cnbackdoor | 749009376b352dfd21f7289f549c0ed3ff515f813eb1eaf2e604ba75be02c9c2

Analysis

max time kernel
148s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/10/2026, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Installer21691x64.exe
Size 16.1MB
Sample261007-e54jtssse1
SHA256 749009376b352dfd21f7289f549c0ed3ff515f813eb1eaf2e604ba75be02c9c2
MD5 770e477b5f8cd94a6783140a3bb62225
SHA1 36c20408877494fe44a04809a7730efc0d0a323a
SHA512 df666499f7d927dfb5ad45472928aded35ae4b6178c77067e3bad40e95a49744e6d1e515b18eeb5cfc35a061e55b1cf879bc9d30188bcfd9f9136e893a1abffa
SSDEEP 393216:cpxQTv84vaMxyerYiSX6Rse9SWC6Yuh7Ueh:gRlesiNRseIpAV9h
TLSH
T1CD07337D31C8042CE68CEF3B173BB58882EBBD366D389125E245F1BD5534AE152F1A29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion discovery execution cnbackdoor persistence privilege_escalation themida trojan

Malware Config

Signatures

Family: CNBackdoor
CNBackdoor aka CNB Bot is a backdoor that polls its C2 to download and execute additional malware.
backdoor cnbackdoor

Enumerates VirtualBox registry keys 2 TTPs 4 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	services.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	services.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	tagSyncID.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	tagSyncID.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Installer21691x64.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	tagSyncID.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	services.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
868	powershell.exe
992	powershell.exe
868	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	services.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	tagSyncID.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Installer21691x64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Installer21691x64.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ShortcutsManager.lnk	tagSyncID.exe

Executes a file named after a Windows system binary 1 TTPs 2 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Roaming\SpecsOptimizer\STD002\services.exe	tagSyncID.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\SpecsOptimizer\STD002\services.exe	services.exe

Executes dropped EXE 2 IoCs

pid	Process
1504	tagSyncID.exe
4056	services.exe

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/1240-5-0x0000000000400000-0x0000000001BD0000-memory.dmp	themida
behavioral1/memory/1240-6-0x0000000000400000-0x0000000001BD0000-memory.dmp	themida
behavioral1/memory/1240-61-0x0000000000400000-0x0000000001BD0000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Installer21691x64.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
1240	Installer21691x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3960	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	services.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	services.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	tagSyncID.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	tagSyncID.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	services.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	services.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2208	timeout.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
868	powershell.exe
868	powershell.exe
992	powershell.exe
992	powershell.exe
1504	tagSyncID.exe
4056	services.exe
4056	services.exe
4056	services.exe
4056	services.exe
4056	services.exe
4056	services.exe
4056	services.exe
4056	services.exe
4056	services.exe
4056	services.exe
4056	services.exe
4056	services.exe
4056	services.exe
4056	services.exe
4056	services.exe
4056	services.exe
4056	services.exe
4056	services.exe
4056	services.exe
4056	services.exe
4056	services.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1240	Installer21691x64.exe
Token: SeDebugPrivilege	868	powershell.exe
Token: SeDebugPrivilege	992	powershell.exe
Token: SeDebugPrivilege	1504	tagSyncID.exe
Token: SeDebugPrivilege	4056	services.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 868	1240	Installer21691x64.exe	88
PID 1240 wrote to memory of 992	1240	Installer21691x64.exe	97
PID 992 wrote to memory of 1504	992	powershell.exe	99
PID 1504 wrote to memory of 4056	1504	tagSyncID.exe	100
PID 1504 wrote to memory of 3960	1504	tagSyncID.exe	101
PID 3960 wrote to memory of 2208	3960	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\Installer21691x64.exe
"C:\Users\Admin\AppData\Local\Temp\Installer21691x64.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath @('C:\Users\Admin\AppData\Local\Temp\','C:\Users\Admin\AppData\Local\Temp\Installer21691x64.exe','C:\Users\Admin\AppData\Local','C:\Users\Admin\AppData\Roaming','C:\Users\Admin\AppData\Local','C:\Users\Admin\AppData\Roaming','RuntimeBroker.exe','AppLaunch.exe','dwm.exe','svchost.exe','explorer.exe','services.exe','schtasks.exe','conhost.exe'); Add-MpPreference -ExclusionProcess @('C:\Users\Admin\AppData\Local\Temp\Installer21691x64.exe','RuntimeBroker.exe','InstallUtil.exe','AppLaunch.exe','dwm.exe','svchost.exe','explorer.exe','services.exe','schtasks.exe','conhost.exe','wscript.exe','concheck.exe','pathmsil.exe','ioextender.exe','tagSyncID.exe')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -WindowStyle Hidden Start-Process 'C:\Users\Admin\AppData\Local\Temp\\tagSyncID.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:992
- - C:\Users\Admin\AppData\Local\Temp\tagSyncID.exe
    "C:\Users\Admin\AppData\Local\Temp\tagSyncID.exe"
    3⤵
    - Enumerates VirtualBox registry keys
    - Looks for VirtualBox Guest Additions in registry
    - Looks for VMWare Tools registry key
    - Creates a file in the Startup directory
    - Executes a file named after a Windows system binary
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1504
  - - C:\Users\Admin\AppData\Roaming\SpecsOptimizer\STD002\services.exe
      "C:\Users\Admin\AppData\Roaming\SpecsOptimizer\STD002\services.exe"
      4⤵
      Enumerates VirtualBox registry keys
      Looks for VirtualBox Guest Additions in registry
      Looks for VMWare Tools registry key
      Executes a file named after a Windows system binary
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4056
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ty8bmv9o.bat""
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3960
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 3 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Debugger Evasion

