Malware Analysis Report

2025-08-10 17:44

Sample ID 230321-l44a1ahf83
Target BG000896543.exe
SHA256 1fcf39f27164b5bfee7f234220f5cd10f73932d72794cafd678a0dac1297707f
Tags
asyncrat default persistence rat upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1fcf39f27164b5bfee7f234220f5cd10f73932d72794cafd678a0dac1297707f

Threat Level: Known bad

The file BG000896543.exe was found to be: Known bad.

Malicious Activity Summary

asyncrat default persistence rat upx

AsyncRat

Async RAT payload

Executes dropped EXE

Loads dropped DLL

UPX packed file

Adds Run key to start application

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-03-21 10:06

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-03-21 10:06

Reported

2023-03-21 10:08

Platform

win7-20230220-en

Max time kernel

142s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\BG000896543.exe"

Signatures

AsyncRat

rat asyncrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\jmxpydzgw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jmxpydzgw.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Windows\CurrentVersion\Run\enjsn = "C:\\Users\\Admin\\AppData\\Roaming\\uqajfoxscxhq\\mvfbkgpyu.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\jmxpydzgw.exe\" C:\\Users\\Admin\\AppData" C:\Users\Admin\AppData\Local\Temp\jmxpydzgw.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1756 set thread context of 544 N/A C:\Users\Admin\AppData\Local\Temp\jmxpydzgw.exe C:\Users\Admin\AppData\Local\Temp\jmxpydzgw.exe

Enumerates physical storage devices

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\jmxpydzgw.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jmxpydzgw.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\BG000896543.exe

"C:\Users\Admin\AppData\Local\Temp\BG000896543.exe"

C:\Users\Admin\AppData\Local\Temp\jmxpydzgw.exe

"C:\Users\Admin\AppData\Local\Temp\jmxpydzgw.exe" C:\Users\Admin\AppData\Local\Temp\edfxh.uno

C:\Users\Admin\AppData\Local\Temp\jmxpydzgw.exe

"C:\Users\Admin\AppData\Local\Temp\jmxpydzgw.exe"

Network

Country Destination Domain Proto
US 192.3.193.136:2023 tcp

Files

\Users\Admin\AppData\Local\Temp\jmxpydzgw.exe

MD5 41fcc8ea93e353c03f86c4f7f47fb8bf
SHA1 37766be6029410e596c103fa5aa660d4e7de5cb4
SHA256 328f8c311bc7c17bc544d83665216ef125a5ebf1d4acc87423352c9346ded93d
SHA512 ae70ff237246e03ab6836aa6c594a3904be6e9cdc9990618f626622f213a54aabd29e86c3bba8ada3ceaba74f86379facd3172ce04f7405a225e4e11058c1dae

\Users\Admin\AppData\Local\Temp\jmxpydzgw.exe

MD5 41fcc8ea93e353c03f86c4f7f47fb8bf
SHA1 37766be6029410e596c103fa5aa660d4e7de5cb4
SHA256 328f8c311bc7c17bc544d83665216ef125a5ebf1d4acc87423352c9346ded93d
SHA512 ae70ff237246e03ab6836aa6c594a3904be6e9cdc9990618f626622f213a54aabd29e86c3bba8ada3ceaba74f86379facd3172ce04f7405a225e4e11058c1dae

C:\Users\Admin\AppData\Local\Temp\jmxpydzgw.exe

MD5 41fcc8ea93e353c03f86c4f7f47fb8bf
SHA1 37766be6029410e596c103fa5aa660d4e7de5cb4
SHA256 328f8c311bc7c17bc544d83665216ef125a5ebf1d4acc87423352c9346ded93d
SHA512 ae70ff237246e03ab6836aa6c594a3904be6e9cdc9990618f626622f213a54aabd29e86c3bba8ada3ceaba74f86379facd3172ce04f7405a225e4e11058c1dae

C:\Users\Admin\AppData\Local\Temp\jmxpydzgw.exe

MD5 41fcc8ea93e353c03f86c4f7f47fb8bf
SHA1 37766be6029410e596c103fa5aa660d4e7de5cb4
SHA256 328f8c311bc7c17bc544d83665216ef125a5ebf1d4acc87423352c9346ded93d
SHA512 ae70ff237246e03ab6836aa6c594a3904be6e9cdc9990618f626622f213a54aabd29e86c3bba8ada3ceaba74f86379facd3172ce04f7405a225e4e11058c1dae

C:\Users\Admin\AppData\Local\Temp\edfxh.uno

MD5 c7a9d72dcb4c336ed5ce3bc3f84dd1ff
SHA1 89e84e7a721a8de1439caac348214df6130b1d95
SHA256 7d1e0ce820decb490b328f147d873cadf2cc2ff18d2f38fbe314835c0b0bce7d
SHA512 2265247e034ddef51853460a2dedb66e86851912aa4169d795e53911ba63d53857c097398be7d8f7a4b94b0067c47d1ae4baad0b26f0614b07f80cbe1f8452cb

C:\Users\Admin\AppData\Local\Temp\jmxpydzgw.exe

MD5 41fcc8ea93e353c03f86c4f7f47fb8bf
SHA1 37766be6029410e596c103fa5aa660d4e7de5cb4
SHA256 328f8c311bc7c17bc544d83665216ef125a5ebf1d4acc87423352c9346ded93d
SHA512 ae70ff237246e03ab6836aa6c594a3904be6e9cdc9990618f626622f213a54aabd29e86c3bba8ada3ceaba74f86379facd3172ce04f7405a225e4e11058c1dae

C:\Users\Admin\AppData\Local\Temp\grfmfvqbxa.zsd

MD5 da5c2ace84a6bda6b77fa44cffe23637
SHA1 477a8fa4732843cc3c0399cd9256d76e5c3080a9
SHA256 57e9c28db872eb5a639af48bb88a59da1c2c5e8af4832c444ef812162b311181
SHA512 20beee6e71d55a9da667f7d5db2d5480a8a82053a3fbcbe0b0e0d84ac952b120bb52ab424d35a75650d28901a4791d56f4f7520f5138f0da3353040c6344bea1

\Users\Admin\AppData\Local\Temp\jmxpydzgw.exe

MD5 41fcc8ea93e353c03f86c4f7f47fb8bf
SHA1 37766be6029410e596c103fa5aa660d4e7de5cb4
SHA256 328f8c311bc7c17bc544d83665216ef125a5ebf1d4acc87423352c9346ded93d
SHA512 ae70ff237246e03ab6836aa6c594a3904be6e9cdc9990618f626622f213a54aabd29e86c3bba8ada3ceaba74f86379facd3172ce04f7405a225e4e11058c1dae

memory/544-69-0x0000000000400000-0x0000000000426000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\jmxpydzgw.exe

MD5 41fcc8ea93e353c03f86c4f7f47fb8bf
SHA1 37766be6029410e596c103fa5aa660d4e7de5cb4
SHA256 328f8c311bc7c17bc544d83665216ef125a5ebf1d4acc87423352c9346ded93d
SHA512 ae70ff237246e03ab6836aa6c594a3904be6e9cdc9990618f626622f213a54aabd29e86c3bba8ada3ceaba74f86379facd3172ce04f7405a225e4e11058c1dae

memory/544-72-0x0000000000400000-0x0000000000426000-memory.dmp

memory/544-74-0x0000000000400000-0x0000000000426000-memory.dmp

memory/544-75-0x0000000000400000-0x0000000000426000-memory.dmp

memory/544-76-0x00000000005F0000-0x0000000000602000-memory.dmp

memory/544-77-0x0000000001E10000-0x0000000001E50000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-03-21 10:06

Reported

2023-03-21 10:08

Platform

win10v2004-20230220-en

Max time kernel

146s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\BG000896543.exe"

Signatures

AsyncRat

rat asyncrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\jmxpydzgw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\jmxpydzgw.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\enjsn = "C:\\Users\\Admin\\AppData\\Roaming\\uqajfoxscxhq\\mvfbkgpyu.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\jmxpydzgw.exe\" C:\\Users\\Admin\\AppData" C:\Users\Admin\AppData\Local\Temp\jmxpydzgw.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2276 set thread context of 2608 N/A C:\Users\Admin\AppData\Local\Temp\jmxpydzgw.exe C:\Users\Admin\AppData\Local\Temp\jmxpydzgw.exe

Enumerates physical storage devices

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\jmxpydzgw.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jmxpydzgw.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\BG000896543.exe

"C:\Users\Admin\AppData\Local\Temp\BG000896543.exe"

C:\Users\Admin\AppData\Local\Temp\jmxpydzgw.exe

"C:\Users\Admin\AppData\Local\Temp\jmxpydzgw.exe" C:\Users\Admin\AppData\Local\Temp\edfxh.uno

