| File name: | 11c509649c391209ce09bc178ebffcfc7cbfcf038ce699aebfd1303191c136aa.zip |
| Full analysis: | https://app.any.run/tasks/7f0f37df-2aea-4656-aa1a-be2a8c084cb8 |
| Verdict: | Malicious activity |
| Threats: | A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices. |
| Analysis date: | May 15, 2025, 23:48:48 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v2.0 to extract, compression method=AES Encrypted |
| MD5: | 41E637CF97FA2F2ABEA58A4D8A6C4E61 |
| SHA1: | 0B68F9648B75E37284E58CFE428BFD433990CD37 |
| SHA256: | F5F8E7F48612D5416DF59A6978C2A756BBB57F671D2EE298DF47E627A1B08464 |
| SSDEEP: | 1536:KKdN8m0QJ0jLXW8akYwde6tbX1hWrglJPcksRgawqXEU77HD87q6CU6:ld+fWuNdJphrpsRgLrU7H8X6 |
MALICIOUS
Generic archive extractor
- WinRAR.exe (PID: 5680)
BDAEJEC has been detected
- bGfoJD.exe (PID: 8172)
SYSTEMBC has been detected (YARA)
- 11c509649c391209ce09bc178ebffcfc7cbfcf038ce699aebfd1303191c136aa.exe (PID: 8144)
- dfauqi.exe (PID: 4040)
SUSPICIOUS
Reads security settings of Internet Explorer
- bGfoJD.exe (PID: 8172)
- bGfoJD.exe (PID: 5164)
Executable content was dropped or overwritten
- 11c509649c391209ce09bc178ebffcfc7cbfcf038ce699aebfd1303191c136aa.exe (PID: 8144)
- dfauqi.exe (PID: 4040)
The process executes via Task Scheduler
- dfauqi.exe (PID: 4040)
Connects to unusual port
- bGfoJD.exe (PID: 5164)
- bGfoJD.exe (PID: 8172)
- dfauqi.exe (PID: 4040)
There is functionality for capture public ip (YARA)
- 11c509649c391209ce09bc178ebffcfc7cbfcf038ce699aebfd1303191c136aa.exe (PID: 8144)
- dfauqi.exe (PID: 4040)
Executes application which crashes
- 11c509649c391209ce09bc178ebffcfc7cbfcf038ce699aebfd1303191c136aa.exe (PID: 8144)
INFO
Executable content was dropped or overwritten
- WinRAR.exe (PID: 5680)
Checks supported languages
- 11c509649c391209ce09bc178ebffcfc7cbfcf038ce699aebfd1303191c136aa.exe (PID: 8144)
- bGfoJD.exe (PID: 8172)
- dfauqi.exe (PID: 4040)
- bGfoJD.exe (PID: 5164)
Create files in a temporary directory
- 11c509649c391209ce09bc178ebffcfc7cbfcf038ce699aebfd1303191c136aa.exe (PID: 8144)
- bGfoJD.exe (PID: 8172)
Manual execution by a user
- 11c509649c391209ce09bc178ebffcfc7cbfcf038ce699aebfd1303191c136aa.exe (PID: 8144)
Reads the computer name
- bGfoJD.exe (PID: 8172)
- bGfoJD.exe (PID: 5164)
- 11c509649c391209ce09bc178ebffcfc7cbfcf038ce699aebfd1303191c136aa.exe (PID: 8144)
- dfauqi.exe (PID: 4040)
Checks proxy server information
- bGfoJD.exe (PID: 8172)
- slui.exe (PID: 1672)
Creates files or folders in the user directory
- bGfoJD.exe (PID: 8172)
- WerFault.exe (PID: 664)
Aspack has been detected
- dfauqi.exe (PID: 4040)
- 11c509649c391209ce09bc178ebffcfc7cbfcf038ce699aebfd1303191c136aa.exe (PID: 8144)
Reads the software policy settings
- slui.exe (PID: 7316)
- slui.exe (PID: 1672)
Creates files in the program directory
- 11c509649c391209ce09bc178ebffcfc7cbfcf038ce699aebfd1303191c136aa.exe (PID: 8144)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
SystemBC
(PID) Process(8144) 11c509649c391209ce09bc178ebffcfc7cbfcf038ce699aebfd1303191c136aa.exe
C2 (2)31.44.185.6:4001
31.44.185.11:4001
(PID) Process(4040) dfauqi.exe
C2 (2)31.44.185.6:4001
31.44.185.11:4001
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipRequiredVersion: | 20 |
|---|---|
| ZipBitFlag: | 0x0001 |
| ZipCompression: | Unknown (99) |
| ZipModifyDate: | 2025:05:15 23:48:10 |
| ZipCRC: | 0xd68dde8b |
| ZipCompressedSize: | 93863 |
| ZipUncompressedSize: | 253952 |
| ZipFileName: | 11c509649c391209ce09bc178ebffcfc7cbfcf038ce699aebfd1303191c136aa.exe |
Total processes
145
Monitored processes
10
Malicious processes
3