T1622

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Debugger Evasion

T1622

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 7305bcde3ba246a9b5c1666079c61596cc2ed2c651a1cd9e20557dba8a78c0e4
MD5 b7e1db446e63a2aae76cd85440a08856
SHA1 c900cc81335dd3ca6337e21f5bcde80f8e8a88f3
SHA512 dd63e28017eec632868489e469dd2ba54f20a3024be44550b729a0384bd55c5aa78171f7416612cd5174047afc544e21678ca164359962312b1d853c9bff04ea
TLSH
T1A2112263F3CD8920CC96163A509DAC5172B586CB81AEDF9F7FC0D210A1BF984CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_h5mb1ivl.meh.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h5mb1ivl.meh.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tagSyncID.exe

Path C:\Users\Admin\AppData\Local\Temp\tagSyncID.exe
Size 542KB
SHA256 7d5b65482b802bfd9bbdf098b6561a75d8855646c57815171cc1092f368cf6e1
MD5 626257baad0e9fa3a6e98953bd46a010
SHA1 600a6a3144e8eb87bab42814fa392c1bddadfb10
SHA512 037b7ca36b3af0344f67519ef6f1f258ce1440d30e38acd5d4a5ebd30e7fe903719780f0263eb0e61f82abef104ce0a16e462902db762d2374a8d8728203c7dc
SSDEEP 6144:Ar5F/Yp+wEBkVhXGTsEPCKDJ/T69gmWTMCvnjCDr2CcGU0BJAiPmiba9:ArUGKzOfJ7/TdnjC+GU0PAi9ba
TLSH
T149C46B17B6965D30C1841B3BE1EB900027F5A646B6FBDB89798D13CA4D073FED88A187
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ty8bmv9o.bat

Path C:\Users\Admin\AppData\Local\Temp\ty8bmv9o.bat
Size 202B
SHA256 9744b13181b77440e2af218b740751ba56475d6b897885cea84187cf742c8b20
MD5 97c464c7fc06023fe2c0e953a63e1294
SHA1 91d755158aa54b8a966a5906fd99b0fc0d6efd29
SHA512 474622b628043230eb17cc3743171a89ee2acca7a6b27c4fba7f9a236d5b9e3c4f93762feaeac3abf4d67de40966a53592be4f080016abb5b59285f77774d919
TLSH
T111D01209218BC7D5180428760EBF60A9B0A94CA79E8476528265C0BE569745F97E7BC1
MD5 SHA1 SHA512 TLSH

Submit Download

install.dat

Path C:\Users\Admin\AppData\Roaming\SpecsOptimizer\STD002\install.dat
Size 65B
SHA256 03359febf99c8b7e547ab28fdd8cfed7cd5de135724492a4b64a09215e6c2c77
MD5 52b7207735b0aed43ca4d76ea190970e
SHA1 b197b6dc3ef5193a34ba3fc07556acd868b267dc
SHA512 07907f9f41f7c361a47e388d751351024fcc6af59c19783f403ea64d5a2d6464aea1209f52a887a1520c757f566813dfe824a77fda56cb930c7d02db2500ed69
TLSH
T1D9A0022051CECB29540284E79FB7A04986EB46416AE4355F9772D498D180FA8A9C2613
MD5 SHA1 SHA512 TLSH

Submit Download

memory/868-19-0x00007FF96C250000-0x00007FF96C519000-memory.dmp

Download

memory/868-8-0x00007FF96C250000-0x00007FF96C519000-memory.dmp

Download

memory/868-16-0x000001B685930000-0x000001B685952000-memory.dmp

Download

memory/1240-23-0x000000001ECA0000-0x000000001F832000-memory.dmp

Download

memory/1240-2-0x00007FF96C250000-0x00007FF96C519000-memory.dmp

Download

memory/1240-21-0x00007FF96C250000-0x00007FF96C519000-memory.dmp

Download

memory/1240-0-0x0000000000400000-0x0000000001BD0000-memory.dmp

Download

memory/1240-7-0x00007FF96C250000-0x00007FF96C519000-memory.dmp

Download

memory/1240-6-0x0000000000400000-0x0000000001BD0000-memory.dmp

Download

memory/1240-5-0x0000000000400000-0x0000000001BD0000-memory.dmp

Download

memory/1240-20-0x0000000000400000-0x0000000001BD0000-memory.dmp

Download

memory/1240-61-0x0000000000400000-0x0000000001BD0000-memory.dmp

Download

memory/1240-60-0x00007FF96C250000-0x00007FF96C519000-memory.dmp

Download

memory/1240-1-0x00007FF96C2B4000-0x00007FF96C2B5000-memory.dmp

Download

memory/1504-37-0x0000026AA1040000-0x0000026AA10CC000-memory.dmp

Download

memory/1504-45-0x0000026ABB730000-0x0000026ABB74E000-memory.dmp

Download

memory/1504-43-0x0000026ABC200000-0x0000026ABC276000-memory.dmp

Download

memory/1504-40-0x0000026ABB6A0000-0x0000026ABB6F4000-memory.dmp

Download