C:\Users\Admin\AppData\Local\Temp\jmxpydzgw.exe

"C:\Users\Admin\AppData\Local\Temp\jmxpydzgw.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 192.3.193.136:2023 tcp
US 8.8.8.8:53 136.193.3.192.in-addr.arpa udp
IE 20.50.80.210:443 tcp
US 8.8.8.8:53 32.146.190.20.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 76.38.195.152.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
NL 8.238.179.126:80 tcp
NL 173.223.113.164:443 tcp
US 8.8.8.8:53 86.8.109.52.in-addr.arpa udp
NL 8.238.179.126:80 tcp
US 8.8.8.8:53 202.74.101.95.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\jmxpydzgw.exe

MD5 41fcc8ea93e353c03f86c4f7f47fb8bf
SHA1 37766be6029410e596c103fa5aa660d4e7de5cb4
SHA256 328f8c311bc7c17bc544d83665216ef125a5ebf1d4acc87423352c9346ded93d
SHA512 ae70ff237246e03ab6836aa6c594a3904be6e9cdc9990618f626622f213a54aabd29e86c3bba8ada3ceaba74f86379facd3172ce04f7405a225e4e11058c1dae

C:\Users\Admin\AppData\Local\Temp\jmxpydzgw.exe

MD5 41fcc8ea93e353c03f86c4f7f47fb8bf
SHA1 37766be6029410e596c103fa5aa660d4e7de5cb4
SHA256 328f8c311bc7c17bc544d83665216ef125a5ebf1d4acc87423352c9346ded93d
SHA512 ae70ff237246e03ab6836aa6c594a3904be6e9cdc9990618f626622f213a54aabd29e86c3bba8ada3ceaba74f86379facd3172ce04f7405a225e4e11058c1dae

C:\Users\Admin\AppData\Local\Temp\edfxh.uno

MD5 c7a9d72dcb4c336ed5ce3bc3f84dd1ff
SHA1 89e84e7a721a8de1439caac348214df6130b1d95
SHA256 7d1e0ce820decb490b328f147d873cadf2cc2ff18d2f38fbe314835c0b0bce7d
SHA512 2265247e034ddef51853460a2dedb66e86851912aa4169d795e53911ba63d53857c097398be7d8f7a4b94b0067c47d1ae4baad0b26f0614b07f80cbe1f8452cb

C:\Users\Admin\AppData\Local\Temp\grfmfvqbxa.zsd

MD5 da5c2ace84a6bda6b77fa44cffe23637
SHA1 477a8fa4732843cc3c0399cd9256d76e5c3080a9
SHA256 57e9c28db872eb5a639af48bb88a59da1c2c5e8af4832c444ef812162b311181
SHA512 20beee6e71d55a9da667f7d5db2d5480a8a82053a3fbcbe0b0e0d84ac952b120bb52ab424d35a75650d28901a4791d56f4f7520f5138f0da3353040c6344bea1

memory/2608-142-0x0000000000400000-0x0000000000426000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\jmxpydzgw.exe

MD5 41fcc8ea93e353c03f86c4f7f47fb8bf
SHA1 37766be6029410e596c103fa5aa660d4e7de5cb4
SHA256 328f8c311bc7c17bc544d83665216ef125a5ebf1d4acc87423352c9346ded93d
SHA512 ae70ff237246e03ab6836aa6c594a3904be6e9cdc9990618f626622f213a54aabd29e86c3bba8ada3ceaba74f86379facd3172ce04f7405a225e4e11058c1dae

memory/2608-145-0x0000000000400000-0x0000000000426000-memory.dmp

memory/2608-146-0x0000000000400000-0x0000000000426000-memory.dmp

memory/2608-148-0x0000000000400000-0x0000000000426000-memory.dmp

memory/2608-149-0x0000000004B10000-0x0000000004B20000-memory.dmp

memory/2608-150-0x0000000004B10000-0x0000000004B20000-memory.dmp

memory/2608-151-0x0000000004B10000-0x0000000004B20000-memory.dmp

memory/2608-152-0x0000000004B10000-0x0000000004B20000-memory.dmp

memory/2608-153-0x0000000004D60000-0x0000000004DFC000-memory.dmp

memory/2608-154-0x0000000004E00000-0x00000000053A4000-memory.dmp

memory/2608-155-0x00000000053B0000-0x0000000005416000-memory.dmp

memory/2608-157-0x0000000004B10000-0x0000000004B20000-memory.dmp

memory/2608-158-0x0000000004B10000-0x0000000004B20000-memory.dmp

memory/2608-159-0x0000000004B10000-0x0000000004B20000-memory.dmp

memory/2608-160-0x0000000004B10000-0x0000000004B20000-memory.dmp