File name:

69e834be4264dab45e393e63952ae3b65f4e027a5928509c013b16175a43504b.exe

Full analysis: https://app.any.run/tasks/6ad343ef-3867-4f48-9d52-50a497c646d5
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Analysis date: January 10, 2025, 20:00:38
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
auto
bdaejec
backdoor
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

7ACF6527EF4BEF7F7325A94C4D92C1F9

SHA1:

8C39212F127DFE4C04B05F05B9E6759566ED207A

SHA256:

69E834BE4264DAB45E393E63952AE3B65F4E027A5928509C013B16175A43504B

SSDEEP:

1536:Euf6eOOaYLJgceVTuD8SIY2vn7JibiwCrdGgPQECYq9J9wng:5fVOOaYLX0orIY2f7JimwCrdGgPQE9g

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • BDAEJEC has been found (auto)

      • 69e834be4264dab45e393e63952ae3b65f4e027a5928509c013b16175a43504b.exe (PID: 4428)
    • BDAEJEC has been detected (SURICATA)

      • sgKbPm.exe (PID: 4160)
    • Connects to the CnC server

      • sgKbPm.exe (PID: 4160)
  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • sgKbPm.exe (PID: 4160)
    • Executable content was dropped or overwritten

      • 69e834be4264dab45e393e63952ae3b65f4e027a5928509c013b16175a43504b.exe (PID: 4428)
    • Contacting a server suspected of hosting an CnC

      • sgKbPm.exe (PID: 4160)
    • Starts CMD.EXE for commands execution

      • sgKbPm.exe (PID: 4160)
    • Executing commands from a ".bat" file

      • sgKbPm.exe (PID: 4160)
    • Connects to unusual port

      • sgKbPm.exe (PID: 4160)
  • INFO

    • Create files in a temporary directory

      • 69e834be4264dab45e393e63952ae3b65f4e027a5928509c013b16175a43504b.exe (PID: 4428)
      • sgKbPm.exe (PID: 4160)
    • Checks supported languages

      • 69e834be4264dab45e393e63952ae3b65f4e027a5928509c013b16175a43504b.exe (PID: 4428)
      • sgKbPm.exe (PID: 4160)
    • Reads the computer name

      • sgKbPm.exe (PID: 4160)
    • The process uses the downloaded file

      • sgKbPm.exe (PID: 4160)
    • Checks proxy server information

      • sgKbPm.exe (PID: 4160)
    • Creates files or folders in the user directory

      • sgKbPm.exe (PID: 4160)
    • Process checks computer location settings

      • sgKbPm.exe (PID: 4160)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

Subsystem: Windows GUI
SubsystemVersion: 5
ImageVersion: -
OSVersion: 5
EntryPoint: 0x14000
UninitializedDataSize: -
InitializedDataSize: 19968
CodeSize: 68608
LinkerVersion: 9
PEType: PE32
ImageFileCharacteristics: No relocs, Executable, 32-bit
TimeStamp: 2013:05:09 14:21:53+00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
128
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 69e834be4264dab45e393e63952ae3b65f4e027a5928509c013b16175a43504b.exe #BDAEJEC sgkbpm.exe cmd.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
4428"C:\Users\admin\AppData\Local\Temp\69e834be4264dab45e393e63952ae3b65f4e027a5928509c013b16175a43504b.exe" C:\Users\admin\AppData\Local\Temp\69e834be4264dab45e393e63952ae3b65f4e027a5928509c013b16175a43504b.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
2
Modules
Images
c:\users\admin\appdata\local\temp\69e834be4264dab45e393e63952ae3b65f4e027a5928509c013b16175a43504b.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\sechost.dll
4160C:\Users\admin\AppData\Local\Temp\sgKbPm.exeC:\Users\admin\AppData\Local\Temp\sgKbPm.exe
69e834be4264dab45e393e63952ae3b65f4e027a5928509c013b16175a43504b.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\sgkbpm.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6704C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\42f16eac.bat" "C:\Windows\SysWOW64\cmd.exesgKbPm.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6716\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
727
Read events
723
Write events
4
Delete events
0

