lxbaserat | 42f0e94c6a4e1d4b05ae29ecb3b67ff7ae3cbcc6002e959b7882a96d49cc2913

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 08:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Thư Yêu Cầu Mua HàngF.js
Size 780KB
Sample260930-kc55vasdmg
SHA256 42f0e94c6a4e1d4b05ae29ecb3b67ff7ae3cbcc6002e959b7882a96d49cc2913
MD5 3891eb8ef4d5eab6765ba6ca17ef3378
SHA1 5b4b54affbddd1463b07c9fefe68caea8b71aad1
SHA512 e1d6efb8c0aa3041ddef7c99b78ab00e3de341400db55593323fb4551f4cea72a5b72253b9780f8de5b90a9b9ae9986a55c66ea1c60f98695772def5893afac4
SSDEEP 12288:5JKFiyTWnpQ3RECXrslPPftH1KfaDpyEM2xL8qfFTFplQ4VCMA/B0v:HKFr2cEmshtHQyU/2xL86p3DPAJe
TLSH
T1DD05E1202539E02F467BC11163AA624C99BD97458619F61E703DD2F24FFB0B522A7FCB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

group1 1890e289a8e24876b03f7195f1d5a1e5 execution lxbaserat persistence rat

Malware Config

Extracted

Family

lxbaserat

Version

1.0.41

Botnet

Group1

Campaign

1890e289a8e24876b03f7195f1d5a1e5

64.89.160.127:4561

Attributes

directory
WindowsTelemetry\Logs
executable
client.exe
password
dxwloGHWdUH6yaQyyWMV

Signatures

Family: LxBaseRAT
LxBaseRAT is a .NET remote access trojan with stealer capabilities.
rat lxbaserat

Enumerates connected drives 3 TTPs 3 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	wscript.exe
\??\F:\	wscript.exe
\??\F:\	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5356 set thread context of 5668	5356	powershell.exe	95

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5356	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5356	powershell.exe
5356	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5356	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4440 wrote to memory of 5752	4440	wscript.exe	89
PID 5752 wrote to memory of 5356	5752	wscript.exe	91
PID 5356 wrote to memory of 5668	5356	powershell.exe	95
PID 5356 wrote to memory of 5668	5356	powershell.exe	95
PID 5356 wrote to memory of 5668	5356	powershell.exe	95
PID 5356 wrote to memory of 5668	5356	powershell.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Thư Yêu Cầu Mua HàngF.js"
1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Windows\system32\wscript.exe
  "C:\Windows\system32\wscript.exe" //B //NoLogo "C:\Users\Admin\AppData\Local\PrintQueue\ledger90359.js"
  2⤵
  - Enumerates connected drives
  - Suspicious use of WriteProcessMemory
  PID:5752
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -File "queue49461.ps1"
    3⤵
    - Enumerates connected drives
    - Suspicious use of SetThreadContext
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5356
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
      4⤵
      PID:5668

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:5724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ledger90359.js

Path C:\Users\Admin\AppData\Local\PrintQueue\ledger90359.js
Size 780KB
SHA256 42f0e94c6a4e1d4b05ae29ecb3b67ff7ae3cbcc6002e959b7882a96d49cc2913
MD5 3891eb8ef4d5eab6765ba6ca17ef3378
SHA1 5b4b54affbddd1463b07c9fefe68caea8b71aad1
SHA512 e1d6efb8c0aa3041ddef7c99b78ab00e3de341400db55593323fb4551f4cea72a5b72253b9780f8de5b90a9b9ae9986a55c66ea1c60f98695772def5893afac4
SSDEEP 12288:5JKFiyTWnpQ3RECXrslPPftH1KfaDpyEM2xL8qfFTFplQ4VCMA/B0v:HKFr2cEmshtHQyU/2xL86p3DPAJe
TLSH
T1DD05E1202539E02F467BC11163AA624C99BD97458619F61E703DD2F24FFB0B522A7FCB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

queue49461.ps1

Path C:\Users\Admin\AppData\Local\PrintQueue\queue49461.ps1
Size 416KB
SHA256 4fa49cbf8dc3d039c3dc076ccc45a2585d4655e1600f11f215527e512a0d64c9
MD5 743868492b63fb9f07a7e6ebe5fb2f04
SHA1 b442db441c54e9b2bbd1f368a439739c6d58b8f6
SHA512 cd32eeb95811b2fe2430252a06e7ddfddf409feeb1270f19e69d3774e4b19a799b601c17fec2556a93ce3ee1091b6d4d449f2539abfc1be8c7257d2eddfa8d90
SSDEEP 12288:X3XSbEtzGll2wkipkxPlVvTF1A8BONH56LEJV:X3XSQw2wJpitVvTfA80Ht
TLSH
T1AF9423064E368E638DB932AA249D0ECE377C5BDC09C02C9DF7D9BD8D10B6759691322D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5356-3-0x000001DAFCBA0000-0x000001DAFCBC2000-memory.dmp

Download

memory/5356-7-0x000001DAFCDB0000-0x000001DAFCDCA000-memory.dmp

Download

memory/5356-8-0x000001DAFCD80000-0x000001DAFCD88000-memory.dmp

Download

memory/5668-9-0x0000000000400000-0x0000000000496000-memory.dmp

Download