lxbaserat | d14e45479e964178f165e330954120cf0e3c26714af9a4339ccd41aa017a4c83

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/10/2026, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
INQUIRY -2026-17085.js
Size 715KB
Sample261006-vr61ssbt3x
SHA256 d14e45479e964178f165e330954120cf0e3c26714af9a4339ccd41aa017a4c83
MD5 8a611642fb4ac78d061de94ea64da8ad
SHA1 51d35c4d2e3c7e5673775b5cf5943947e69ec33c
SHA512 ea45bdfd8ffdddc56aa28aac52364c80b5ca985243664ef2b45a3765e1fa14cdc0aadab8837e0f11745124f5c645e937bc57dbad2a248582da115eb1ae9d1e3a
SSDEEP 12288:qIqpz9qQxmyFxIs+aE0L3y73dpDDxBNDu1Hfg5c92gR2D3NUBpSmuKFkIdB9gFUJ:qIq59qQxmkxxZ3CbdpDdBA1/Ec92gR2k
TLSH
T1BCF49E31627C905D2967A45B733BB1237A1EFB2DD2063B4045FE43C671E60BA92374AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

group1 cd58a8089d8b482492963be28d647613 collection discovery execution lxbaserat persistence rat

Malware Config

Extracted

Family

lxbaserat

Version

1.0.41

Botnet

Group1

Campaign

cd58a8089d8b482492963be28d647613

64.89.160.127:4561

Attributes

directory
WindowsTelemetry\Logs
executable
client.exe
password
cauuJmSgqABv6V4OS54U

Signatures

Family: LxBaseRAT
LxBaseRAT is a .NET remote access trojan with stealer capabilities.
rat lxbaserat

Executes dropped EXE 2 IoCs

pid	Process
1700	netcfghelperznx.exe
4072	netcfghelperznx.exe

Loads dropped DLL 1 IoCs

pid	Process
3068	chrome.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	MSBuild.exe
Key queried	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
22	ip-api.com

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1700 set thread context of 1376	1700	netcfghelperznx.exe	102
PID 4072 set thread context of 3692	4072	netcfghelperznx.exe	105

