File name:

69e834be4264dab45e393e63952ae3b65f4e027a5928509c013b16175a43504b.exe

Full analysis: https://app.any.run/tasks/aaf608f1-8354-4d82-9883-c728bb091b29
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Analysis date: January 10, 2025, 19:55:48
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
auto
bdaejec
backdoor
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

7ACF6527EF4BEF7F7325A94C4D92C1F9

SHA1:

8C39212F127DFE4C04B05F05B9E6759566ED207A

SHA256:

69E834BE4264DAB45E393E63952AE3B65F4E027A5928509C013B16175A43504B

SSDEEP:

1536:Euf6eOOaYLJgceVTuD8SIY2vn7JibiwCrdGgPQECYq9J9wng:5fVOOaYLX0orIY2f7JimwCrdGgPQE9g

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • BDAEJEC has been found (auto)

      • 69e834be4264dab45e393e63952ae3b65f4e027a5928509c013b16175a43504b.exe (PID: 6356)
    • BDAEJEC has been detected (SURICATA)

      • sgKbPm.exe (PID: 6372)
    • Connects to the CnC server

      • sgKbPm.exe (PID: 6372)
  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • sgKbPm.exe (PID: 6372)
    • Executable content was dropped or overwritten

      • 69e834be4264dab45e393e63952ae3b65f4e027a5928509c013b16175a43504b.exe (PID: 6356)
    • Contacting a server suspected of hosting an CnC

      • sgKbPm.exe (PID: 6372)
    • Connects to unusual port

      • sgKbPm.exe (PID: 6372)
    • Executing commands from a ".bat" file

      • sgKbPm.exe (PID: 6372)
    • Starts CMD.EXE for commands execution

      • sgKbPm.exe (PID: 6372)
  • INFO

    • Checks supported languages

      • 69e834be4264dab45e393e63952ae3b65f4e027a5928509c013b16175a43504b.exe (PID: 6356)
      • sgKbPm.exe (PID: 6372)
    • Create files in a temporary directory

      • 69e834be4264dab45e393e63952ae3b65f4e027a5928509c013b16175a43504b.exe (PID: 6356)
      • sgKbPm.exe (PID: 6372)
    • Reads the computer name

      • sgKbPm.exe (PID: 6372)
    • Checks proxy server information

      • sgKbPm.exe (PID: 6372)
    • Manual execution by a user

      • notepad++.exe (PID: 7116)
      • notepad++.exe (PID: 1684)
      • notepad++.exe (PID: 1448)
    • Creates files or folders in the user directory

      • sgKbPm.exe (PID: 6372)
    • Sends debugging messages

      • notepad++.exe (PID: 1684)
      • notepad++.exe (PID: 7116)
      • notepad++.exe (PID: 1448)
    • The process uses the downloaded file

      • sgKbPm.exe (PID: 6372)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

Subsystem: Windows GUI
SubsystemVersion: 5
ImageVersion: -
OSVersion: 5
EntryPoint: 0x14000
UninitializedDataSize: -
InitializedDataSize: 19968
CodeSize: 68608
LinkerVersion: 9
PEType: PE32
ImageFileCharacteristics: No relocs, Executable, 32-bit
TimeStamp: 2013:05:09 14:21:53+00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
125
Monitored processes
8
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 69e834be4264dab45e393e63952ae3b65f4e027a5928509c013b16175a43504b.exe #BDAEJEC sgkbpm.exe rundll32.exe no specs notepad++.exe notepad++.exe notepad++.exe cmd.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
6356"C:\Users\admin\AppData\Local\Temp\69e834be4264dab45e393e63952ae3b65f4e027a5928509c013b16175a43504b.exe" C:\Users\admin\AppData\Local\Temp\69e834be4264dab45e393e63952ae3b65f4e027a5928509c013b16175a43504b.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
2
Modules
Images
c:\users\admin\appdata\local\temp\69e834be4264dab45e393e63952ae3b65f4e027a5928509c013b16175a43504b.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\sechost.dll
6372C:\Users\admin\AppData\Local\Temp\sgKbPm.exeC:\Users\admin\AppData\Local\Temp\sgKbPm.exe
69e834be4264dab45e393e63952ae3b65f4e027a5928509c013b16175a43504b.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\sgkbpm.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6860C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
7116"C:\Program Files\Notepad++\notepad++.exe" "C:\Users\admin\Desktop\sgKbPm.exe"C:\Program Files\Notepad++\notepad++.exe
explorer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Notepad++ : a free (GNU) source code editor
Exit code:
0
Version:
7.91
Modules
Images
c:\program files\notepad++\notepad++.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1684"C:\Program Files\Notepad++\notepad++.exe" "C:\Users\admin\Desktop\06C126C2.exe"C:\Program Files\Notepad++\notepad++.exe
explorer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Notepad++ : a free (GNU) source code editor
Exit code:
0
Version:
7.91
Modules
Images
c:\program files\notepad++\notepad++.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1448"C:\Program Files\Notepad++\notepad++.exe" "C:\Users\admin\Desktop\6E9050B0.exe"C:\Program Files\Notepad++\notepad++.exe
explorer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Notepad++ : a free (GNU) source code editor
Exit code:
0
Version:
7.91
Modules
Images
c:\program files\notepad++\notepad++.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3612C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\136d0392.bat" "C:\Windows\SysWOW64\cmd.exesgKbPm.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
5404\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
1 065
Read events
1 061
Write events
4
Delete events
0