Modification events

(PID) Process:(4160) sgKbPm.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4160) sgKbPm.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4160) sgKbPm.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(4160) sgKbPm.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\GTplus
Operation:writeName:Time
Value:
74147E589A63DB01
Executable files
1
Suspicious files
0
Text files
11
Unknown types
0

Dropped files

PID
Process
Filename
Type
4160sgKbPm.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\k4[1].rartext
MD5:D3B07384D113EDEC49EAA6238AD5FF00
SHA256:B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
4160sgKbPm.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\k1[1].rartext
MD5:D3B07384D113EDEC49EAA6238AD5FF00
SHA256:B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
4160sgKbPm.exeC:\Users\admin\AppData\Local\Temp\6FFA713F.exetext
MD5:D3B07384D113EDEC49EAA6238AD5FF00
SHA256:B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
4160sgKbPm.exeC:\Users\admin\AppData\Local\Temp\42f16eac.battext
MD5:7D2D623EAFF95A5CF46DCFAA355DFC01
SHA256:7A0EED637BE7268249DFA0F3E730B61210C435DCB5BB17ACA3EEA041E7BF8BA6
4160sgKbPm.exeC:\Users\admin\AppData\Local\Temp\0FED5DEB.exetext
MD5:D3B07384D113EDEC49EAA6238AD5FF00
SHA256:B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
4160sgKbPm.exeC:\Users\admin\AppData\Local\Temp\03AD761F.exetext
MD5:D3B07384D113EDEC49EAA6238AD5FF00
SHA256:B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
4160sgKbPm.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\k3[1].rartext
MD5:D3B07384D113EDEC49EAA6238AD5FF00
SHA256:B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
4160sgKbPm.exeC:\Users\admin\AppData\Local\Temp\7F1F3F83.exetext
MD5:D3B07384D113EDEC49EAA6238AD5FF00
SHA256:B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
442869e834be4264dab45e393e63952ae3b65f4e027a5928509c013b16175a43504b.exeC:\Users\admin\AppData\Local\Temp\sgKbPm.exeexecutable
MD5:56B2C3810DBA2E939A8BB9FA36D3CF96
SHA256:4354970CCC7CD6BB16318F132C34F6A1B3D5C2EA7FF53E1C9271905527F2DB07
4160sgKbPm.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\k2[1].rartext
MD5:D3B07384D113EDEC49EAA6238AD5FF00
SHA256:B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
22
DNS requests
8
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4160
sgKbPm.exe
GET
44.221.84.105:799
http://ddos.dnsnb8.net:799/cj//k5.rar
unknown
malicious
4160
sgKbPm.exe
GET
44.221.84.105:799
http://ddos.dnsnb8.net:799/cj//k1.rar
unknown
malicious
4160
sgKbPm.exe
GET
44.221.84.105:799
http://ddos.dnsnb8.net:799/cj//k2.rar
unknown
malicious
4160
sgKbPm.exe
GET
44.221.84.105:799
http://ddos.dnsnb8.net:799/cj//k1.rar
unknown
malicious
4160
sgKbPm.exe
GET
44.221.84.105:799
http://ddos.dnsnb8.net:799/cj//k3.rar
unknown
malicious
4160
sgKbPm.exe
GET
44.221.84.105:799
http://ddos.dnsnb8.net:799/cj//k4.rar
unknown
malicious
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
184.25.50.8:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
6072
RUXIMICS.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
4712
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6072
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
whitelisted
4712
MoUsoCoreWorker.exe
184.25.50.8:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
svchost.exe
184.25.50.8:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5064
SearchApp.exe
184.86.251.21:443
www.bing.com
Akamai International B.V.
DE
whitelisted
5496
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
google.com
  • 142.250.185.78
whitelisted
crl.microsoft.com
  • 184.25.50.8
whitelisted
www.bing.com
  • 184.86.251.21
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
ddos.dnsnb8.net
  • 44.221.84.105
malicious
self.events.data.microsoft.com
  • 20.42.73.26
whitelisted

Threats

PID
Process
Class
Message
Misc activity
SUSPICIOUS [ANY.RUN] Domain previously seen in multiple payload deliveries (ddos .dnsnb8 .net)
6 ETPRO signatures available at the full report
No debug info