lxbaserat | 8393bba56d997984a22b008bf2a829039c8467c789d14e567fcf2eff135839a3 | Triage™

Analysis

max time kernel
298s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 01:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
YÊU CẦU MUA HÀNG GIÁ CẢ.js
Size 537KB
Sample261027-cdxabsax8j
SHA256 8393bba56d997984a22b008bf2a829039c8467c789d14e567fcf2eff135839a3
MD5 9d71f06182537e3ad8ca1a3c0f3fe6a4
SHA1 c651c49a0502b2264cc2e0d0f16a1a9d18676293
SHA512 ba71f377f4059762aebd3dc5094ebe596acbd8e9b08419decbd51092b84544ca1b1be39dea660c96f83cc56bda4bdfb1c3c6c93f192590013e3b988e76e9b7e8
SSDEEP 12288:BJDJGTIgkyPdIawjhxeH1vs2Kwz4niLCPn6/RgnXUjxIT8:xGcYdIZhxq1vsDwz4qCcjOw
TLSH
T160C41213FED3A8648989A178B37F171C5CAD335D689C94A66E95708627A4E02CC1FC8F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

group1 b035796145e84b0dabf48060f919ffa0 discovery execution lxbaserat persistence rat

Malware Config

Extracted

Family

lxbaserat

Version

1.0.43

Botnet

Group1

Campaign

b035796145e84b0dabf48060f919ffa0

C2

64.89.160.127:4561

Attributes

directory
WindowsTelemetry\Logs
executable
client.exe
password
et8gcU2iTViVWqMGTp60

Signatures

Family: LxBaseRAT
LxBaseRAT is a .NET remote access trojan with stealer capabilities.
rat lxbaserat

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4960	4168	powershell.exe	92

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

PowerShell

pid	Process
4960	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	wscript.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Internet Connection Discovery

flow	ioc
29	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4960 set thread context of 4764	4960	powershell.exe	100

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

System Network Configuration Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wscript.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
1224	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4960	powershell.exe
4960	powershell.exe
4764	MSBuild.exe
4764	MSBuild.exe
4764	MSBuild.exe
4764	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4960	powershell.exe
Token: SeDebugPrivilege	4764	MSBuild.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4764	MSBuild.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 1224	4556	wscript.exe	85
PID 4960 wrote to memory of 4764	4960	powershell.exe	100
PID 4960 wrote to memory of 4764	4960	powershell.exe	100
PID 4960 wrote to memory of 4764	4960	powershell.exe	100
PID 4960 wrote to memory of 4764	4960	powershell.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\YÊU CẦU MUA HÀNG GIÁ CẢ.js"
1⤵
- Checks computer location settings
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "SchemaStore57" /xml "C:\Users\Admin\AppData\Local\Temp\3472113.xml" /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1224

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:924

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "[scriptblock]::Create([IO.File]::ReadAllText('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\da695f4c.ps1')).Invoke()"
1⤵
- Process spawned unexpected child process
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

PowerShell

Scheduled Task/Job

Scheduled Task

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Scheduled Task/Job

Scheduled Task

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3472113.xml

Path C:\Users\Admin\AppData\Local\Temp\3472113.xml
Size 1KB
SHA256 7c30230a7ebdd4728215688453973973d4de1e5b8fd8977bf3e6955c99a7c4cc
MD5 4803857e7e96968373e72e0ae6782a4d
SHA1 6a9b9325f46fb2c9ad67abf7095df8314dd8f628
SHA512 c8fcd8e7152061bb1fe78202be6c8964aa711602a8452cc9925b3a65edff0ee8f71725d4197efc87d34645a54ba05c886c1cf851a584c4f26813cec1f78b0d60
TLSH
T1AA413943A7FE2109F1F35B9CAAB754115EA7BD695C39947D00BC0A0D0BB3962C960B37
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ep14pai3.dit.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ep14pai3.dit.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

da695f4c.ps1

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\da695f4c.ps1
Size 380KB
SHA256 5cf0f3b2189afc327d5151794a124c64e38e362ce7bdb3df743d00b4080ba1f8
MD5 c50c0c7b5050f03957c6bd5b0932e193
SHA1 ed058f1d973d91b4d3e56a68366e9ac60c47b80a
SHA512 f0ef5dc34cfdcff43f259ae92fe035a4cbdeabaa726163121ea7bf8c6abc5c240134a7290fccc03db955dd19b306ad7fe9cca7c91f07796e53951bd884b1ec5f
SSDEEP 6144:6m3zOhiKceRwI36P4fAew5ad+7ns0rkUASh8KtcyyVpxp+soqJsKQWvpY8VjzMk+:6dw+3o5ad+js07cySo4sKlQP
TLSH
T1BC8423C4EF000FEB94E45EAD30240EAD7EE41A8DC8DAE5C48F95689E6D8DED54039B19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4764-14-0x0000000000400000-0x0000000000496000-memory.dmp

Download

memory/4960-11-0x0000022EE3220000-0x0000022EE3242000-memory.dmp

Download

memory/4960-13-0x0000022EE3210000-0x0000022EE321A000-memory.dmp

Download