File name:

69e834be4264dab45e393e63952ae3b65f4e027a5928509c013b16175a43504b.exe

Full analysis: https://app.any.run/tasks/2aeb4e1c-540e-4bf6-8be9-d14996760eaf
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Malware Trends Tracker     >>>
Analysis date: January 10, 2025, 19:58:59
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
auto
bdaejec
backdoor
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

7ACF6527EF4BEF7F7325A94C4D92C1F9

SHA1:

8C39212F127DFE4C04B05F05B9E6759566ED207A

SHA256:

69E834BE4264DAB45E393E63952AE3B65F4E027A5928509C013B16175A43504B

SSDEEP:

1536:Euf6eOOaYLJgceVTuD8SIY2vn7JibiwCrdGgPQECYq9J9wng:5fVOOaYLX0orIY2f7JimwCrdGgPQE9g

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • BDAEJEC has been found (auto)

      • 69e834be4264dab45e393e63952ae3b65f4e027a5928509c013b16175a43504b.exe (PID: 6248)

    • Connects to the CnC server

      • sgKbPm.exe (PID: 6280)

    • BDAEJEC has been detected (SURICATA)

      • sgKbPm.exe (PID: 6280)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • sgKbPm.exe (PID: 6280)

    • Executable content was dropped or overwritten

      • 69e834be4264dab45e393e63952ae3b65f4e027a5928509c013b16175a43504b.exe (PID: 6248)

    • Contacting a server suspected of hosting an CnC

      • sgKbPm.exe (PID: 6280)

    • Connects to unusual port

      • sgKbPm.exe (PID: 6280)

    • Executing commands from a ".bat" file

      • sgKbPm.exe (PID: 6280)

    • Starts CMD.EXE for commands execution

      • sgKbPm.exe (PID: 6280)

  • INFO

    • Create files in a temporary directory

      • 69e834be4264dab45e393e63952ae3b65f4e027a5928509c013b16175a43504b.exe (PID: 6248)
      • sgKbPm.exe (PID: 6280)

    • Reads the computer name

      • sgKbPm.exe (PID: 6280)

    • Checks supported languages

      • sgKbPm.exe (PID: 6280)
      • 69e834be4264dab45e393e63952ae3b65f4e027a5928509c013b16175a43504b.exe (PID: 6248)
      • SearchApp.exe (PID: 5064)

    • Checks proxy server information

      • sgKbPm.exe (PID: 6280)

    • Creates files or folders in the user directory

      • sgKbPm.exe (PID: 6280)

    • Process checks computer location settings

      • SearchApp.exe (PID: 5064)

    • Reads the machine GUID from the registry

      • SearchApp.exe (PID: 5064)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2013:05:09 14:21:53+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 68608
InitializedDataSize: 19968
UninitializedDataSize: -
EntryPoint: 0x14000
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
127
Monitored processes
5
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 69e834be4264dab45e393e63952ae3b65f4e027a5928509c013b16175a43504b.exe #BDAEJEC sgkbpm.exe cmd.exe no specs conhost.exe no specs searchapp.exe

Process information

PID
CMD
Path
Indicators
Parent process
5064"C:\WINDOWS\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mcaC:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Search application
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\microsoft.windows.search_cw5n1h2txyewy\searchapp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6248"C:\Users\admin\AppData\Local\Temp\69e834be4264dab45e393e63952ae3b65f4e027a5928509c013b16175a43504b.exe" C:\Users\admin\AppData\Local\Temp\69e834be4264dab45e393e63952ae3b65f4e027a5928509c013b16175a43504b.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
2
Modules
Images
c:\users\admin\appdata\local\temp\69e834be4264dab45e393e63952ae3b65f4e027a5928509c013b16175a43504b.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\sechost.dll
6280C:\Users\admin\AppData\Local\Temp\sgKbPm.exeC:\Users\admin\AppData\Local\Temp\sgKbPm.exe
69e834be4264dab45e393e63952ae3b65f4e027a5928509c013b16175a43504b.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\sgkbpm.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6880C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\2ac11acc.bat" "C:\Windows\SysWOW64\cmd.exe—sgKbPm.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6892\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
5 218
Read events
5 119
Write events
97
Delete events
2