Modification events

(PID) Process:(6372) sgKbPm.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6372) sgKbPm.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6372) sgKbPm.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6372) sgKbPm.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\GTplus
Operation:writeName:Time
Value:
4C54DCCE9963DB01
Executable files
1
Suspicious files
0
Text files
11
Unknown types
0

Dropped files

PID
Process
Filename
Type
7116notepad++.exeC:\Users\admin\AppData\Roaming\Notepad++\stylers.xmlxml
MD5:312281C4126FA897EF21A7E8CCB8D495
SHA256:53B4BE3ED1CFD712E53542B30CFE30C5DB35CC48BE7C57727DFEC26C9E882E90
7116notepad++.exeC:\Users\admin\AppData\Roaming\Notepad++\shortcuts.xmltext
MD5:F11D96162BC521F5CF49FFE6B6841C9B
SHA256:BE9AEAEAB5A2E4899BA7E582274BA592C1B9BAF688B340A754B8EF32B23CFA9C
635669e834be4264dab45e393e63952ae3b65f4e027a5928509c013b16175a43504b.exeC:\Users\admin\AppData\Local\Temp\sgKbPm.exeexecutable
MD5:56B2C3810DBA2E939A8BB9FA36D3CF96
SHA256:4354970CCC7CD6BB16318F132C34F6A1B3D5C2EA7FF53E1C9271905527F2DB07
6372sgKbPm.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\k2[1].rartext
MD5:D3B07384D113EDEC49EAA6238AD5FF00
SHA256:B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
7116notepad++.exeC:\Users\admin\AppData\Roaming\Notepad++\config.xmlxml
MD5:A2ED875AA42589077C4D08F4F8912018
SHA256:77B0174D655F327C1FC9520B4F8831ECD82E98351B26BB9C2EDD98FF0CD63A2D
6372sgKbPm.exeC:\Users\admin\AppData\Local\Temp\136d0392.battext
MD5:944FD1D4C130EAA04F2CD9AC06293B8E
SHA256:F62FE7FE479AAC8C804C7642790C484102E15467CF5FB6A74F5458CB5F23F34A
7116notepad++.exeC:\Users\admin\AppData\Roaming\Notepad++\langs.xmlxml
MD5:FE22EC5755BC98988F9656F73B2E6FB8
SHA256:F972C425CE176E960F6347F1CA2F64A8CE2B95A375C33A03E57538052BA0624D
7116notepad++.exeC:\Users\admin\AppData\Roaming\Notepad++\plugins\config\converter.initext
MD5:F70F579156C93B097E656CABA577A5C9
SHA256:B926498A19CA95DC28964B7336E5847107DD3C0F52C85195C135D9DD6CA402D4
6372sgKbPm.exeC:\Users\admin\AppData\Local\Temp\6E9050B0.exetext
MD5:D3B07384D113EDEC49EAA6238AD5FF00
SHA256:B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
6372sgKbPm.exeC:\Users\admin\AppData\Local\Temp\06C126C2.exetext
MD5:D3B07384D113EDEC49EAA6238AD5FF00
SHA256:B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
18
DNS requests
7
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6372
sgKbPm.exe
GET
44.221.84.105:799
http://ddos.dnsnb8.net:799/cj//k2.rar
unknown
malicious
6372
sgKbPm.exe
GET
44.221.84.105:799
http://ddos.dnsnb8.net:799/cj//k2.rar
unknown
malicious
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
3040
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
6372
sgKbPm.exe
GET
44.221.84.105:799
http://ddos.dnsnb8.net:799/cj//k2.rar
unknown
malicious
6372
sgKbPm.exe
GET
44.221.84.105:799
http://ddos.dnsnb8.net:799/cj//k1.rar
unknown
malicious
6372
sgKbPm.exe
GET
44.221.84.105:799
http://ddos.dnsnb8.net:799/cj//k2.rar
unknown
malicious
6372
sgKbPm.exe
GET
44.221.84.105:799
http://ddos.dnsnb8.net:799/cj//k2.rar
unknown
malicious
6372
sgKbPm.exe
GET
44.221.84.105:799
http://ddos.dnsnb8.net:799/cj//k3.rar
unknown
malicious
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3040
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:137
whitelisted
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
51.124.78.146:443
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
whitelisted
6372
sgKbPm.exe
44.221.84.105:799
ddos.dnsnb8.net
AMAZON-AES
US
malicious
3040
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5064
SearchApp.exe
184.86.251.27:443
www.bing.com
Akamai International B.V.
DE
whitelisted
5064
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 142.250.179.174
whitelisted
ddos.dnsnb8.net
  • 44.221.84.105
malicious
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
www.bing.com
  • 184.86.251.27
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
self.events.data.microsoft.com
  • 52.182.143.214
whitelisted

Threats

PID
Process
Class
Message
Misc activity
SUSPICIOUS [ANY.RUN] Domain previously seen in multiple payload deliveries (ddos .dnsnb8 .net)
7 ETPRO signatures available at the full report
Process
Message
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\updater\gup.exe
notepad++.exe
VerifyLibrary: error while getting certificate informations
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
VerifyLibrary: error while getting certificate informations