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 664 | C:\WINDOWS\SysWOW64\WerFault.exe -u -p 8144 -s 516 | C:\Windows\SysWOW64\WerFault.exe | — | 11c509649c391209ce09bc178ebffcfc7cbfcf038ce699aebfd1303191c136aa.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Problem Reporting Exit code: 0 Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1672 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2196 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4040 | "C:\ProgramData\lgurp\dfauqi.exe" start | C:\ProgramData\lgurp\dfauqi.exe | svchost.exe | ||||||||||||
User: SYSTEM Integrity Level: SYSTEM Modules
SystemBC(PID) Process(4040) dfauqi.exe C2 (2)31.44.185.6:4001 31.44.185.11:4001 | |||||||||||||||
| 5164 | C:\WINDOWS\TEMP\bGfoJD.exe | C:\Windows\Temp\bGfoJD.exe | dfauqi.exe | ||||||||||||
User: SYSTEM Integrity Level: SYSTEM Modules
| |||||||||||||||
| 5680 | "C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\11c509649c391209ce09bc178ebffcfc7cbfcf038ce699aebfd1303191c136aa.zip | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
| 7284 | C:\WINDOWS\system32\SppExtComObj.exe -Embedding | C:\Windows\System32\SppExtComObj.Exe | — | svchost.exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: KMS Connection Broker Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7316 | "C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEvent | C:\Windows\System32\slui.exe | SppExtComObj.Exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows Activation Client Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 8144 | "C:\Users\admin\Desktop\11c509649c391209ce09bc178ebffcfc7cbfcf038ce699aebfd1303191c136aa.exe" | C:\Users\admin\Desktop\11c509649c391209ce09bc178ebffcfc7cbfcf038ce699aebfd1303191c136aa.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 3221225477 Modules
SystemBC(PID) Process(8144) 11c509649c391209ce09bc178ebffcfc7cbfcf038ce699aebfd1303191c136aa.exe C2 (2)31.44.185.6:4001 31.44.185.11:4001 | |||||||||||||||
| 8172 | C:\Users\admin\AppData\Local\Temp\bGfoJD.exe | C:\Users\admin\AppData\Local\Temp\bGfoJD.exe | 11c509649c391209ce09bc178ebffcfc7cbfcf038ce699aebfd1303191c136aa.exe | ||||||||||||
User: admin Integrity Level: HIGH Modules
| |||||||||||||||
Total events
5 799
Read events
5 755
Write events
28
Delete events
16
Modification events
| (PID) Process: | (5680) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\preferences.zip | |||
| (PID) Process: | (5680) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\chromium_ext.zip | |||
| (PID) Process: | (5680) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip | |||
| (PID) Process: | (5680) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\11c509649c391209ce09bc178ebffcfc7cbfcf038ce699aebfd1303191c136aa.zip | |||
| (PID) Process: | (5680) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (5680) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (5680) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (5680) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (5680) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath |
| Operation: | delete value | Name: | 15 |
Value: | |||
| (PID) Process: | (5680) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath |
| Operation: | delete value | Name: | 14 |
Value: | |||
Executable files
4
Suspicious files
6
Text files
1
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 664 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_11c509649c391209_21f74c4a206656a23e628690dee25359819dabc0_d1c0b25c_5ab9ca1c-9cd5-4522-91c7-8fde9a5cb0ad\Report.wer | — | |
MD5:— | SHA256:— | |||
