cnbackdoor | 749009376b352dfd21f7289f549c0ed3ff515f813eb1eaf2e604ba75be02c9c2

Analysis

max time kernel
149s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/10/2026, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Installer21691x64.exe
Size 16.1MB
Sample261007-e54jtssse1
SHA256 749009376b352dfd21f7289f549c0ed3ff515f813eb1eaf2e604ba75be02c9c2
MD5 770e477b5f8cd94a6783140a3bb62225
SHA1 36c20408877494fe44a04809a7730efc0d0a323a
SHA512 df666499f7d927dfb5ad45472928aded35ae4b6178c77067e3bad40e95a49744e6d1e515b18eeb5cfc35a061e55b1cf879bc9d30188bcfd9f9136e893a1abffa
SSDEEP 393216:cpxQTv84vaMxyerYiSX6Rse9SWC6Yuh7Ueh:gRlesiNRseIpAV9h
TLSH
T1CD07337D31C8042CE68CEF3B173BB58882EBBD366D389125E245F1BD5534AE152F1A29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion discovery execution cnbackdoor persistence privilege_escalation themida trojan

Malware Config

Signatures

Family: CNBackdoor
CNBackdoor aka CNB Bot is a backdoor that polls its C2 to download and execute additional malware.
backdoor cnbackdoor

Enumerates VirtualBox registry keys 2 TTPs 4 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	services.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	tagSyncID.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	tagSyncID.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	services.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Installer21691x64.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	tagSyncID.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	services.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4232	powershell.exe
4232	powershell.exe
1092	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	tagSyncID.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	services.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Installer21691x64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Installer21691x64.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ShortcutsManager.lnk	tagSyncID.exe

Executes a file named after a Windows system binary 1 TTPs 2 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Roaming\SpecsOptimizer\STD002\services.exe	services.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\SpecsOptimizer\STD002\services.exe	tagSyncID.exe

