File name:

69e834be4264dab45e393e63952ae3b65f4e027a5928509c013b16175a43504b.exe

Full analysis: https://app.any.run/tasks/2aeb4e1c-540e-4bf6-8be9-d14996760eaf
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Malware Trends Tracker     >>>
Analysis date: January 10, 2025, 19:58:59
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
auto
bdaejec
backdoor
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

7ACF6527EF4BEF7F7325A94C4D92C1F9

SHA1:

8C39212F127DFE4C04B05F05B9E6759566ED207A

SHA256:

69E834BE4264DAB45E393E63952AE3B65F4E027A5928509C013B16175A43504B

SSDEEP:

1536:Euf6eOOaYLJgceVTuD8SIY2vn7JibiwCrdGgPQECYq9J9wng:5fVOOaYLX0orIY2f7JimwCrdGgPQE9g

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • BDAEJEC has been found (auto)

      • 69e834be4264dab45e393e63952ae3b65f4e027a5928509c013b16175a43504b.exe (PID: 6248)

    • Connects to the CnC server

      • sgKbPm.exe (PID: 6280)

    • BDAEJEC has been detected (SURICATA)

      • sgKbPm.exe (PID: 6280)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • sgKbPm.exe (PID: 6280)

    • Executable content was dropped or overwritten

      • 69e834be4264dab45e393e63952ae3b65f4e027a5928509c013b16175a43504b.exe (PID: 6248)

    • Starts CMD.EXE for commands execution

      • sgKbPm.exe (PID: 6280)

    • Executing commands from a ".bat" file

      • sgKbPm.exe (PID: 6280)

    • Contacting a server suspected of hosting an CnC

      • sgKbPm.exe (PID: 6280)

    • Connects to unusual port

      • sgKbPm.exe (PID: 6280)

  • INFO

    • Creates files or folders in the user directory

      • sgKbPm.exe (PID: 6280)

    • Reads the machine GUID from the registry

      • SearchApp.exe (PID: 5064)

    • Reads the computer name

      • sgKbPm.exe (PID: 6280)

    • Create files in a temporary directory

      • 69e834be4264dab45e393e63952ae3b65f4e027a5928509c013b16175a43504b.exe (PID: 6248)
      • sgKbPm.exe (PID: 6280)

    • Checks proxy server information

      • sgKbPm.exe (PID: 6280)

    • Checks supported languages

      • SearchApp.exe (PID: 5064)
      • 69e834be4264dab45e393e63952ae3b65f4e027a5928509c013b16175a43504b.exe (PID: 6248)
      • sgKbPm.exe (PID: 6280)

    • Process checks computer location settings

      • SearchApp.exe (PID: 5064)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

Subsystem: Windows GUI
SubsystemVersion: 5
ImageVersion: -
OSVersion: 5
EntryPoint: 0x14000
UninitializedDataSize: -
InitializedDataSize: 19968
CodeSize: 68608
LinkerVersion: 9
PEType: PE32
ImageFileCharacteristics: No relocs, Executable, 32-bit
TimeStamp: 2013:05:09 14:21:53+00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
127
Monitored processes
5
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 69e834be4264dab45e393e63952ae3b65f4e027a5928509c013b16175a43504b.exe #BDAEJEC sgkbpm.exe cmd.exe no specs conhost.exe no specs searchapp.exe

Process information

PID
CMD
Path
Indicators
Parent process
5064"C:\WINDOWS\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mcaC:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Search application
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\microsoft.windows.search_cw5n1h2txyewy\searchapp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6248"C:\Users\admin\AppData\Local\Temp\69e834be4264dab45e393e63952ae3b65f4e027a5928509c013b16175a43504b.exe" C:\Users\admin\AppData\Local\Temp\69e834be4264dab45e393e63952ae3b65f4e027a5928509c013b16175a43504b.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
2
Modules
Images
c:\users\admin\appdata\local\temp\69e834be4264dab45e393e63952ae3b65f4e027a5928509c013b16175a43504b.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\sechost.dll
6280C:\Users\admin\AppData\Local\Temp\sgKbPm.exeC:\Users\admin\AppData\Local\Temp\sgKbPm.exe
69e834be4264dab45e393e63952ae3b65f4e027a5928509c013b16175a43504b.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\sgkbpm.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6880C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\2ac11acc.bat" "C:\Windows\SysWOW64\cmd.exe—sgKbPm.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6892\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
5 218
Read events
5 119
Write events
97
Delete events
2

