lxbaserat | e67e6162c362efc29de15c4be46b7d9e3baaa64dfd8661bcc5b10fc20bbc4afc

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 05:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Purchase_Orders 61022_for_Approval Globus Incorporated FZE Ref20.js
Size 754KB
Sample260930-gkagcssbkg
SHA256 e67e6162c362efc29de15c4be46b7d9e3baaa64dfd8661bcc5b10fc20bbc4afc
MD5 1370f14477e3d040e511c92821688a41
SHA1 26e2e62b952de6da13272c07c6b72fb7dd32d7a5
SHA512 68e3c064015f6aa335e97ffc73b4aef5a4af72c3239835e20e4c2854372ccad38d4275afa706c46dc426fe3294a336d76ba081778ccf5110458baaeb09beb3c2
SSDEEP 12288:WM8gonoYEI4MXgFlap1j92k7v7X9Ku432phu4/g6k7GYVu+X03dLPHDZZIt:f4BRwapF92E7X9Kudphu4Tk7lVu+Xkdc
TLSH
T143F49E31623C905D3D67A45B6737B1237A1EBB2DD20A2B4045FE43C671F60BA92374AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

group1 8cd56ba334da40e69d867aead8892a9a execution lxbaserat rat

Malware Config

Extracted

Family

lxbaserat

Version

1.0.46

Botnet

Group1

Campaign

8cd56ba334da40e69d867aead8892a9a

96.9.226.39:4521

Attributes

directory
WindowsTelemetry\Logs
executable
client.exe
password
WdKP3bkYENazFmKbBMic

Signatures

Family: LxBaseRAT
LxBaseRAT is a .NET remote access trojan with stealer capabilities.
rat lxbaserat

Executes dropped EXE 1 IoCs

pid	Process
6032	manifestsvcjhw.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 6032 set thread context of 3336	6032	manifestsvcjhw.exe	89

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 6032	4948	wscript.exe	88
PID 6032 wrote to memory of 3336	6032	manifestsvcjhw.exe	89
PID 6032 wrote to memory of 3336	6032	manifestsvcjhw.exe	89
PID 6032 wrote to memory of 3336	6032	manifestsvcjhw.exe	89
PID 6032 wrote to memory of 3336	6032	manifestsvcjhw.exe	89

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Purchase_Orders 61022_for_Approval Globus Incorporated FZE Ref20.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Users\Admin\AppData\Local\Temp\rad49DF6.tmp\manifestsvcjhw.exe
  "C:\Users\Admin\AppData\Local\Temp\rad49DF6.tmp\manifestsvcjhw.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:6032
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
    3⤵
    PID:3336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifestsvcjhw.exe

Path C:\Users\Admin\AppData\Local\Temp\rad49DF6.tmp\manifestsvcjhw.exe
Size 20KB
SHA256 79cf945c66fe5346a8669ab5891d2e6f864eaab2989facbc065ea42f8d36cb94
MD5 7a1cc3f3e24d7c51c6b55e60e93fc1ae
SHA1 20fdf68bcb5e339f301d2b1dfe319e88d72e9c24
SHA512 46312b6367f74c7b052bbfba392ad20c93585c4823e08062430238e44021521d136d66c364409391a0113599e460b6e73bee16a570477c63403104c56928eb16
SSDEEP 384:UMRILLeoDBx9SySZJpJgLa0MpkB1A1fU:bR0DBx9SfgLa1uXEfU
TLSH
T1A992E87983DD9278D29F54F56FE29A9E2C24F0B111B0340263B0AFB52F3A9F0596C359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

workspacejhw.cache

Path C:\Users\Admin\AppData\Local\Temp\rad49DF6.tmp\workspacejhw.cache
Size 320KB
SHA256 1c0eccd594d68130eec74bc1df334a2029e18009074ef58bb6ebba2fb33c6546
MD5 7f3de9c9979a91b79a6977b4b4da1d5f
SHA1 7a5dc8e66006e14dba36fa343305ceea66f7634f
SHA512 6952092f384b10f9e8cbe6f67dfdc61baa8e928897d3fcd26c90440fbfeefc497872f782160868dd3231290d621f6d620aa4a851d13e8cdf9bbf88d7e7a4c404
SSDEEP 6144:cya2EUYEhVEjLc8V72bOp41GSkNNV7k2yD17QQHCaPYITU03Jjy2eo:Ja2ETEhVEjL/Vi6EotyJ7flgITU09ko
TLSH
T17A6423B8DA8CF09B406FA7E223AA5A5484DB96477C1E2D02DBF01C1C4C945FB7AE15C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3336-16-0x0000000000400000-0x000000000049C000-memory.dmp

Download

memory/6032-11-0x00000000008C0000-0x00000000008C1000-memory.dmp

Download

memory/6032-10-0x00000000008B0000-0x00000000008B1000-memory.dmp

Download

memory/6032-12-0x00000000008D0000-0x00000000008D1000-memory.dmp

Download

memory/6032-15-0x0000000000900000-0x0000000000901000-memory.dmp

Download

memory/6032-17-0x0000000000910000-0x0000000000911000-memory.dmp

Download

memory/6032-13-0x00000000008E0000-0x00000000008E1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads