Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
04/11/2026, 15:58
General
- Target Declaration Aproval Details.pdf.vbe
- Size 3KB
- Sample261104-tek25asycs
- SHA256 206cfbabb6175852a80ccfff9884e6019a39d712de6c198a3ac43e4e4e9f9c45
Malware Config
Extracted
-
lxbaserat
-
1.0.51
-
Group1
-
26e0c7f5f459424a99c5778f99297a1d
-
Gaza.gleeze.com:2712
-
directory
WindowsTelemetry\Logs
-
executable
client.exe
-
password
OPYC89fCsflfswL10NaU
Signatures
- Family: LxBaseRAT
LxBaseRAT is a .NET remote access trojan with stealer capabilities.
- Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Declaration Aproval Details.pdf.vbe"1⤵
- Badlisted process makes network request
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -ep bypass -file "C:\Temp\JBTSFMPY.ps1"2⤵
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"3⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"4⤵
- Loads dropped DLL
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /nologo /optimize+ /target:exe /platform:x64 /unsafe+ /out:"C:\Users\Admin\AppData\Local\Temp\.dfc_6b45b5f4.dat" "C:\Users\Admin\AppData\Local\Temp\.dfc_6b45b5f4.tmp"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:AMD64 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB4BB.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB7D532A82AFF46B5B2C47F8CD526186.TMP"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\.dfc_6b45b5f4.dat"C:\Users\Admin\AppData\Local\Temp\.dfc_6b45b5f4.dat" 2936 "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\msasn1.dll" "\\.\pipe\mojo.48060.7250.0608.chrome"4⤵
- Executes dropped EXE
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /nologo /optimize+ /target:exe /platform:x64 /unsafe+ /out:"C:\Users\Admin\AppData\Local\Temp\.dfc_8320fa99.dat" "C:\Users\Admin\AppData\Local\Temp\.dfc_8320fa99.tmp"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:AMD64 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB72C.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4D350D0523A84B04BB272C4C6F891661.TMP"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\.dfc_8320fa99.dat"C:\Users\Admin\AppData\Local\Temp\.dfc_8320fa99.dat" "C:\Program Files\Mozilla Firefox" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4e6yyh2i.Admin|Admin;C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\8z6dgki7.default-release|default-release" "C:\Users\Admin\AppData\Local\Temp\c376-95cl-adc1-7451\Firefox"4⤵
- Executes dropped EXE
-
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
JBTSFMPY.ps1
msasn1.dll
.dfc_6b45b5f4.dat
.dfc_8320fa99.dat
RESB4BB.tmp
RESB72C.tmp
badd188d798845ba9dc77b69c4c6b476.db
.dfc_6b45b5f4.tmp
.dfc_8320fa99.tmp
CSC4D350D0523A84B04BB272C4C6F891661.TMP
CSCB7D532A82AFF46B5B2C47F8CD526186.TMP
memory/1180-61-0x0000000000230000-0x0000000000236000-memory.dmp
memory/2324-34-0x0000000000400000-0x00000000004A0000-memory.dmp
memory/2324-35-0x0000000005C10000-0x00000000061CA000-memory.dmp
memory/2324-50-0x0000000007B60000-0x000000000808C000-memory.dmp
memory/2324-49-0x0000000007460000-0x0000000007622000-memory.dmp
memory/2324-48-0x0000000007220000-0x0000000007270000-memory.dmp
memory/2324-36-0x0000000006B30000-0x0000000006B96000-memory.dmp
memory/3304-27-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp
memory/3304-23-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp
memory/3304-33-0x000001BE634D0000-0x000001BE634DE000-memory.dmp
memory/3304-32-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp
memory/3304-31-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp
memory/3304-30-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp
memory/3304-28-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp
memory/3304-29-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp
memory/3304-26-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp
memory/3304-25-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp
memory/3304-24-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp
memory/3304-14-0x00007FFF8BA6F000-0x00007FFF8BA70000-memory.dmp
memory/3304-21-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp
memory/3304-20-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp
memory/3304-19-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp
memory/3304-16-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp
memory/3304-15-0x000001BE63460000-0x000001BE63482000-memory.dmp
memory/3304-100-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp
memory/3304-98-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp
memory/3304-99-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp
memory/3808-88-0x0000000000960000-0x0000000000966000-memory.dmp