Modification events

(PID) Process:(6280) sgKbPm.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6280) sgKbPm.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6280) sgKbPm.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5064) SearchApp.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com
Operation:writeName:Total
Value:
50667
(PID) Process:(5064) SearchApp.exeKey:\REGISTRY\A\{ee080948-b2ea-145a-6870-f9164b908eb9}\LocalState\ConstraintIndex
Operation:writeName:CurrentConstraintIndexCabPath
Value:
43003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C004C006F00630061006C005C005000610063006B0061006700650073005C004D006900630072006F0073006F00660074002E00570069006E0064006F00770073002E005300650061007200630068005F006300770035006E003100680032007400780079006500770079005C004C006F00630061006C00530074006100740065005C0043006F006E00730074007200610069006E00740049006E006400650078005C0049006E007000750074005F007B00380033003200620036003800640032002D0037006600650032002D0034006500370031002D0061003300610064002D003200360031003600360062003600350036006500630036007D000000E858341C9A63DB01
(PID) Process:(5064) SearchApp.exeKey:\REGISTRY\A\{ee080948-b2ea-145a-6870-f9164b908eb9}\LocalState\AppsConstraintIndex
Operation:writeName:LatestConstraintIndexFolder
Value:
43003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C004C006F00630061006C005C005000610063006B0061006700650073005C004D006900630072006F0073006F00660074002E00570069006E0064006F00770073002E005300650061007200630068005F006300770035006E003100680032007400780079006500770079005C004C006F00630061006C00530074006100740065005C0043006F006E00730074007200610069006E00740049006E006400650078005C0041007000700073005F007B00610066006500640063003600650036002D0032003000650063002D0034003500310039002D0062006300350062002D003400300065006100610066003800370034006300660038007D000000E858341C9A63DB01
(PID) Process:(5064) SearchApp.exeKey:\REGISTRY\A\{ee080948-b2ea-145a-6870-f9164b908eb9}\LocalState\AppsConstraintIndex
Operation:writeName:LastConstraintIndexBuildCompleted
Value:
EDA5351C9A63DB01E858341C9A63DB01
(PID) Process:(5064) SearchApp.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\Microsoft.Windows.Search_cw5n1h2txyewy\AppsConstraintIndex
Operation:writeName:CurrentConstraintIndexCabPath
Value:
C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{832b68d2-7fe2-4e71-a3ad-26166b656ec6}
(PID) Process:(5064) SearchApp.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\Microsoft.Windows.Search_cw5n1h2txyewy\AppsConstraintIndex
Operation:writeName:LatestConstraintIndexFolder
Value:
C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{afedc6e6-20ec-4519-bc5b-40eaaf874cf8}
(PID) Process:(5064) SearchApp.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\SearchSettings
Operation:writeName:SafeSearchMode
Value:
1
Executable files
1
Suspicious files
53
Text files
119
Unknown types
0

