Analysis
- max time kernel
298s - max time network
169s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
- submitted
07/10/2026, 02:00
General
- Target Installer21691x64.exe
- Size 16.1MB
- Sample261007-cfdwrsbz6l
- SHA256 749009376b352dfd21f7289f549c0ed3ff515f813eb1eaf2e604ba75be02c9c2
Malware Config
Signatures
- Family: CNBackdoor
CNBackdoor aka CNB Bot is a backdoor that polls its C2 to download and execute additional malware.
- Enumerates VirtualBox registry keys 2 TTPs 4 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Looks for VMWare Tools registry key 2 TTPs 2 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes a file named after a Windows system binary 1 TTPs 2 IoCs
The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
- Executes dropped EXE 2 IoCs
- Themida packer 3 IoCs
Detects Themida, an advanced Windows software protection system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 1 IoCs
- Suspicious behavior: EnumeratesProcesses 26 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Installer21691x64.exe"C:\Users\Admin\AppData\Local\Temp\Installer21691x64.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath @('C:\Users\Admin\AppData\Local\Temp\','C:\Users\Admin\AppData\Local\Temp\Installer21691x64.exe','C:\Users\Admin\AppData\Local','C:\Users\Admin\AppData\Roaming','C:\Users\Admin\AppData\Local','C:\Users\Admin\AppData\Roaming','RuntimeBroker.exe','AppLaunch.exe','dwm.exe','svchost.exe','explorer.exe','services.exe','schtasks.exe','conhost.exe'); Add-MpPreference -ExclusionProcess @('C:\Users\Admin\AppData\Local\Temp\Installer21691x64.exe','RuntimeBroker.exe','InstallUtil.exe','AppLaunch.exe','dwm.exe','svchost.exe','explorer.exe','services.exe','schtasks.exe','conhost.exe','wscript.exe','concheck.exe','pathmsil.exe','ioextender.exe','tagSyncID.exe')"2⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -WindowStyle Hidden Start-Process 'C:\Users\Admin\AppData\Local\Temp\\tagSyncID.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tagSyncID.exe"C:\Users\Admin\AppData\Local\Temp\tagSyncID.exe"3⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Creates a file in the Startup directory
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\SpecsOptimizer\STD002\services.exe"C:\Users\Admin\AppData\Roaming\SpecsOptimizer\STD002\services.exe"4⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\13gkts1y.bat""4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout /t 3 /nobreak5⤵
- Delays execution with timeout.exe
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Debugger Evasion
1Masquerading
1Match Legitimate Name or Location
1Virtualization/Sandbox Evasion
4Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
13gkts1y.bat
__PSScriptPolicyTest_q1db2gau.0s3.ps1
tagSyncID.exe
install.dat
memory/1548-24-0x00000246A1E40000-0x00000246A1EF3000-memory.dmp
memory/1548-23-0x00000246A1E20000-0x00000246A1E3C000-memory.dmp
memory/1548-31-0x00000246A23E0000-0x00000246A23EA000-memory.dmp
memory/1548-16-0x00000246A1C30000-0x00000246A1C52000-memory.dmp
memory/1548-35-0x00000246A1C80000-0x00000246A1DCF000-memory.dmp
memory/1548-30-0x00000246A1F30000-0x00000246A1F36000-memory.dmp
memory/1548-25-0x00000246A1F00000-0x00000246A1F0A000-memory.dmp
memory/1548-26-0x00000246A23A0000-0x00000246A23BC000-memory.dmp
memory/1548-27-0x00000246A1F10000-0x00000246A1F1A000-memory.dmp
memory/1548-28-0x00000246A23C0000-0x00000246A23DA000-memory.dmp
memory/1548-29-0x00000246A1F20000-0x00000246A1F28000-memory.dmp
memory/2972-8-0x0000000000400000-0x0000000001BD0000-memory.dmp
memory/2972-1-0x00007FFB857FA000-0x00007FFB857FB000-memory.dmp
memory/2972-75-0x0000000000400000-0x0000000001BD0000-memory.dmp
memory/2972-4-0x00007FFB857E0000-0x00007FFB8589D000-memory.dmp
memory/2972-0-0x0000000000400000-0x0000000001BD0000-memory.dmp
memory/2972-38-0x000000001ED80000-0x000000001F912000-memory.dmp
memory/2972-2-0x00007FFB857E0000-0x00007FFB8589D000-memory.dmp
memory/2972-3-0x00007FFB857E0000-0x00007FFB8589D000-memory.dmp
memory/2972-32-0x0000000000400000-0x0000000001BD0000-memory.dmp
memory/2972-74-0x00007FFB857E0000-0x00007FFB8589D000-memory.dmp
memory/2972-5-0x00007FFB857E0000-0x00007FFB8589D000-memory.dmp
memory/2972-9-0x0000000000400000-0x0000000001BD0000-memory.dmp
memory/2972-36-0x00007FFB857E0000-0x00007FFB8589D000-memory.dmp
memory/5116-57-0x0000025758810000-0x0000025758886000-memory.dmp
memory/5116-54-0x000002573DA60000-0x000002573DAB4000-memory.dmp
memory/5116-51-0x000002573D530000-0x000002573D5BC000-memory.dmp
memory/5116-59-0x0000025757BD0000-0x0000025757BEE000-memory.dmp