| 5680 | WinRAR.exe | C:\Users\admin\Desktop\11c509649c391209ce09bc178ebffcfc7cbfcf038ce699aebfd1303191c136aa.exe | executable | |
MD5:ECD0928E717CE95B2918B50460813DB7 | SHA256:11C509649C391209CE09BC178EBFFCFC7CBFCF038CE699AEBFD1303191C136AA | |||
| 8144 | 11c509649c391209ce09bc178ebffcfc7cbfcf038ce699aebfd1303191c136aa.exe | C:\Users\admin\AppData\Local\Temp\bGfoJD.exe | executable | |
MD5:F7D21DE5C4E81341ECCD280C11DDCC9A | SHA256:4485DF22C627FA0BB899D79AA6FF29BC5BE1DBC3CAA2B7A490809338D54B7794 | |||
| 8172 | bGfoJD.exe | C:\Users\admin\AppData\Local\Temp\3FE72923.exe | binary | |
MD5:68B329DA9893E34099C7D8AD5CB9C940 | SHA256:01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B | |||
| 664 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\Temp\WER9CB5.tmp.dmp | binary | |
MD5:9AB8CF0D89DBAB732ED469FC691D9753 | SHA256:81A1FD9C251639C65F85F58CEFEF34C5A5763D3679F55A5C9123364859A343FB | |||
| 8144 | 11c509649c391209ce09bc178ebffcfc7cbfcf038ce699aebfd1303191c136aa.exe | C:\ProgramData\lgurp\dfauqi.exe | executable | |
MD5:ECD0928E717CE95B2918B50460813DB7 | SHA256:11C509649C391209CE09BC178EBFFCFC7CBFCF038CE699AEBFD1303191C136AA | |||
| 8172 | bGfoJD.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\k1[1].rar | binary | |
MD5:68B329DA9893E34099C7D8AD5CB9C940 | SHA256:01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B | |||
| 8144 | 11c509649c391209ce09bc178ebffcfc7cbfcf038ce699aebfd1303191c136aa.exe | C:\Windows\Tasks\dfauqi.job | binary | |
MD5:BB2AFC4D2E8729FD7E56A57F96C63B27 | SHA256:26187F1B2A6144424E715321107B7D15ED76B913F625E9121A4B228E74665EC2 | |||
| 4040 | dfauqi.exe | C:\Windows\Temp\bGfoJD.exe | executable | |
MD5:F7D21DE5C4E81341ECCD280C11DDCC9A | SHA256:4485DF22C627FA0BB899D79AA6FF29BC5BE1DBC3CAA2B7A490809338D54B7794 | |||
| 664 | WerFault.exe | C:\Users\admin\AppData\Local\CrashDumps\11c509649c391209ce09bc178ebffcfc7cbfcf038ce699aebfd1303191c136aa.exe.8144.dmp | binary | |
MD5:61C5AAD15ED65627710AD5307BD7196F | SHA256:3C3D3EBFDDE89D49E0CE19602AED421AE94549B00CCDBE29CD0517766A8FE3C8 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
40
DNS requests
17
Threats
3
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5496 | MoUsoCoreWorker.exe | GET | 200 | 23.53.40.176:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
7908 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
8172 | bGfoJD.exe | GET | — | 3.229.117.57:799 | http://ddos.dnsnb8.net:799/cj//k1.rar | unknown | — | — | malicious |
7908 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
8172 | bGfoJD.exe | GET | — | 3.229.117.57:799 | http://ddos.dnsnb8.net:799/cj//k2.rar | unknown | — | — | malicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
2104 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6708 | RUXIMICS.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
5496 | MoUsoCoreWorker.exe | 23.53.40.176:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
5496 | MoUsoCoreWorker.exe | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2112 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
3216 | svchost.exe | 172.211.123.250:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
6544 | svchost.exe | 20.190.159.129:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
ddos.dnsnb8.net |
| malicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2196 | svchost.exe | Misc activity | SUSPICIOUS [ANY.RUN] Domain previously seen in multiple payload deliveries (ddos .dnsnb8 .net) |
8172 | bGfoJD.exe | A Network Trojan was detected | BACKDOOR [ANY.RUN] Bdaejec Backdoor (download .rar) |
8172 | bGfoJD.exe | A Network Trojan was detected | BACKDOOR [ANY.RUN] Bdaejec Backdoor (download .rar) |