Dropped files

PID
Process
Filename
Type
624869e834be4264dab45e393e63952ae3b65f4e027a5928509c013b16175a43504b.exeC:\Users\admin\AppData\Local\Temp\sgKbPm.exeexecutable
MD5:56B2C3810DBA2E939A8BB9FA36D3CF96
SHA256:4354970CCC7CD6BB16318F132C34F6A1B3D5C2EA7FF53E1C9271905527F2DB07
5064SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{afedc6e6-20ec-4519-bc5b-40eaaf874cf8}\Apps.ftbinary
MD5:AB5CF5D309581951ACE7978FF8DF0FF0
SHA256:CA45CAA7DE38CB805EC43EDC8B9332E1E95124A27FBB6E5BD3DDD5E8A526AFC7
5064SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{afedc6e6-20ec-4519-bc5b-40eaaf874cf8}\0.2.filtertrie.intermediate.txttext
MD5:C204E9FAAF8565AD333828BEFF2D786E
SHA256:D65B6A3BF11A27A1CED1F7E98082246E40CF01289FD47FE4A5ED46C221F2F73F
5064SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\95d9a2a97a42f02325559b453ba7f8fe839baa18.tbresbinary
MD5:4B5B34ACF134869E9610AF251FA4D777
SHA256:53D5D48349771F5A18732FD47EA276CE4C6C008F37563F473114EE96C92987C4
5064SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{afedc6e6-20ec-4519-bc5b-40eaaf874cf8}\0.1.filtertrie.intermediate.txttext
MD5:34BD1DFB9F72CF4F86E6DF6DA0A9E49A
SHA256:8E1E6A3D56796A245D0C7B0849548932FEE803BBDB03F6E289495830E017F14C
5064SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbresbinary
MD5:F7B2B9477E75D263FD29CE820BBDFE12
SHA256:D85D6884EB60651A827412110A6769B33B0E133BFF1AA103E4B74E4874BA3833
5064SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZWUI0EBX\www.bing[1].xmltext
MD5:8124BFEA920F0A7EA5DB08BD806C90A5
SHA256:AE1018C4A46F50514CB73821DBD93D8778EA635ADE60168A99181C868C2CA310
6280sgKbPm.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\k4[1].rartext
MD5:D3B07384D113EDEC49EAA6238AD5FF00
SHA256:B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
6280sgKbPm.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\k3[1].rartext
MD5:D3B07384D113EDEC49EAA6238AD5FF00
SHA256:B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
6280sgKbPm.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\k2[1].rartext
MD5:D3B07384D113EDEC49EAA6238AD5FF00
SHA256:B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
35
DNS requests
13
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6280
sgKbPm.exe
GET
—
44.221.84.105:799
http://ddos.dnsnb8.net:799/cj//k1.rar
unknown
—
—
malicious
1016
svchost.exe
GET
200
104.79.89.142:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.21.245.134:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
104.79.89.142:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6280
sgKbPm.exe
GET
—
44.221.84.105:799
http://ddos.dnsnb8.net:799/cj//k4.rar
unknown
—
—
malicious
1016
svchost.exe
GET
200
2.21.245.134:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6280
sgKbPm.exe
GET
—
44.221.84.105:799
http://ddos.dnsnb8.net:799/cj//k2.rar
unknown
—
—
malicious
6280
sgKbPm.exe
GET
—
44.221.84.105:799
http://ddos.dnsnb8.net:799/cj//k5.rar
unknown
—
—
malicious
6280
sgKbPm.exe
GET
—
44.221.84.105:799
http://ddos.dnsnb8.net:799/cj//k3.rar
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
2.21.245.134:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
1016
svchost.exe
2.21.245.134:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
5064
SearchApp.exe
2.21.245.32:443
www.bing.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
104.79.89.142:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
1016
svchost.exe
104.79.89.142:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5064
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4712
MoUsoCoreWorker.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1016
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 2.21.245.134
whitelisted
google.com
  • 142.250.185.174
whitelisted
www.bing.com
  • 2.21.245.32
whitelisted
www.microsoft.com
  • 104.79.89.142
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
ddos.dnsnb8.net
  • 44.221.84.105
malicious
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
r.bing.com
  • 184.86.251.30
whitelisted
fp.msedge.net
  • 204.79.197.222
whitelisted
arm-ring.msedge.net
  • 4.150.240.254
unknown

Threats

PID
Process
Class
Message
—
—
Misc activity
SUSPICIOUS [ANY.RUN] Domain previously seen in multiple payload deliveries (ddos .dnsnb8 .net)
5 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
69e834be4264dab45e393e63952ae3b65f4e027a5928509c013b16175a43504b.exe