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wscript.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2392	schtasks.exe
3100	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1376	MSBuild.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
3692	MSBuild.exe
3692	MSBuild.exe
3692	MSBuild.exe
3692	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe
1376	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1376	MSBuild.exe
Token: SeIncreaseQuotaPrivilege	4228	wmic.exe
Token: SeSecurityPrivilege	4228	wmic.exe
Token: SeTakeOwnershipPrivilege	4228	wmic.exe
Token: SeLoadDriverPrivilege	4228	wmic.exe
Token: SeSystemProfilePrivilege	4228	wmic.exe
Token: SeSystemtimePrivilege	4228	wmic.exe
Token: SeProfSingleProcessPrivilege	4228	wmic.exe
Token: SeIncBasePriorityPrivilege	4228	wmic.exe
Token: SeCreatePagefilePrivilege	4228	wmic.exe
Token: SeBackupPrivilege	4228	wmic.exe
Token: SeRestorePrivilege	4228	wmic.exe
Token: SeShutdownPrivilege	4228	wmic.exe
Token: SeDebugPrivilege	4228	wmic.exe
Token: SeSystemEnvironmentPrivilege	4228	wmic.exe
Token: SeRemoteShutdownPrivilege	4228	wmic.exe
Token: SeUndockPrivilege	4228	wmic.exe
Token: SeManageVolumePrivilege	4228	wmic.exe
Token: 33	4228	wmic.exe
Token: 34	4228	wmic.exe
Token: 35	4228	wmic.exe
Token: 36	4228	wmic.exe
Token: SeIncreaseQuotaPrivilege	4228	wmic.exe
Token: SeSecurityPrivilege	4228	wmic.exe
Token: SeTakeOwnershipPrivilege	4228	wmic.exe
Token: SeLoadDriverPrivilege	4228	wmic.exe
Token: SeSystemProfilePrivilege	4228	wmic.exe
Token: SeSystemtimePrivilege	4228	wmic.exe
Token: SeProfSingleProcessPrivilege	4228	wmic.exe
Token: SeIncBasePriorityPrivilege	4228	wmic.exe
Token: SeCreatePagefilePrivilege	4228	wmic.exe
Token: SeBackupPrivilege	4228	wmic.exe
Token: SeRestorePrivilege	4228	wmic.exe
Token: SeShutdownPrivilege	4228	wmic.exe
Token: SeDebugPrivilege	4228	wmic.exe
Token: SeSystemEnvironmentPrivilege	4228	wmic.exe
Token: SeRemoteShutdownPrivilege	4228	wmic.exe
Token: SeUndockPrivilege	4228	wmic.exe
Token: SeManageVolumePrivilege	4228	wmic.exe
Token: 33	4228	wmic.exe
Token: 34	4228	wmic.exe
Token: 35	4228	wmic.exe
Token: 36	4228	wmic.exe
Token: SeDebugPrivilege	3692	MSBuild.exe
Token: SeIncreaseQuotaPrivilege	3148	wmic.exe
Token: SeSecurityPrivilege	3148	wmic.exe
Token: SeTakeOwnershipPrivilege	3148	wmic.exe
Token: SeLoadDriverPrivilege	3148	wmic.exe
Token: SeSystemProfilePrivilege	3148	wmic.exe
Token: SeSystemtimePrivilege	3148	wmic.exe
Token: SeProfSingleProcessPrivilege	3148	wmic.exe
Token: SeIncBasePriorityPrivilege	3148	wmic.exe
Token: SeCreatePagefilePrivilege	3148	wmic.exe
Token: SeBackupPrivilege	3148	wmic.exe
Token: SeRestorePrivilege	3148	wmic.exe
Token: SeShutdownPrivilege	3148	wmic.exe
Token: SeDebugPrivilege	3148	wmic.exe
Token: SeSystemEnvironmentPrivilege	3148	wmic.exe
Token: SeRemoteShutdownPrivilege	3148	wmic.exe
Token: SeUndockPrivilege	3148	wmic.exe
Token: SeManageVolumePrivilege	3148	wmic.exe
Token: 33	3148	wmic.exe
Token: 34	3148	wmic.exe
Token: 35	3148	wmic.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1376	MSBuild.exe
3692	MSBuild.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2392	1700	netcfghelperznx.exe	95
PID 4072 wrote to memory of 3100	4072	netcfghelperznx.exe	99
PID 1700 wrote to memory of 1376	1700	netcfghelperznx.exe	102
PID 1700 wrote to memory of 1376	1700	netcfghelperznx.exe	102
PID 1700 wrote to memory of 1376	1700	netcfghelperznx.exe	102
PID 1700 wrote to memory of 1376	1700	netcfghelperznx.exe	102
PID 1376 wrote to memory of 4228	1376	MSBuild.exe	103
PID 4072 wrote to memory of 3692	4072	netcfghelperznx.exe	105
PID 4072 wrote to memory of 3692	4072	netcfghelperznx.exe	105
PID 4072 wrote to memory of 3692	4072	netcfghelperznx.exe	105
PID 4072 wrote to memory of 3692	4072	netcfghelperznx.exe	105
PID 3692 wrote to memory of 3148	3692	MSBuild.exe	106
PID 1376 wrote to memory of 3068	1376	MSBuild.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\INQUIRY -2026-17085.js"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:3668

C:\Users\Admin\AppData\Local\Temp\netcfghelperznx.exe
"C:\Users\Admin\AppData\Local\Temp\netcfghelperznx.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn PolicyCacheRefresh /xml "C:\Users\Admin\AppData\Local\Temp\lxD666.tmp" /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2392
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  PID:1376
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where ProcessId=1700 get CommandLine /value
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of AdjustPrivilegeToken
    PID:4228
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    - Loads dropped DLL
    PID:3068

C:\Users\Admin\AppData\Local\PolicyCache\netcfghelperznx.exe
C:\Users\Admin\AppData\Local\PolicyCache\netcfghelperznx.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn PolicyCacheRefresh /xml "C:\Users\Admin\AppData\Local\Temp\lxD7CD.tmp" /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3100
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3692
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic" process where ProcessId=4072 get CommandLine /value
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of AdjustPrivilegeToken
    PID:3148

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4892

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msasn1.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\msasn1.dll
Size 63KB
SHA256 0232e3d13e53fc069b113190903be389ec59f5991acd99aecc8011d19c2d9282
MD5 96a644ea4c30cd71c965810ad0bdad55
SHA1 e748e8bc6cee870b0fb5ea798faa29f0832170f3
SHA512 7b22ea69c18b7e1f4114fe2368688ebfc9a64803dfe23a2b0d460caf62c27e6f5b00b10752ebf69172eba040b7bcd5580a9fb9bf72025297dc6d47438fd13de0
SSDEEP 1536:MGLiTh9ZTWZg8FjwYDbCgs7ZodphAQ/m5:MGLiTh9uMYqgsiph9
TLSH
T1FF53C53871C981B7C297CD30586DBF12527330A38FE1669F33ACF61D1E7979A2A1650A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

