lxbaserat | 8fd8f83d1ced581a9412d3323591cdff9b2c7e70498719bf15da996056f704aa

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 15:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
구매 문의 Purchase Inquiry_0.js
Size 711KB
Sample261011-spbe1aca98
SHA256 8fd8f83d1ced581a9412d3323591cdff9b2c7e70498719bf15da996056f704aa
MD5 ba37ff258781144dbd96c4b140050eed
SHA1 4701b854458631e3f235a68821d15879e595d879
SHA512 65896b22dadc1c479f602ad0dc01567240a91144b854c0b3069f659bc109b874f3db465dcff1a65ae538542849c664813dc8568ef65da27d2615f6617230988a
SSDEEP 12288:lNvTOKEmu/41BZefjgAulKJODcirJ61dyNTxaHscUNUGC9iU3e8MoSBoj2Z:lNvTOK/u/sBZef3uKJOAiV6byN1gscol
TLSH
T144F48E30627C905E3967945B2737B5737A1EB72DD20A2B4105FE83C271E61BA52338EB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

group1 1890e289a8e24876b03f7195f1d5a1e5 discovery execution lxbaserat persistence rat

Malware Config

Extracted

Family

lxbaserat

Version

1.0.41

Botnet

Group1

Campaign

1890e289a8e24876b03f7195f1d5a1e5

64.89.160.127:4561

Attributes

directory
WindowsTelemetry\Logs
executable
client.exe
password
dxwloGHWdUH6yaQyyWMV

Signatures

Family: LxBaseRAT
LxBaseRAT is a .NET remote access trojan with stealer capabilities.
rat lxbaserat

Executes dropped EXE 1 IoCs

pid	Process
3172	diagcoreqb.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3172 set thread context of 908	3172	diagcoreqb.exe	92

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wscript.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1956	schtasks.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3172 wrote to memory of 908	3172	diagcoreqb.exe	92
PID 3172 wrote to memory of 908	3172	diagcoreqb.exe	92
PID 3172 wrote to memory of 908	3172	diagcoreqb.exe	92
PID 3172 wrote to memory of 908	3172	diagcoreqb.exe	92
PID 3900 wrote to memory of 1956	3900	wscript.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\구매 문의 Purchase Inquiry_0.js"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:3900
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "ChannelIndex97" /xml "C:\Users\Admin\AppData\Local\Temp\1622449.xml" /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1956

C:\Users\Admin\AppData\Local\Temp\diagcoreqb.exe
"C:\Users\Admin\AppData\Local\Temp\diagcoreqb.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3172
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  2⤵
  PID:908

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:5492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1622449.xml

Path C:\Users\Admin\AppData\Local\Temp\1622449.xml
Size 1KB
SHA256 c0800da8fee37877131bd56a88a7b6294e6c9645c788d1883605e667bc70dcd6
MD5 7a0cd4f50e0d7f5fe1a75abb6a1960be
SHA1 63706a67db4da8cd093048779e67f16306360844
SHA512 5891c9de5ecadc456b7b07838f3609f5b644482d6086024bd3199c2a75bf20384876e1d4bc3b20a2d2ad4a944fc72248326d97ae1235dacbe5d505303c99c232
TLSH
T16F316843ABFD220DF2F7AF5CAEB6646199BAFDA55C28D46D0070094D0930A71C9B1B37
MD5 SHA1 SHA512 TLSH

Submit Download

diagcoreqb.exe

Path C:\Users\Admin\AppData\Local\Temp\diagcoreqb.exe
Size 24KB
SHA256 e1e7df8ba2c78fbd150545011c0debbb32f19838aaa9b513f88c1a989adb2487
MD5 c36168982ec0f6c7dd671153ff3db476
SHA1 b2ecf5b328a4ddc3e24b248c3e1fe2740b1ca2b9
SHA512 81b0156c9b98ba6c969e53ccb1085717e2a5b0188499f3575f9c7af48dfc819dfa8c4ef2b328bfac9895fa86cd54c972a3d7c1a7d7e2b37642cc362281aff084
SSDEEP 384:KMlsGe6V5T9B9NAPCuDT74emJCSS7xjQG6JpJgLa0MpefUrz/H:ZlsGe639BzcbCAdAgLa1sfUX/H
TLSH
T1D8B2A23563ECE078D26F60BA2FE2948A6435F0B553A170063360AFB53EB6DF8255834D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

receiptqb.dat

Path C:\Users\Admin\AppData\Local\Temp\receiptqb.dat
Size 285KB
SHA256 a51712003a622316d4ba414445a28ed0738dbcd8fbb1f04bd688040e5ec51e97
MD5 9cfb485e7a424bdcbe93d66c0ddb4238
SHA1 e56d0c4d958624ab0c09e109c4ac408d3c0832bc
SHA512 46f272af341bbf010688307f1b81af277c4a7995db18c5e581340c470d715787e7451e14ce6dd8b463e394e4cb93fed7c1c20965e715331059b16581c9019a0f
SSDEEP 6144:X8Sxt7glj/Qd+HZ53kH6xGPOrrdCU10CwgGEdfQO86U1hir8:X80gW852APMUq3gRdIORi
TLSH
T1A554220FF132B07BF4DA913C8EA7A76C77C5979654E4DF074AAAE9112707E90017928C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/908-11-0x0000000000400000-0x0000000000496000-memory.dmp

Download

memory/3172-5-0x0000000000410000-0x0000000000411000-memory.dmp

Download

memory/3172-12-0x0000000000810000-0x0000000000811000-memory.dmp

Download

memory/3172-10-0x0000000000800000-0x0000000000801000-memory.dmp

Download

memory/3172-8-0x00000000007E0000-0x00000000007E1000-memory.dmp

Download

memory/3172-6-0x00000000007C0000-0x00000000007C1000-memory.dmp

Download

memory/3172-7-0x00000000007D0000-0x00000000007D1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads