Analysis
- max time kernel
149s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
26/10/2026, 17:51
General
- Target H2mzrg74S9G1HknTq9LWPptDOaYqz0O9a4dK69OYoQQ.js
- Size 654KB
- Sample261026-wfac5abf37
- SHA256 1f69b3ae0ef84bd1b51e49d3abd2d63e9b4339a62acf43bd6b874aebd398a104
Malware Config
Extracted
-
lxbaserat
-
1.0.51
-
General
-
1aac089f0eec48da9cd636019342394f
-
general.activeworkshops.com:4521
-
directory
WindowsTelemetry\Logs
-
executable
client.exe
-
password
JxC41yjMt9nWZNpYLUNB
Signatures
- Family: LxBaseRAT
LxBaseRAT is a .NET remote access trojan with stealer capabilities.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\H2mzrg74S9G1HknTq9LWPptDOaYqz0O9a4dK69OYoQQ.js1⤵
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "[scriptblock]::Create([IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\yoflzmzelp\w97130.ps1')).Invoke()"1⤵
- Process spawned unexpected child process
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\suwzeiui\suwzeiui.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDC1E.tmp" "c:\Users\Admin\AppData\Local\Temp\suwzeiui\CSC9A4BC8579FEA4CB692F2A0F3798EE8C1.TMP"3⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe2⤵
-
-
C:\Windows\system32\wscript.exewscript.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RESDC1E.tmp
suwzeiui.dll
w97130.ps1
CSC9A4BC8579FEA4CB692F2A0F3798EE8C1.TMP
suwzeiui.0.cs
suwzeiui.cmdline
memory/2740-12-0x00007FFF31830000-0x00007FFF321D4000-memory.dmp
memory/2740-31-0x00007FFF31830000-0x00007FFF321D4000-memory.dmp
memory/2740-11-0x00007FFF31830000-0x00007FFF321D4000-memory.dmp
memory/2740-1-0x00007FFF319BF000-0x00007FFF319C0000-memory.dmp
memory/2740-13-0x00007FFF31830000-0x00007FFF321D4000-memory.dmp
memory/2740-9-0x000001CBBFA30000-0x000001CBBFA52000-memory.dmp
memory/2740-6-0x00007FFF31830000-0x00007FFF321D4000-memory.dmp
memory/2740-5-0x00007FFF31830000-0x00007FFF321D4000-memory.dmp
memory/2740-15-0x00007FFF31830000-0x00007FFF321D4000-memory.dmp
memory/2740-4-0x00007FFF31830000-0x00007FFF321D4000-memory.dmp
memory/2740-28-0x000001CBA7420000-0x000001CBA7428000-memory.dmp
memory/2740-3-0x00007FFF31830000-0x00007FFF321D4000-memory.dmp
memory/2740-2-0x00007FFF31830000-0x00007FFF321D4000-memory.dmp
memory/2740-29-0x000001CBBFB00000-0x000001CBBFB1A000-memory.dmp
memory/2740-30-0x00007FFF31830000-0x00007FFF321D4000-memory.dmp
memory/2740-10-0x00007FFF31830000-0x00007FFF321D4000-memory.dmp
memory/2740-32-0x00007FFF31830000-0x00007FFF321D4000-memory.dmp
memory/2740-33-0x00007FFF31830000-0x00007FFF321D4000-memory.dmp
memory/2740-34-0x00007FFF31830000-0x00007FFF321D4000-memory.dmp
memory/2740-36-0x00007FFF31830000-0x00007FFF321D4000-memory.dmp
memory/2740-37-0x00007FFF31830000-0x00007FFF321D4000-memory.dmp
memory/2740-38-0x00007FFF31830000-0x00007FFF321D4000-memory.dmp
memory/2740-39-0x00007FFF31830000-0x00007FFF321D4000-memory.dmp
memory/2740-40-0x00007FFF31830000-0x00007FFF321D4000-memory.dmp
memory/2740-41-0x00007FFF31830000-0x00007FFF321D4000-memory.dmp
memory/2740-42-0x00007FFF31830000-0x00007FFF321D4000-memory.dmp
memory/2740-43-0x00007FFF31830000-0x00007FFF321D4000-memory.dmp
memory/2740-44-0x00007FFF31830000-0x00007FFF321D4000-memory.dmp
memory/2740-45-0x000001CBBFAC0000-0x000001CBBFAC8000-memory.dmp
memory/2740-48-0x00007FFF31830000-0x00007FFF321D4000-memory.dmp
memory/3192-46-0x0000000000400000-0x000000000049E000-memory.dmp