cnbackdoor | 749009376b352dfd21f7289f549c0ed3ff515f813eb1eaf2e604ba75be02c9c2

Analysis

max time kernel
298s
max time network
177s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
07/10/2026, 02:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Installer21691x64.exe
Size 16.1MB
Sample261007-cfdwrsbz6l
SHA256 749009376b352dfd21f7289f549c0ed3ff515f813eb1eaf2e604ba75be02c9c2
MD5 770e477b5f8cd94a6783140a3bb62225
SHA1 36c20408877494fe44a04809a7730efc0d0a323a
SHA512 df666499f7d927dfb5ad45472928aded35ae4b6178c77067e3bad40e95a49744e6d1e515b18eeb5cfc35a061e55b1cf879bc9d30188bcfd9f9136e893a1abffa
SSDEEP 393216:cpxQTv84vaMxyerYiSX6Rse9SWC6Yuh7Ueh:gRlesiNRseIpAV9h
TLSH
T1CD07337D31C8042CE68CEF3B173BB58882EBBD366D389125E245F1BD5534AE152F1A29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion discovery execution cnbackdoor persistence privilege_escalation themida trojan

Malware Config

Signatures

Family: CNBackdoor
CNBackdoor aka CNB Bot is a backdoor that polls its C2 to download and execute additional malware.
backdoor cnbackdoor

Enumerates VirtualBox registry keys 2 TTPs 4 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	services.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	tagSyncID.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	tagSyncID.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	services.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Installer21691x64.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	tagSyncID.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	services.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4572	powershell.exe
4572	powershell.exe
928	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	services.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	tagSyncID.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Installer21691x64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Installer21691x64.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ShortcutsManager.lnk	tagSyncID.exe

Executes a file named after a Windows system binary 1 TTPs 2 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Roaming\SpecsOptimizer\STD002\services.exe	tagSyncID.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\SpecsOptimizer\STD002\services.exe	services.exe

Executes dropped EXE 2 IoCs

pid	Process
740	tagSyncID.exe
5040	services.exe

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/2516-5-0x0000000000400000-0x0000000001BD0000-memory.dmp	themida
behavioral2/memory/2516-6-0x0000000000400000-0x0000000001BD0000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Installer21691x64.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
2516	Installer21691x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2124	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	services.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	tagSyncID.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	tagSyncID.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	services.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	services.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	services.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5096	timeout.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
4572	powershell.exe
4572	powershell.exe
928	powershell.exe
928	powershell.exe
740	tagSyncID.exe
5040	services.exe
5040	services.exe
5040	services.exe
5040	services.exe
5040	services.exe
5040	services.exe
5040	services.exe
5040	services.exe
5040	services.exe
5040	services.exe
5040	services.exe
5040	services.exe
5040	services.exe
5040	services.exe
5040	services.exe
5040	services.exe
5040	services.exe
5040	services.exe
5040	services.exe
5040	services.exe
5040	services.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeDebugPrivilege	2516	Installer21691x64.exe
Token: SeDebugPrivilege	4572	powershell.exe
Token: SeIncreaseQuotaPrivilege	4572	powershell.exe
Token: SeSecurityPrivilege	4572	powershell.exe
Token: SeTakeOwnershipPrivilege	4572	powershell.exe
Token: SeLoadDriverPrivilege	4572	powershell.exe
Token: SeSystemProfilePrivilege	4572	powershell.exe
Token: SeSystemtimePrivilege	4572	powershell.exe
Token: SeProfSingleProcessPrivilege	4572	powershell.exe
Token: SeIncBasePriorityPrivilege	4572	powershell.exe
Token: SeCreatePagefilePrivilege	4572	powershell.exe
Token: SeBackupPrivilege	4572	powershell.exe
Token: SeRestorePrivilege	4572	powershell.exe
Token: SeShutdownPrivilege	4572	powershell.exe
Token: SeDebugPrivilege	4572	powershell.exe
Token: SeSystemEnvironmentPrivilege	4572	powershell.exe
Token: SeRemoteShutdownPrivilege	4572	powershell.exe
Token: SeUndockPrivilege	4572	powershell.exe
Token: SeManageVolumePrivilege	4572	powershell.exe
Token: 33	4572	powershell.exe
Token: 34	4572	powershell.exe
Token: 35	4572	powershell.exe
Token: 36	4572	powershell.exe
Token: SeIncreaseQuotaPrivilege	4572	powershell.exe
Token: SeSecurityPrivilege	4572	powershell.exe
Token: SeTakeOwnershipPrivilege	4572	powershell.exe
Token: SeLoadDriverPrivilege	4572	powershell.exe
Token: SeSystemProfilePrivilege	4572	powershell.exe
Token: SeSystemtimePrivilege	4572	powershell.exe
Token: SeProfSingleProcessPrivilege	4572	powershell.exe
Token: SeIncBasePriorityPrivilege	4572	powershell.exe
Token: SeCreatePagefilePrivilege	4572	powershell.exe
Token: SeBackupPrivilege	4572	powershell.exe
Token: SeRestorePrivilege	4572	powershell.exe
Token: SeShutdownPrivilege	4572	powershell.exe
Token: SeDebugPrivilege	4572	powershell.exe
Token: SeSystemEnvironmentPrivilege	4572	powershell.exe
Token: SeRemoteShutdownPrivilege	4572	powershell.exe
Token: SeUndockPrivilege	4572	powershell.exe
Token: SeManageVolumePrivilege	4572	powershell.exe
Token: 33	4572	powershell.exe
Token: 34	4572	powershell.exe
Token: 35	4572	powershell.exe
Token: 36	4572	powershell.exe
Token: SeDebugPrivilege	928	powershell.exe
Token: SeDebugPrivilege	740	tagSyncID.exe
Token: SeDebugPrivilege	5040	services.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 4572	2516	Installer21691x64.exe	84
PID 2516 wrote to memory of 928	2516	Installer21691x64.exe	94
PID 928 wrote to memory of 740	928	powershell.exe	96
PID 740 wrote to memory of 5040	740	tagSyncID.exe	97
PID 740 wrote to memory of 2124	740	tagSyncID.exe	98
PID 2124 wrote to memory of 5096	2124	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\Installer21691x64.exe
"C:\Users\Admin\AppData\Local\Temp\Installer21691x64.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath @('C:\Users\Admin\AppData\Local\Temp\','C:\Users\Admin\AppData\Local\Temp\Installer21691x64.exe','C:\Users\Admin\AppData\Local','C:\Users\Admin\AppData\Roaming','C:\Users\Admin\AppData\Local','C:\Users\Admin\AppData\Roaming','RuntimeBroker.exe','AppLaunch.exe','dwm.exe','svchost.exe','explorer.exe','services.exe','schtasks.exe','conhost.exe'); Add-MpPreference -ExclusionProcess @('C:\Users\Admin\AppData\Local\Temp\Installer21691x64.exe','RuntimeBroker.exe','InstallUtil.exe','AppLaunch.exe','dwm.exe','svchost.exe','explorer.exe','services.exe','schtasks.exe','conhost.exe','wscript.exe','concheck.exe','pathmsil.exe','ioextender.exe','tagSyncID.exe')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -WindowStyle Hidden Start-Process 'C:\Users\Admin\AppData\Local\Temp\\tagSyncID.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:928
- - C:\Users\Admin\AppData\Local\Temp\tagSyncID.exe
    "C:\Users\Admin\AppData\Local\Temp\tagSyncID.exe"
    3⤵
    - Enumerates VirtualBox registry keys
    - Looks for VirtualBox Guest Additions in registry
    - Looks for VMWare Tools registry key
    - Creates a file in the Startup directory
    - Executes a file named after a Windows system binary
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:740
  - - C:\Users\Admin\AppData\Roaming\SpecsOptimizer\STD002\services.exe
      "C:\Users\Admin\AppData\Roaming\SpecsOptimizer\STD002\services.exe"
      4⤵
      Enumerates VirtualBox registry keys
      Looks for VirtualBox Guest Additions in registry
      Looks for VMWare Tools registry key
      Executes a file named after a Windows system binary
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5040
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rxznndx2.bat""
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2124
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 3 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:5096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Debugger Evasion

T1622

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Debugger Evasion

T1622

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 c485a6e2fd17c342fca60060f47d6a5655a65a412e35e001bb5bf88d96e6e485
MD5 3eb3833f769dd890afc295b977eab4b4
SHA1 e857649b037939602c72ad003e5d3698695f436f
SHA512 c24bbc8f278478d43756807b8c584d4e3fb2289db468bc92986a489f74a8da386a667a758360a397e77e018e363be8912ac260072fa3e31117ad0599ac749e72
TLSH
T13A51EE313375B0D4C95A7F07193819C063BF8386E698AF58B65C521ED92751B9B222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 16bb1cfdd524f8b61a72e41bc3f6dadfc3804c577c297085d6c28e40fc05de17
MD5 08fa151f0800365d5f220dd818f97373
SHA1 58cfaa3efb8ecaefabea23c1a366bebf698b648b
SHA512 40ce138c3aa85651f5cd094fa76e4ae503a50bef7425409559853331fe63dc7f23c060b7fe04c5a3054f14833fe5309345ab31954c2ae01a4983b2880a85d9a6
TLSH
T1E0217423B3DDC850CC99423A609C9C9076B697C780DEDF9B2EC4C211907FA99CB101A0
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_tl5knc2z.0bx.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tl5knc2z.0bx.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

rxznndx2.bat

Path C:\Users\Admin\AppData\Local\Temp\rxznndx2.bat
Size 202B
SHA256 9744b13181b77440e2af218b740751ba56475d6b897885cea84187cf742c8b20
MD5 97c464c7fc06023fe2c0e953a63e1294
SHA1 91d755158aa54b8a966a5906fd99b0fc0d6efd29
SHA512 474622b628043230eb17cc3743171a89ee2acca7a6b27c4fba7f9a236d5b9e3c4f93762feaeac3abf4d67de40966a53592be4f080016abb5b59285f77774d919
TLSH
T111D01209218BC7D5180428760EBF60A9B0A94CA79E8476528265C0BE569745F97E7BC1
MD5 SHA1 SHA512 TLSH

Submit Download

tagSyncID.exe

Path C:\Users\Admin\AppData\Local\Temp\tagSyncID.exe
Size 542KB
SHA256 7d5b65482b802bfd9bbdf098b6561a75d8855646c57815171cc1092f368cf6e1
MD5 626257baad0e9fa3a6e98953bd46a010
SHA1 600a6a3144e8eb87bab42814fa392c1bddadfb10
SHA512 037b7ca36b3af0344f67519ef6f1f258ce1440d30e38acd5d4a5ebd30e7fe903719780f0263eb0e61f82abef104ce0a16e462902db762d2374a8d8728203c7dc
SSDEEP 6144:Ar5F/Yp+wEBkVhXGTsEPCKDJ/T69gmWTMCvnjCDr2CcGU0BJAiPmiba9:ArUGKzOfJ7/TdnjC+GU0PAi9ba
TLSH
T149C46B17B6965D30C1841B3BE1EB900027F5A646B6FBDB89798D13CA4D073FED88A187
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.dat

Path C:\Users\Admin\AppData\Roaming\SpecsOptimizer\STD002\install.dat
Size 65B
SHA256 03359febf99c8b7e547ab28fdd8cfed7cd5de135724492a4b64a09215e6c2c77
MD5 52b7207735b0aed43ca4d76ea190970e
SHA1 b197b6dc3ef5193a34ba3fc07556acd868b267dc
SHA512 07907f9f41f7c361a47e388d751351024fcc6af59c19783f403ea64d5a2d6464aea1209f52a887a1520c757f566813dfe824a77fda56cb930c7d02db2500ed69
TLSH
T1D9A0022051CECB29540284E79FB7A04986EB46416AE4355F9772D498D180FA8A9C2613
MD5 SHA1 SHA512 TLSH

Submit Download

memory/740-41-0x000002119D0B0000-0x000002119D0CE000-memory.dmp

Download

memory/740-39-0x00000211B5AA0000-0x00000211B5B16000-memory.dmp

Download

memory/740-36-0x000002119D040000-0x000002119D094000-memory.dmp

Download

memory/740-34-0x000002119B3A0000-0x000002119B42C000-memory.dmp

Download

memory/2516-6-0x0000000000400000-0x0000000001BD0000-memory.dmp

Download

memory/2516-20-0x000000001EC70000-0x000000001F802000-memory.dmp

Download

memory/2516-18-0x0000000000400000-0x0000000001BD0000-memory.dmp

Download

memory/2516-7-0x00007FF98DF00000-0x00007FF98E09F000-memory.dmp

Download

memory/2516-0-0x0000000000400000-0x0000000001BD0000-memory.dmp

Download

memory/2516-5-0x0000000000400000-0x0000000001BD0000-memory.dmp

Download

memory/2516-2-0x00007FF98DF00000-0x00007FF98E09F000-memory.dmp

Download

memory/2516-1-0x00007FF98DF00000-0x00007FF98E09F000-memory.dmp

Download

memory/4572-8-0x0000023C5ED80000-0x0000023C5EDA2000-memory.dmp

Download