Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/09/2026, 05:51
Static task
static1
Behavioral task
behavioral1
Sample
Purchase_Orders 61022_for_Approval Globus Incorporated FZE Ref20.js
Resource
win10v2004-20260911-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
Purchase_Orders 61022_for_Approval Globus Incorporated FZE Ref20.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target Purchase_Orders 61022_for_Approval Globus Incorporated FZE Ref20.js
- Size 754KB
- Sample260930-gkagcssbkg
- SHA256 e67e6162c362efc29de15c4be46b7d9e3baaa64dfd8661bcc5b10fc20bbc4afc
- MD5 1370f14477e3d040e511c92821688a41
- SHA1 26e2e62b952de6da13272c07c6b72fb7dd32d7a5
- SHA512 68e3c064015f6aa335e97ffc73b4aef5a4af72c3239835e20e4c2854372ccad38d4275afa706c46dc426fe3294a336d76ba081778ccf5110458baaeb09beb3c2
- SSDEEP 12288:WM8gonoYEI4MXgFlap1j92k7v7X9Ku432phu4/g6k7GYVu+X03dLPHDZZIt:f4BRwapF92E7X9Kudphu4Tk7lVu+Xkdc
- TLSH T143F49E31623C905D3D67A45B6737B1237A1EBB2DD20A2B4045FE43C671F60BA92374AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
lxbaserat
Version
-
1.0.46
Botnet
-
Group1
Campaign
-
8cd56ba334da40e69d867aead8892a9a
C2
-
96.9.226.39:4521
Attributes
-
directory
WindowsTelemetry\Logs
-
executable
client.exe
-
password
WdKP3bkYENazFmKbBMic
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation wscript.exe - Executes dropped EXE 1 IoCs
pid Process 4972 manifestsvcjhw.exe - Loads dropped DLL 1 IoCs
pid Process 1316 chrome.exe - Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook InstallUtil.exe Key queried \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe - Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 23 ip-api.com - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4972 set thread context of 228 4972 manifestsvcjhw.exe 99 - Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain wmic.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 228 InstallUtil.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe 228 InstallUtil.exe - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 228 InstallUtil.exe Token: SeIncreaseQuotaPrivilege 640 wmic.exe Token: SeSecurityPrivilege 640 wmic.exe Token: SeTakeOwnershipPrivilege 640 wmic.exe Token: SeLoadDriverPrivilege 640 wmic.exe Token: SeSystemProfilePrivilege 640 wmic.exe Token: SeSystemtimePrivilege 640 wmic.exe Token: SeProfSingleProcessPrivilege 640 wmic.exe Token: SeIncBasePriorityPrivilege 640 wmic.exe Token: SeCreatePagefilePrivilege 640 wmic.exe Token: SeBackupPrivilege 640 wmic.exe Token: SeRestorePrivilege 640 wmic.exe Token: SeShutdownPrivilege 640 wmic.exe Token: SeDebugPrivilege 640 wmic.exe Token: SeSystemEnvironmentPrivilege 640 wmic.exe Token: SeRemoteShutdownPrivilege 640 wmic.exe Token: SeUndockPrivilege 640 wmic.exe Token: SeManageVolumePrivilege 640 wmic.exe Token: 33 640 wmic.exe Token: 34 640 wmic.exe Token: 35 640 wmic.exe Token: 36 640 wmic.exe Token: SeIncreaseQuotaPrivilege 640 wmic.exe Token: SeSecurityPrivilege 640 wmic.exe Token: SeTakeOwnershipPrivilege 640 wmic.exe Token: SeLoadDriverPrivilege 640 wmic.exe Token: SeSystemProfilePrivilege 640 wmic.exe Token: SeSystemtimePrivilege 640 wmic.exe Token: SeProfSingleProcessPrivilege 640 wmic.exe Token: SeIncBasePriorityPrivilege 640 wmic.exe Token: SeCreatePagefilePrivilege 640 wmic.exe Token: SeBackupPrivilege 640 wmic.exe Token: SeRestorePrivilege 640 wmic.exe Token: SeShutdownPrivilege 640 wmic.exe Token: SeDebugPrivilege 640 wmic.exe Token: SeSystemEnvironmentPrivilege 640 wmic.exe Token: SeRemoteShutdownPrivilege 640 wmic.exe Token: SeUndockPrivilege 640 wmic.exe Token: SeManageVolumePrivilege 640 wmic.exe Token: 33 640 wmic.exe Token: 34 640 wmic.exe Token: 35 640 wmic.exe Token: 36 640 wmic.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 228 InstallUtil.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2224 wrote to memory of 4972 2224 wscript.exe 96 PID 4972 wrote to memory of 228 4972 manifestsvcjhw.exe 99 PID 4972 wrote to memory of 228 4972 manifestsvcjhw.exe 99 PID 4972 wrote to memory of 228 4972 manifestsvcjhw.exe 99 PID 4972 wrote to memory of 228 4972 manifestsvcjhw.exe 99 PID 228 wrote to memory of 640 228 InstallUtil.exe 100 PID 228 wrote to memory of 1316 228 InstallUtil.exe 102 - outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Purchase_Orders 61022_for_Approval Globus Incorporated FZE Ref20.js"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\rad47314.tmp\manifestsvcjhw.exe"C:\Users\Admin\AppData\Local\Temp\rad47314.tmp\manifestsvcjhw.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe3⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
PID:228 -
C:\Windows\System32\Wbem\wmic.exe"wmic" process where ProcessId=4972 get CommandLine /value4⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"4⤵
- Loads dropped DLL
PID:1316
-
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:396
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:3088
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\msasn1.dll
- Size 63KB
- SHA256 0232e3d13e53fc069b113190903be389ec59f5991acd99aecc8011d19c2d9282
- MD5 96a644ea4c30cd71c965810ad0bdad55
- SHA1 e748e8bc6cee870b0fb5ea798faa29f0832170f3
- SHA512 7b22ea69c18b7e1f4114fe2368688ebfc9a64803dfe23a2b0d460caf62c27e6f5b00b10752ebf69172eba040b7bcd5580a9fb9bf72025297dc6d47438fd13de0
- SSDEEP 1536:MGLiTh9ZTWZg8FjwYDbCgs7ZodphAQ/m5:MGLiTh9uMYqgsiph9
- TLSH T1FF53C53871C981B7C297CD30586DBF12527330A38FE1669F33ACF61D1E7979A2A1650A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\c376-95cl-adc1-7451\.temp\d45e37b3083a4e9089018889c73414da.db
- Size 40KB
- SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
- MD5 ba979c77c714b67908bc582ec373c723
- SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
- SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
- SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
- TLSH T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\rad47314.tmp\manifestsvcjhw.exe
- Size 20KB
- SHA256 79cf945c66fe5346a8669ab5891d2e6f864eaab2989facbc065ea42f8d36cb94
- MD5 7a1cc3f3e24d7c51c6b55e60e93fc1ae
- SHA1 20fdf68bcb5e339f301d2b1dfe319e88d72e9c24
- SHA512 46312b6367f74c7b052bbfba392ad20c93585c4823e08062430238e44021521d136d66c364409391a0113599e460b6e73bee16a570477c63403104c56928eb16
- SSDEEP 384:UMRILLeoDBx9SySZJpJgLa0MpkB1A1fU:bR0DBx9SfgLa1uXEfU
- TLSH T1A992E87983DD9278D29F54F56FE29A9E2C24F0B111B0340263B0AFB52F3A9F0596C359
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\rad47314.tmp\workspacejhw.cache
- Size 320KB
- SHA256 1c0eccd594d68130eec74bc1df334a2029e18009074ef58bb6ebba2fb33c6546
- MD5 7f3de9c9979a91b79a6977b4b4da1d5f
- SHA1 7a5dc8e66006e14dba36fa343305ceea66f7634f
- SHA512 6952092f384b10f9e8cbe6f67dfdc61baa8e928897d3fcd26c90440fbfeefc497872f782160868dd3231290d621f6d620aa4a851d13e8cdf9bbf88d7e7a4c404
- SSDEEP 6144:cya2EUYEhVEjLc8V72bOp41GSkNNV7k2yD17QQHCaPYITU03Jjy2eo:Ja2ETEhVEjL/Vi6EotyJ7flgITU09ko
- TLSH T17A6423B8DA8CF09B406FA7E223AA5A5484DB96477C1E2D02DBF01C1C4C945FB7AE15C7
- MD5 SHA1 SHA512 SSDEEP TLSH