Modification events

(PID) Process:(5064) SearchApp.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com
Operation:writeName:Total
Value:
50667
(PID) Process:(6280) sgKbPm.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6280) sgKbPm.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6280) sgKbPm.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5064) SearchApp.exeKey:\REGISTRY\A\{ee080948-b2ea-145a-6870-f9164b908eb9}\LocalState\ConstraintIndex
Operation:writeName:CurrentConstraintIndexCabPath
Value:
43003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C004C006F00630061006C005C005000610063006B0061006700650073005C004D006900630072006F0073006F00660074002E00570069006E0064006F00770073002E005300650061007200630068005F006300770035006E003100680032007400780079006500770079005C004C006F00630061006C00530074006100740065005C0043006F006E00730074007200610069006E00740049006E006400650078005C0049006E007000750074005F007B00380033003200620036003800640032002D0037006600650032002D0034006500370031002D0061003300610064002D003200360031003600360062003600350036006500630036007D000000E858341C9A63DB01
(PID) Process:(5064) SearchApp.exeKey:\REGISTRY\A\{ee080948-b2ea-145a-6870-f9164b908eb9}\LocalState\AppsConstraintIndex
Operation:writeName:LatestConstraintIndexFolder
Value:
43003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C004C006F00630061006C005C005000610063006B0061006700650073005C004D006900630072006F0073006F00660074002E00570069006E0064006F00770073002E005300650061007200630068005F006300770035006E003100680032007400780079006500770079005C004C006F00630061006C00530074006100740065005C0043006F006E00730074007200610069006E00740049006E006400650078005C0041007000700073005F007B00610066006500640063003600650036002D0032003000650063002D0034003500310039002D0062006300350062002D003400300065006100610066003800370034006300660038007D000000E858341C9A63DB01
(PID) Process:(5064) SearchApp.exeKey:\REGISTRY\A\{ee080948-b2ea-145a-6870-f9164b908eb9}\LocalState\AppsConstraintIndex
Operation:writeName:LastConstraintIndexBuildCompleted
Value:
EDA5351C9A63DB01E858341C9A63DB01
(PID) Process:(5064) SearchApp.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\Microsoft.Windows.Search_cw5n1h2txyewy\AppsConstraintIndex
Operation:writeName:CurrentConstraintIndexCabPath
Value:
C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{832b68d2-7fe2-4e71-a3ad-26166b656ec6}
(PID) Process:(5064) SearchApp.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\Microsoft.Windows.Search_cw5n1h2txyewy\AppsConstraintIndex
Operation:writeName:LatestConstraintIndexFolder
Value:
C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{afedc6e6-20ec-4519-bc5b-40eaaf874cf8}
(PID) Process:(5064) SearchApp.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\SearchSettings
Operation:writeName:SafeSearchMode
Value:
1
Executable files
1
Suspicious files
53
Text files
119
Unknown types
0