40b8551eeb7e45e7bc4f824806a4b192.db

Path C:\Users\Admin\AppData\Local\Temp\c376-95cl-adc1-7451\.temp\40b8551eeb7e45e7bc4f824806a4b192.db
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cacheznx.dat

Path C:\Users\Admin\AppData\Local\Temp\cacheznx.dat
Size 285KB
SHA256 315ed2a77c0b47930d9f86df1fc882edbd3b50fa50b221d17ad8440cb0834f3f
MD5 c0e42961843dfec5f4cd7d4ef36ac9d1
SHA1 23ce4eb0f56148405b6d2e2d1d0e1b9630c1c759
SHA512 e8ecf2773771a0f7a995096cc6a337e54cb4a919b41e12ef09268d3293facc9edb11a170d50c6a21a0d3f7c773abbb10ec005b19b186c52fc6140eab757319e4
SSDEEP 6144:oc+ZXf8C8CMzvzpPhIfcvV+wb6SsjGWV3Xq1YvPBgBWLmHJNzvL4H:j+ZPiz7IfcvVJ2dV3Xq1YvPyWLAtzO
TLSH
T116542363D1944E8DEFBB2D13D7657A765B4EC0CF9D58FA1F8E76C2A1E313494202808A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lxD666.tmp

Path C:\Users\Admin\AppData\Local\Temp\lxD666.tmp
Size 1KB
SHA256 5ff2e743ca6f85b31dab334fb62dbc405960f0543cc0846bcf0313abeab83088
MD5 cb8e3357614af55579dd3f4518997a22
SHA1 74352be10eaf1f54bf4e31a451a0830f04fc385c
SHA512 f8d82a44266091a2ee2cb049c94a080b85169c1fa689f26d4d17f44a4438d4dce7072fb55b906e99488c6cde812d4aebc8d78610ccb1de030363db85f789ba5f
TLSH
T1FE316743ABFD220DF2F36B5CAEBAA45199BAFD655D28D86D0060090D0531D70C9B1B37
MD5 SHA1 SHA512 TLSH

Submit Download

netcfghelperznx.exe

Path C:\Users\Admin\AppData\Local\Temp\netcfghelperznx.exe
Size 31KB
SHA256 3179ff9fa230f514bbf08535d39aebb164457c905d0af85ea1bcc3e02d88f9ab
MD5 7602e28b855d2dc05590d12dc29188f0
SHA1 400643c3de9fae533029fd2eca036e2ad81114a7
SHA512 6a48cf9f3d88191b3fb5474ffb4e8070f0ade437c4e0884e09d0b82d7f2c503dd340fbdc37f8dc444f05fc274556e0a19a3fecb19ab349481f21c5daf8ef85e6
SSDEEP 384:pMKKTZWB5e1QO+KmcpHIcFiVfm6JabfOjJBbjUxEV5A3f21bcCGJpJgLa0MplHvQ:uKjSbTWgCV5Av214gLa1THvQ
TLSH
T1CEE2D73553DD7178D28F62B66FE390DB6979B0B071B3224532A2DBB92E364F0662430D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1376-50-0x000002A72B8D0000-0x000002A72B920000-memory.dmp

Download

memory/1376-79-0x000002A712010000-0x000002A712020000-memory.dmp

Download

memory/1376-20-0x0000000000400000-0x0000000000496000-memory.dmp

Download

memory/1376-52-0x000002A72CCF0000-0x000002A72D218000-memory.dmp

Download

memory/1376-51-0x000002A72C5F0000-0x000002A72C7B2000-memory.dmp

Download

memory/1376-22-0x000002A712010000-0x000002A712020000-memory.dmp

Download

memory/1700-16-0x0000000000810000-0x0000000000811000-memory.dmp

Download

memory/1700-19-0x0000000000840000-0x0000000000841000-memory.dmp

Download

memory/1700-21-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/1700-14-0x00000000004F0000-0x00000000004F1000-memory.dmp

Download

memory/1700-15-0x0000000000800000-0x0000000000801000-memory.dmp

Download

memory/1700-17-0x0000000000820000-0x0000000000821000-memory.dmp

Download