Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
07/10/2026, 18:05
General
- Target ΑΠΟΔΕΙΞΗ ΠΑΡΑΔΟΣΗΣ_w.js
- Size 1.2MB
- Sample261007-wpfaqscx3t
- SHA256 60cd45011ec94f6d01c21271090d85956068dd10c9d5ab427117be73bfc44216
Malware Config
Extracted
-
lxbaserat
-
1.0.48
-
Group1
-
648ddaaceaa84770a5d4ab6338c26934
-
64.89.160.127:4561
-
directory
WindowsTelemetry\Logs
-
executable
client.exe
-
password
C0gWMaLjLm9JvXr7pVkw
Signatures
- Family: LxBaseRAT
LxBaseRAT is a .NET remote access trojan with stealer capabilities.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\ΑΠΟΔΕΙΞΗ ΠΑΡΑΔΟΣΗΣ_w.js"1⤵
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\system32\wscript.exewscript.exe1⤵
-
C:\Windows\system32\cmd.execmd.exe /c ""C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoPr -NonI -WindowStyle Hidden -C "[scriptblock]::Create([IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\28682.ps1')).Invoke()""1⤵
- Process spawned unexpected child process
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoPr -NonI -WindowStyle Hidden -C "[scriptblock]::Create([IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\28682.ps1')).Invoke()"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe3⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"4⤵
- Loads dropped DLL
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /nologo /optimize+ /target:exe /platform:x64 /unsafe+ /out:"C:\Users\Admin\AppData\Local\Temp\.dfc_78a69b79.dat" "C:\Users\Admin\AppData\Local\Temp\.dfc_78a69b79.tmp"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:AMD64 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8A6F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC1317C633A46745478374A3B3313F023.TMP"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\.dfc_78a69b79.dat"C:\Users\Admin\AppData\Local\Temp\.dfc_78a69b79.dat" 592 "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\msasn1.dll" "\\.\pipe\chrome.sync.33856.8090.B9C0"4⤵
- Executes dropped EXE
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /nologo /optimize+ /target:exe /platform:x64 /unsafe+ /out:"C:\Users\Admin\AppData\Local\Temp\.dfc_4c865f98.dat" "C:\Users\Admin\AppData\Local\Temp\.dfc_4c865f98.tmp"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:AMD64 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8CB1.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC739AC0AAD0B244808C16DD3B427C77CA.TMP"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\.dfc_4c865f98.dat"C:\Users\Admin\AppData\Local\Temp\.dfc_4c865f98.dat" "C:\Program Files\Mozilla Firefox" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz9oy164.Admin|Admin;C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release|default-release" "C:\Users\Admin\AppData\Local\Temp\c376-95cl-adc1-7451\Firefox"4⤵
- Executes dropped EXE
-
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3JavaScript
1PowerShell
1Windows Command Shell
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
msasn1.dll
.dfc_4c865f98.dat
.dfc_78a69b79.dat
28682.ps1
RES8A6F.tmp
RES8CB1.tmp
fc3a11e358ca4aacbb625b60c43f542c.db
.dfc_4c865f98.tmp
.dfc_78a69b79.tmp
CSC1317C633A46745478374A3B3313F023.TMP
CSC739AC0AAD0B244808C16DD3B427C77CA.TMP
memory/3240-22-0x00000000055B0000-0x0000000005B6A000-memory.dmp
memory/3240-28-0x0000000007030000-0x000000000703A000-memory.dmp
memory/3240-20-0x0000000000700000-0x00000000007A0000-memory.dmp
memory/3240-40-0x00000000091C0000-0x00000000096EC000-memory.dmp
memory/3240-39-0x0000000008AC0000-0x0000000008C82000-memory.dmp
memory/3240-38-0x00000000088A0000-0x00000000088F0000-memory.dmp
memory/3240-27-0x0000000006E80000-0x0000000006F12000-memory.dmp
memory/3680-79-0x000000001BC00000-0x000000001BEB4000-memory.dmp
memory/3680-78-0x0000000000460000-0x0000000000466000-memory.dmp
memory/4936-51-0x00000000003F0000-0x00000000003F6000-memory.dmp
memory/5160-1-0x00000000744D2000-0x00000000744D3000-memory.dmp
memory/5160-7-0x00000000063A0000-0x0000000006406000-memory.dmp
memory/5160-15-0x000000000B370000-0x000000000B9EC000-memory.dmp
memory/5160-21-0x00000000744C0000-0x0000000074C7C000-memory.dmp
memory/5160-13-0x0000000006970000-0x00000000069BC000-memory.dmp
memory/5160-12-0x0000000006940000-0x000000000695E000-memory.dmp
memory/5160-11-0x0000000006480000-0x00000000067DB000-memory.dmp
memory/5160-8-0x0000000006410000-0x0000000006476000-memory.dmp
memory/5160-18-0x000000000AB80000-0x000000000AB88000-memory.dmp
memory/5160-24-0x00000000744C0000-0x0000000074C7C000-memory.dmp
memory/5160-6-0x0000000005A50000-0x0000000005A72000-memory.dmp
memory/5160-5-0x00000000744C0000-0x0000000074C7C000-memory.dmp
memory/5160-4-0x0000000005CE0000-0x000000000632A000-memory.dmp
memory/5160-3-0x00000000744C0000-0x0000000074C7C000-memory.dmp
memory/5160-2-0x0000000003410000-0x0000000003446000-memory.dmp
memory/5160-17-0x000000000AB40000-0x000000000AB5A000-memory.dmp
memory/5160-16-0x000000000AAF0000-0x000000000AB0A000-memory.dmp