Analysis
- user interaction
yes - max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/11/2026, 14:57
General
- Target secured_stub.ps1
- Size 2.6MB
- Sample261102-sbjt8aay7x
- SHA256 75b41d1f69a1a6f7332585e18f5ff54412d4196aecacf2bb7c7ab409571f5599
Malware Config
Extracted
-
lxbaserat
-
1.0.51
-
Pele
-
53c537e4fe37442fb41e8443ae058f49
-
65.21.212.75:62025
-
directory
WindowsTelemetry\Logs
-
executable
client.exe
-
password
wQBHvvlRzs8I9qiDqbTf
Signatures
- Family: LxBaseRAT
LxBaseRAT is a .NET remote access trojan with stealer capabilities.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- ConfuserEx .NET packer 1 IoCs
Detects ConfuserEx .NET packer.
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\secured_stub.ps11⤵
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"3⤵
- Loads dropped DLL
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /nologo /optimize+ /target:exe /platform:x64 /unsafe+ /out:"C:\Users\Admin\AppData\Local\Temp\.dfc_b47ecc4a.dat" "C:\Users\Admin\AppData\Local\Temp\.dfc_b47ecc4a.tmp"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:AMD64 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4690.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD147478D53C4450D99D84238A38074A8.TMP"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\.dfc_b47ecc4a.dat"C:\Users\Admin\AppData\Local\Temp\.dfc_b47ecc4a.dat" 5688 "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\msasn1.dll" "\\.\pipe\mojo.20021.7842.2CF8.chrome"3⤵
- Executes dropped EXE
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /nologo /optimize+ /target:exe /platform:x64 /unsafe+ /out:"C:\Users\Admin\AppData\Local\Temp\.dfc_45d1b93b.dat" "C:\Users\Admin\AppData\Local\Temp\.dfc_45d1b93b.tmp"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:AMD64 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4910.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCE9C0D64F9DBE4418A055E83CCF9470EB.TMP"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\.dfc_45d1b93b.dat"C:\Users\Admin\AppData\Local\Temp\.dfc_45d1b93b.dat" "C:\Program Files\Mozilla Firefox" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4e6yyh2i.Admin|Admin;C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release|default-release" "C:\Users\Admin\AppData\Local\Temp\c376-95cl-adc1-7451\Firefox"3⤵
- Executes dropped EXE
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
msasn1.dll
.dfc_45d1b93b.dat
.dfc_b47ecc4a.dat
RES4690.tmp
RES4910.tmp
474d9b6f3cb0432fa54409b2bab0b782.db
.dfc_45d1b93b.tmp
.dfc_b47ecc4a.tmp
CSCD147478D53C4450D99D84238A38074A8.TMP
CSCE9C0D64F9DBE4418A055E83CCF9470EB.TMP
memory/2808-13-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp
memory/2808-5-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp
memory/2808-15-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp
memory/2808-16-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp
memory/2808-14-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp
memory/2808-17-0x000001DDB8650000-0x000001DDB8666000-memory.dmp
memory/2808-18-0x000001DDB8660000-0x000001DDB8666000-memory.dmp
memory/2808-4-0x000001DDB85F0000-0x000001DDB8612000-memory.dmp
memory/2808-3-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp
memory/2808-12-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp
memory/2808-6-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp
memory/2808-7-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp
memory/2808-27-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp
memory/2808-28-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp
memory/2808-8-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp
memory/2808-30-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp
memory/2808-9-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp
memory/2808-0-0x00007FFB23A5F000-0x00007FFB23A60000-memory.dmp
memory/2808-10-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp
memory/2808-11-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp
memory/2876-36-0x0000000074FA0000-0x000000007575C000-memory.dmp
memory/2876-23-0x0000000006660000-0x00000000066C6000-memory.dmp
memory/2876-43-0x0000000008A70000-0x0000000008C32000-memory.dmp
memory/2876-42-0x0000000007E50000-0x0000000007EA0000-memory.dmp
memory/2876-35-0x0000000007340000-0x000000000734A000-memory.dmp
memory/2876-93-0x0000000074FA0000-0x000000007575C000-memory.dmp
memory/2876-29-0x0000000006C60000-0x0000000006CF2000-memory.dmp
memory/2876-44-0x0000000009970000-0x0000000009E9C000-memory.dmp
memory/2876-22-0x0000000005780000-0x0000000005D3A000-memory.dmp
memory/2876-21-0x0000000074FA0000-0x000000007575C000-memory.dmp
memory/2876-20-0x0000000074FB2000-0x0000000074FB3000-memory.dmp
memory/2876-19-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/2876-92-0x0000000074FA0000-0x000000007575C000-memory.dmp
memory/2876-91-0x0000000074FB2000-0x0000000074FB3000-memory.dmp
memory/3728-55-0x00000000007E0000-0x00000000007E6000-memory.dmp
memory/5388-82-0x0000000000F60000-0x0000000000F66000-memory.dmp