lxbaserat | d14e45479e964178f165e330954120cf0e3c26714af9a4339ccd41aa017a4c83

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
INQUIRY -2026-17085.js
Size 715KB
Sample261006-vr61ssbt3x
SHA256 d14e45479e964178f165e330954120cf0e3c26714af9a4339ccd41aa017a4c83
MD5 8a611642fb4ac78d061de94ea64da8ad
SHA1 51d35c4d2e3c7e5673775b5cf5943947e69ec33c
SHA512 ea45bdfd8ffdddc56aa28aac52364c80b5ca985243664ef2b45a3765e1fa14cdc0aadab8837e0f11745124f5c645e937bc57dbad2a248582da115eb1ae9d1e3a
SSDEEP 12288:qIqpz9qQxmyFxIs+aE0L3y73dpDDxBNDu1Hfg5c92gR2D3NUBpSmuKFkIdB9gFUJ:qIq59qQxmkxxZ3CbdpDdBA1/Ec92gR2k
TLSH
T1BCF49E31627C905D2967A45B733BB1237A1EFB2DD2063B4045FE43C671E60BA92374AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

group1 cd58a8089d8b482492963be28d647613 discovery execution lxbaserat persistence rat

Malware Config

Extracted

Family

lxbaserat

Version

1.0.41

Botnet

Group1

Campaign

cd58a8089d8b482492963be28d647613

64.89.160.127:4561

Attributes

directory
WindowsTelemetry\Logs
executable
client.exe
password
cauuJmSgqABv6V4OS54U

Signatures

Family: LxBaseRAT
LxBaseRAT is a .NET remote access trojan with stealer capabilities.
rat lxbaserat

Executes dropped EXE 2 IoCs

pid	Process
2248	netcfghelperznx.exe
2816	netcfghelperznx.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2248 set thread context of 3156	2248	netcfghelperznx.exe	97
PID 2816 set thread context of 5596	2816	netcfghelperznx.exe	98

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wscript.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3228	schtasks.exe
5412	schtasks.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 3228	2248	netcfghelperznx.exe	91
PID 2816 wrote to memory of 5412	2816	netcfghelperznx.exe	95
PID 2248 wrote to memory of 3156	2248	netcfghelperznx.exe	97
PID 2248 wrote to memory of 3156	2248	netcfghelperznx.exe	97
PID 2248 wrote to memory of 3156	2248	netcfghelperznx.exe	97
PID 2248 wrote to memory of 3156	2248	netcfghelperznx.exe	97
PID 2816 wrote to memory of 5596	2816	netcfghelperznx.exe	98
PID 2816 wrote to memory of 5596	2816	netcfghelperznx.exe	98
PID 2816 wrote to memory of 5596	2816	netcfghelperznx.exe	98
PID 2816 wrote to memory of 5596	2816	netcfghelperznx.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\INQUIRY -2026-17085.js"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:1084

C:\Users\Admin\AppData\Local\Temp\netcfghelperznx.exe
"C:\Users\Admin\AppData\Local\Temp\netcfghelperznx.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /tn PolicyCacheRefresh /xml "C:\Users\Admin\AppData\Local\Temp\lx3F61.tmp" /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3228
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  2⤵
  PID:3156

C:\Users\Admin\AppData\Local\PolicyCache\netcfghelperznx.exe
C:\Users\Admin\AppData\Local\PolicyCache\netcfghelperznx.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /create /tn PolicyCacheRefresh /xml "C:\Users\Admin\AppData\Local\Temp\lx4329.tmp" /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5412
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  2⤵
  PID:5596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cacheznx.dat

Path C:\Users\Admin\AppData\Local\Temp\cacheznx.dat
Size 285KB
SHA256 315ed2a77c0b47930d9f86df1fc882edbd3b50fa50b221d17ad8440cb0834f3f
MD5 c0e42961843dfec5f4cd7d4ef36ac9d1
SHA1 23ce4eb0f56148405b6d2e2d1d0e1b9630c1c759
SHA512 e8ecf2773771a0f7a995096cc6a337e54cb4a919b41e12ef09268d3293facc9edb11a170d50c6a21a0d3f7c773abbb10ec005b19b186c52fc6140eab757319e4
SSDEEP 6144:oc+ZXf8C8CMzvzpPhIfcvV+wb6SsjGWV3Xq1YvPBgBWLmHJNzvL4H:j+ZPiz7IfcvVJ2dV3Xq1YvPyWLAtzO
TLSH
T116542363D1944E8DEFBB2D13D7657A765B4EC0CF9D58FA1F8E76C2A1E313494202808A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lx3F61.tmp

Path C:\Users\Admin\AppData\Local\Temp\lx3F61.tmp
Size 1KB
SHA256 dfaee2f9af6f3535a4bdd770d249b1b6a71d25201d00603780f497184b567730
MD5 b32713729392ffbff08f5063c291b424
SHA1 414402b363b79c506571fef59a69d4446c1b11f3
SHA512 76161917ce40e097844ba35292f890f54a3ea546b43ab54211fc5a24c13195c28c17da5246a055497673b278d14df9eb12d758ddc851982c1b7f324f4a99f0e8
TLSH
T142316743ABFD220DF2F3AF9CAEBAA45199B6FD655D28D46D0064090D0531E70CAB1B37
MD5 SHA1 SHA512 TLSH

Submit Download

netcfghelperznx.exe

Path C:\Users\Admin\AppData\Local\Temp\netcfghelperznx.exe
Size 31KB
SHA256 3179ff9fa230f514bbf08535d39aebb164457c905d0af85ea1bcc3e02d88f9ab
MD5 7602e28b855d2dc05590d12dc29188f0
SHA1 400643c3de9fae533029fd2eca036e2ad81114a7
SHA512 6a48cf9f3d88191b3fb5474ffb4e8070f0ade437c4e0884e09d0b82d7f2c503dd340fbdc37f8dc444f05fc274556e0a19a3fecb19ab349481f21c5daf8ef85e6
SSDEEP 384:pMKKTZWB5e1QO+KmcpHIcFiVfm6JabfOjJBbjUxEV5A3f21bcCGJpJgLa0MplHvQ:uKjSbTWgCV5Av214gLa1THvQ
TLSH
T1CEE2D73553DD7178D28F62B66FE390DB6979B0B071B3224532A2DBB92E364F0662430D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2248-12-0x0000000000590000-0x0000000000591000-memory.dmp

Download

memory/2248-17-0x0000000000810000-0x0000000000811000-memory.dmp

Download

memory/2248-15-0x0000000000800000-0x0000000000801000-memory.dmp

Download

memory/2248-13-0x00000000007E0000-0x00000000007E1000-memory.dmp

Download

memory/2248-11-0x0000000000580000-0x0000000000581000-memory.dmp

Download

memory/2248-10-0x0000000000570000-0x0000000000571000-memory.dmp

Download

memory/3156-16-0x0000000000400000-0x0000000000496000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads