lxbaserat | a86ef7bae584abfc22910223a63831976b95340470ae72b85604488faa063530

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 15:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Quotation 1380567 PROJECT DOOU.js
Size 773KB
Sample261011-spa48sca96
SHA256 a86ef7bae584abfc22910223a63831976b95340470ae72b85604488faa063530
MD5 93525777501e6f6aa9a760fb98de7330
SHA1 46d6261a68b7199b19341fca5cf9b91d6d396c4e
SHA512 1b1e344f20be288ffdd9286fba0eb8254ed5fc0f72a4bbcf413357a1b434ce0d5f92b46f0e626d7eb1f33ba807fe3aea383d320cbeb672fc47c8d17050ac1080
SSDEEP 24576:5qYWrGFPXYWxv3H7KIIVWVHAyg1zR1Bmz:55AWJrKIWbRS
TLSH
T1B8F423C1AB193FDF097CEA7A2501378B23C64F8689B882D8F7E05C1B439589E5B36547
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

group1 1890e289a8e24876b03f7195f1d5a1e5 discovery execution lxbaserat persistence rat

Malware Config

Extracted

Family

lxbaserat

Version

1.0.41

Botnet

Group1

Campaign

1890e289a8e24876b03f7195f1d5a1e5

64.89.160.127:4561

Attributes

directory
WindowsTelemetry\Logs
executable
client.exe
password
dxwloGHWdUH6yaQyyWMV

Signatures

Family: LxBaseRAT
LxBaseRAT is a .NET remote access trojan with stealer capabilities.
rat lxbaserat

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1848	2948	powershell.exe	93

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1848	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1848 set thread context of 2568	1848	powershell.exe	98

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wscript.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2304	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1848	powershell.exe
1848	powershell.exe
1848	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1848	powershell.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5312 wrote to memory of 2304	5312	wscript.exe	89
PID 1848 wrote to memory of 3400	1848	powershell.exe	96
PID 3400 wrote to memory of 6040	3400	csc.exe	97
PID 1848 wrote to memory of 2568	1848	powershell.exe	98
PID 1848 wrote to memory of 2568	1848	powershell.exe	98
PID 1848 wrote to memory of 2568	1848	powershell.exe	98
PID 1848 wrote to memory of 2568	1848	powershell.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Quotation 1380567 PROJECT DOOU.js"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:5312
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "DeviceCatalog51" /xml "C:\Users\Admin\AppData\Local\Temp\1235703.xml" /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2304

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:3524

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\b75c5b1.ps1"
1⤵
- Process spawned unexpected child process
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uj3bbctt\uj3bbctt.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3400
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES937C.tmp" "c:\Users\Admin\AppData\Local\Temp\uj3bbctt\CSCA1BE2772652C410E87BA8664A23C7757.TMP"
    3⤵
    PID:6040
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1235703.xml

Path C:\Users\Admin\AppData\Local\Temp\1235703.xml
Size 1KB
SHA256 fb42bb1291d477cda4c52bddcaf7a5dff094b5491b9f07b20f66769bded9c606
MD5 cda38a4df6c377ce7def4327302b5802
SHA1 8357d61bce9f1df22291fe25c2adfa6e6eca178e
SHA512 4821a4f81a3e8e723f28c18d096799836fcdf38cc80a2665b12cf070ecc8c8934bcc03d1c46fd67c74a9d0f2881b7dadfe19355e590aca154bb63dc0acfc2367
TLSH
T14D41084367FE2209F1F76B9CAAB758515EA7BD694C34947D00BC0A0D0BB3962C960736
MD5 SHA1 SHA512 TLSH

Submit Download

RES937C.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES937C.tmp
Size 1KB
SHA256 1c4c88ad51a6738d3008b4cb89ed8d130585107a797e05f1af5f29b5fae5d523
MD5 b066591ed29cb3f6637166233a236531
SHA1 57fcaedb9429cc87593c70ded535a845d4676bf7
SHA512 cbb4bb291408a5e658fa9e6f00cf612c81729f8457aee374a54338f8064253479f7dd473af35290d75c1eb1b0d05e8ccc560459807f68526c210dd8c384f8747
TLSH
T1F721A60193E8471AF0B357326AEA076BA279FC65EF61976E8584022C2C41500EFA1AB6
MD5 SHA1 SHA512 TLSH

Submit Download

uj3bbctt.dll

Path C:\Users\Admin\AppData\Local\Temp\uj3bbctt\uj3bbctt.dll
Size 10KB
SHA256 f5e6dd0f4b79757f24814c26199787d63046c61554cedceb56c4ee0f452cc7c2
MD5 7a0445617eaae94bb401be67c24821ab
SHA1 752e0fe27cb752763e0e5bb53963b70ab5715b8a
SHA512 19ec60cb20192a3d7aa4bb6ef9c3d4c5a623feea1013ad03cced866a1dc1858acf0ec872f5ec75fc3fb92a359eb22767fcd9adb06b03224feca3b74586202676
SSDEEP 192:TTjxjB8AVxwPS+qKUGKdC5Scvpq8QMZuZpPWRwT16a2zZ72t2f:TTFj+AVxT09K0vTQRZpWZ6tG
TLSH
T1DC22C71B17ED9763E4BF1B39A5A701C6C530E932078BE32B09D8647D6D50BE03B567A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b75c5b1.ps1

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\b75c5b1.ps1
Size 373KB
SHA256 c233e09935e7a2db5edbd3edaab37057ce709b547e1861a6dc05d8edcf70899a
MD5 a7c0986e9ac8f15b484e8866a31e3628
SHA1 9c90e33567d2ce847288c60acbe717ac536a2dd1
SHA512 8089167c780418a8477c71a7f4223050c528187549b3698a2533c68194898c3667fbb79e0462bf1f7b9ee8ec7e33d83c79e7d0c31e3a0221b77f57ca738d9dc8
SSDEEP 6144:XDaXv/THM9gZCJxPzirrJxIPhYaIrpCnSetkCipM1zdz1OrVOHSYEEgSDQasbA4j:TaXv/w9wCJxrIIPhY1NetkzpMrz16OHu
TLSH
T131842322104C0C6E41F5AD14550EA72DEF736BB99DA9AF74BA46224B0F0F2DA05339DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCA1BE2772652C410E87BA8664A23C7757.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\uj3bbctt\CSCA1BE2772652C410E87BA8664A23C7757.TMP
Size 652B
SHA256 c060485a5b31e16b7cdff840020c5eecb12c36697f72bd88ffde36392f1c7e0a
MD5 c6afa206d6562bcdf0f44f9d00a1aac6
SHA1 7c06c683af0afcf599fd3aed17db9b9de5646ac1
SHA512 8ce85f52b3079a8d72f37552ffd4a8b00faa9a9d2b7eb702f410c4b54b381bedc114fee9b39081e749538a2ea6c6479f1fa34b0a5b3b251675ec6b3f5fca3b8a
TLSH
T1A3F0541963F8020EF0F34B30BEF543A79569FC66EE3293ED1490031D1C645108A62F76
MD5 SHA1 SHA512 TLSH

Submit Download

uj3bbctt.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\uj3bbctt\uj3bbctt.0.cs
Size 9KB
SHA256 ecdcfb0952b86700a926ad57cbcf6f651fe476dceddc239c1ec912b21f4bc4c4
MD5 8fd6683a9277f1823acd61a62710f46a
SHA1 75212a270dced1ae658d6c18a10372eb5220c816
SHA512 b543155f48b78dc59ba90433334fc5f458644116781d531b26aa49441d3ca0e5f7a13872e982d2923fb20d34c522b977166c921b63970c59363b8bcf961e9f17
SSDEEP 192:3xeVc9hgUxfAHM9iiVGeeiJkLhz/gnETwkt:BeV+eUxEMJpkt
TLSH
T102129499092C41AA40FE6909D9C5112EFB4375730AF86E3074CE52651FAE2CEF237F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uj3bbctt.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\uj3bbctt\uj3bbctt.cmdline
Size 369B
SHA256 86ac94a2eea3f93be079a22a06bd6dcafc84e6724b92f0b801de6c430f3ca2db
MD5 29d7e84b17389b32b2408d377dfa7850
SHA1 13ddcad3e167252370a545bf82005a8a59645abe
SHA512 e8fe1955755d7f8818dbf6099224b049a8ed23654f2a9f301b7f684f7f09df8f045f77751c14bd3c1873a7e33ad30bf35f8a697affe3ff1782721543a8b1ba20
TLSH
T1B3E0682A4696C2FE11FB104F21ABC8EC8AB246432D40BFA86084485DD01711467D2B75
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1848-5-0x000002502A690000-0x000002502A6B2000-memory.dmp

Download

memory/1848-19-0x00000250121D0000-0x00000250121DA000-memory.dmp

Download

memory/2568-20-0x0000000000400000-0x0000000000496000-memory.dmp

Download