Dropped files

PID
Process
Filename
Type
5064SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{afedc6e6-20ec-4519-bc5b-40eaaf874cf8}\Apps.ftbinary
MD5:AB5CF5D309581951ACE7978FF8DF0FF0
SHA256:CA45CAA7DE38CB805EC43EDC8B9332E1E95124A27FBB6E5BD3DDD5E8A526AFC7
5064SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{afedc6e6-20ec-4519-bc5b-40eaaf874cf8}\0.2.filtertrie.intermediate.txttext
MD5:C204E9FAAF8565AD333828BEFF2D786E
SHA256:D65B6A3BF11A27A1CED1F7E98082246E40CF01289FD47FE4A5ED46C221F2F73F
6280sgKbPm.exeC:\Users\admin\AppData\Local\Temp\50430F31.exetext
MD5:D3B07384D113EDEC49EAA6238AD5FF00
SHA256:B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
6280sgKbPm.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\k3[1].rartext
MD5:D3B07384D113EDEC49EAA6238AD5FF00
SHA256:B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
5064SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZWUI0EBX\www.bing[1].xmltext
MD5:8124BFEA920F0A7EA5DB08BD806C90A5
SHA256:AE1018C4A46F50514CB73821DBD93D8778EA635ADE60168A99181C868C2CA310
6280sgKbPm.exeC:\Users\admin\AppData\Local\Temp\1E497C64.exetext
MD5:D3B07384D113EDEC49EAA6238AD5FF00
SHA256:B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
5064SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\5Y734AMR\67\hCdM5V3UaZXhX_wN6FhxhcULfoU[1].jsbinary
MD5:974B999F9F10DCF784EE257E2AA2F953
SHA256:5A0F2478D335D70CD2510F8EF00BFC0CA2057B787302771EBD411970F1C0ED44
6280sgKbPm.exeC:\Users\admin\AppData\Local\Temp\2ac11acc.battext
MD5:A94834D9C4754A9ECA39C8B5DA12D163
SHA256:3E0EE71DBB2991C106FF461520983D8ABD7447FD8EB06B7555F482A293143FB7
6280sgKbPm.exeC:\Users\admin\AppData\Local\Temp\46B41E2C.exetext
MD5:D3B07384D113EDEC49EAA6238AD5FF00
SHA256:B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
6280sgKbPm.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\k5[1].rartext
MD5:D3B07384D113EDEC49EAA6238AD5FF00
SHA256:B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
35
DNS requests
13
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
2.21.245.134:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1016
svchost.exe
GET
200
104.79.89.142:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1016
svchost.exe
GET
200
2.21.245.134:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6280
sgKbPm.exe
GET
—
44.221.84.105:799
http://ddos.dnsnb8.net:799/cj//k1.rar
unknown
—
—
malicious
6280
sgKbPm.exe
GET
—
44.221.84.105:799
http://ddos.dnsnb8.net:799/cj//k2.rar
unknown
—
—
malicious
4712
MoUsoCoreWorker.exe
GET
200
104.79.89.142:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6280
sgKbPm.exe
GET
—
44.221.84.105:799
http://ddos.dnsnb8.net:799/cj//k3.rar
unknown
—
—
malicious
6280
sgKbPm.exe
GET
—
44.221.84.105:799
http://ddos.dnsnb8.net:799/cj//k4.rar
unknown
—
—
malicious
6280
sgKbPm.exe
GET
—
44.221.84.105:799
http://ddos.dnsnb8.net:799/cj//k5.rar
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
2.21.245.134:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
1016
svchost.exe
2.21.245.134:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
5064
SearchApp.exe
2.21.245.32:443
www.bing.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
104.79.89.142:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
1016
svchost.exe
104.79.89.142:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5064
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4712
MoUsoCoreWorker.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1016
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 2.21.245.134
whitelisted
google.com
  • 142.250.185.174
whitelisted
www.bing.com
  • 2.21.245.32
whitelisted
www.microsoft.com
  • 104.79.89.142
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
ddos.dnsnb8.net
  • 44.221.84.105
malicious
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
r.bing.com
  • 184.86.251.30
whitelisted
fp.msedge.net
  • 204.79.197.222
whitelisted
arm-ring.msedge.net
  • 4.150.240.254
unknown

Threats

PID
Process
Class
Message
2192
svchost.exe
Misc activity
SUSPICIOUS [ANY.RUN] Domain previously seen in multiple payload deliveries (ddos .dnsnb8 .net)
5 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
69e834be4264dab45e393e63952ae3b65f4e027a5928509c013b16175a43504b.exe