Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
02/11/2026, 14:57
General
- Target secured_stub.ps1
- Size 2.6MB
- Sample261102-sbjt8aay7x
- SHA256 75b41d1f69a1a6f7332585e18f5ff54412d4196aecacf2bb7c7ab409571f5599
Malware Config
Extracted
-
lxbaserat
-
1.0.51
-
Pele
-
53c537e4fe37442fb41e8443ae058f49
-
65.21.212.75:62025
-
directory
WindowsTelemetry\Logs
-
executable
client.exe
-
password
wQBHvvlRzs8I9qiDqbTf
Signatures
- Family: LxBaseRAT
LxBaseRAT is a .NET remote access trojan with stealer capabilities.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- ConfuserEx .NET packer 2 IoCs
Detects ConfuserEx .NET packer.
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 2 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\secured_stub.ps11⤵
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"3⤵
- Loads dropped DLL
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /nologo /optimize+ /target:exe /platform:x64 /unsafe+ /out:"C:\Users\Admin\AppData\Local\Temp\.dfc_55bc6258.dat" "C:\Users\Admin\AppData\Local\Temp\.dfc_55bc6258.tmp"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:AMD64 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE347.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB1C9C9A2E1824C088143683EB463719.TMP"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\.dfc_55bc6258.dat"C:\Users\Admin\AppData\Local\Temp\.dfc_55bc6258.dat" 3616 "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\msasn1.dll" "\\.\pipe\chrome.nacl.62152_0AF8"3⤵
- Executes dropped EXE
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /nologo /optimize+ /target:exe /platform:x64 /unsafe+ /out:"C:\Users\Admin\AppData\Local\Temp\.dfc_6f76c013.dat" "C:\Users\Admin\AppData\Local\Temp\.dfc_6f76c013.tmp"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:AMD64 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE606.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCBB178251C02641CAB7102DD737ECA6B7.TMP"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\.dfc_6f76c013.dat"C:\Users\Admin\AppData\Local\Temp\.dfc_6f76c013.dat" "C:\Program Files\Mozilla Firefox" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7ww62gjg.Admin|Admin;C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release|default-release" "C:\Users\Admin\AppData\Local\Temp\c376-95cl-adc1-7451\Firefox"3⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "3064" "2220" "2160" "2224" "0" "0" "2228" "0" "0" "0" "0" "0"2⤵
- Checks processor information in registry
- Enumerates system info in registry
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
msasn1.dll
.dfc_55bc6258.dat
.dfc_6f76c013.dat
RESE347.tmp
RESE606.tmp
__PSScriptPolicyTest_cny4ktx5.tox.ps1
2bfa1a703d89411e9b0aff4d2231cd6a.db
.dfc_55bc6258.tmp
.dfc_6f76c013.tmp
CSCB1C9C9A2E1824C088143683EB463719.TMP
CSCBB178251C02641CAB7102DD737ECA6B7.TMP
memory/2120-55-0x0000000000AB0000-0x0000000000AB6000-memory.dmp
memory/3064-21-0x000001F967BC0000-0x000001F967D0E000-memory.dmp
memory/3064-9-0x000001F9659E0000-0x000001F9659F0000-memory.dmp
memory/3064-19-0x000001F9659E0000-0x000001F9659F0000-memory.dmp
memory/3064-18-0x000001F9659E0000-0x000001F9659F0000-memory.dmp
memory/3064-0-0x000001F9659E0000-0x000001F9659F0000-memory.dmp
memory/3064-105-0x000001F967BC0000-0x000001F967D0E000-memory.dmp
memory/3064-112-0x000001F967BC0000-0x000001F967D0E000-memory.dmp
memory/3064-11-0x000001F967F60000-0x000001F967F66000-memory.dmp
memory/3064-48-0x000001F9659E0000-0x000001F9659F0000-memory.dmp
memory/3064-10-0x000001F967F50000-0x000001F967F66000-memory.dmp
memory/3064-1-0x000001F967A90000-0x000001F967AB2000-memory.dmp
memory/4488-85-0x0000000000D40000-0x0000000000D46000-memory.dmp
memory/4872-15-0x0000000006DF0000-0x0000000006E56000-memory.dmp
memory/4872-42-0x0000000009990000-0x0000000009EBC000-memory.dmp
memory/4872-41-0x0000000009290000-0x0000000009452000-memory.dmp
memory/4872-40-0x0000000009070000-0x00000000090C0000-memory.dmp
memory/4872-27-0x0000000007BC0000-0x0000000007BCA000-memory.dmp
memory/4872-26-0x0000000005910000-0x0000000005920000-memory.dmp
memory/4872-20-0x00000000073E0000-0x0000000007472000-memory.dmp
memory/4872-14-0x0000000005FD0000-0x0000000006574000-memory.dmp
memory/4872-96-0x0000000005910000-0x0000000005920000-memory.dmp
memory/4872-98-0x0000000005910000-0x0000000005920000-memory.dmp
memory/4872-13-0x0000000005910000-0x0000000005920000-memory.dmp
memory/4872-12-0x0000000000400000-0x00000000004A0000-memory.dmp