Executes dropped EXE 2 IoCs

pid	Process
3564	tagSyncID.exe
2556	services.exe

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/4844-8-0x0000000000400000-0x0000000001BD0000-memory.dmp	themida
behavioral2/memory/4844-9-0x0000000000400000-0x0000000001BD0000-memory.dmp	themida
behavioral2/memory/4844-50-0x0000000000400000-0x0000000001BD0000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Installer21691x64.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
4844	Installer21691x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1828	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	tagSyncID.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	tagSyncID.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	services.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	services.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	services.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	services.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2484	timeout.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
4232	powershell.exe
4232	powershell.exe
1092	powershell.exe
1092	powershell.exe
3564	tagSyncID.exe
2556	services.exe
2556	services.exe
2556	services.exe
2556	services.exe
2556	services.exe
2556	services.exe
2556	services.exe
2556	services.exe
2556	services.exe
2556	services.exe
2556	services.exe
2556	services.exe
2556	services.exe
2556	services.exe
2556	services.exe
2556	services.exe
2556	services.exe
2556	services.exe
2556	services.exe
2556	services.exe
2556	services.exe
2556	services.exe
2556	services.exe
2556	services.exe
2556	services.exe
2556	services.exe
2556	services.exe
2556	services.exe
2556	services.exe
2556	services.exe
2556	services.exe
2556	services.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeDebugPrivilege	4844	Installer21691x64.exe
Token: SeDebugPrivilege	4232	powershell.exe
Token: SeIncreaseQuotaPrivilege	4232	powershell.exe
Token: SeSecurityPrivilege	4232	powershell.exe
Token: SeTakeOwnershipPrivilege	4232	powershell.exe
Token: SeLoadDriverPrivilege	4232	powershell.exe
Token: SeSystemProfilePrivilege	4232	powershell.exe
Token: SeSystemtimePrivilege	4232	powershell.exe
Token: SeProfSingleProcessPrivilege	4232	powershell.exe
Token: SeIncBasePriorityPrivilege	4232	powershell.exe
Token: SeCreatePagefilePrivilege	4232	powershell.exe
Token: SeBackupPrivilege	4232	powershell.exe
Token: SeRestorePrivilege	4232	powershell.exe
Token: SeShutdownPrivilege	4232	powershell.exe
Token: SeDebugPrivilege	4232	powershell.exe
Token: SeSystemEnvironmentPrivilege	4232	powershell.exe
Token: SeRemoteShutdownPrivilege	4232	powershell.exe
Token: SeUndockPrivilege	4232	powershell.exe
Token: SeManageVolumePrivilege	4232	powershell.exe
Token: 33	4232	powershell.exe
Token: 34	4232	powershell.exe
Token: 35	4232	powershell.exe
Token: 36	4232	powershell.exe
Token: SeIncreaseQuotaPrivilege	4232	powershell.exe
Token: SeSecurityPrivilege	4232	powershell.exe
Token: SeTakeOwnershipPrivilege	4232	powershell.exe
Token: SeLoadDriverPrivilege	4232	powershell.exe
Token: SeSystemProfilePrivilege	4232	powershell.exe
Token: SeSystemtimePrivilege	4232	powershell.exe
Token: SeProfSingleProcessPrivilege	4232	powershell.exe
Token: SeIncBasePriorityPrivilege	4232	powershell.exe
Token: SeCreatePagefilePrivilege	4232	powershell.exe
Token: SeBackupPrivilege	4232	powershell.exe
Token: SeRestorePrivilege	4232	powershell.exe
Token: SeShutdownPrivilege	4232	powershell.exe
Token: SeDebugPrivilege	4232	powershell.exe
Token: SeSystemEnvironmentPrivilege	4232	powershell.exe
Token: SeRemoteShutdownPrivilege	4232	powershell.exe
Token: SeUndockPrivilege	4232	powershell.exe
Token: SeManageVolumePrivilege	4232	powershell.exe
Token: 33	4232	powershell.exe
Token: 34	4232	powershell.exe
Token: 35	4232	powershell.exe
Token: 36	4232	powershell.exe
Token: SeDebugPrivilege	1092	powershell.exe
Token: SeDebugPrivilege	3564	tagSyncID.exe
Token: SeDebugPrivilege	2556	services.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 4232	4844	Installer21691x64.exe	89
PID 4844 wrote to memory of 1092	4844	Installer21691x64.exe	92
PID 1092 wrote to memory of 3564	1092	powershell.exe	94
PID 3564 wrote to memory of 2556	3564	tagSyncID.exe	96
PID 3564 wrote to memory of 1828	3564	tagSyncID.exe	97
PID 1828 wrote to memory of 2484	1828	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\Installer21691x64.exe
"C:\Users\Admin\AppData\Local\Temp\Installer21691x64.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath @('C:\Users\Admin\AppData\Local\Temp\','C:\Users\Admin\AppData\Local\Temp\Installer21691x64.exe','C:\Users\Admin\AppData\Local','C:\Users\Admin\AppData\Roaming','C:\Users\Admin\AppData\Local','C:\Users\Admin\AppData\Roaming','RuntimeBroker.exe','AppLaunch.exe','dwm.exe','svchost.exe','explorer.exe','services.exe','schtasks.exe','conhost.exe'); Add-MpPreference -ExclusionProcess @('C:\Users\Admin\AppData\Local\Temp\Installer21691x64.exe','RuntimeBroker.exe','InstallUtil.exe','AppLaunch.exe','dwm.exe','svchost.exe','explorer.exe','services.exe','schtasks.exe','conhost.exe','wscript.exe','concheck.exe','pathmsil.exe','ioextender.exe','tagSyncID.exe')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4232
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -WindowStyle Hidden Start-Process 'C:\Users\Admin\AppData\Local\Temp\\tagSyncID.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1092
- - C:\Users\Admin\AppData\Local\Temp\tagSyncID.exe
    "C:\Users\Admin\AppData\Local\Temp\tagSyncID.exe"
    3⤵
    - Enumerates VirtualBox registry keys
    - Looks for VirtualBox Guest Additions in registry
    - Looks for VMWare Tools registry key
    - Creates a file in the Startup directory
    - Executes a file named after a Windows system binary
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3564
  - - C:\Users\Admin\AppData\Roaming\SpecsOptimizer\STD002\services.exe
      "C:\Users\Admin\AppData\Roaming\SpecsOptimizer\STD002\services.exe"
      4⤵
      Enumerates VirtualBox registry keys
      Looks for VirtualBox Guest Additions in registry
      Looks for VMWare Tools registry key
      Executes a file named after a Windows system binary
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2556
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\f0md0web.bat""
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1828
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 3 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Debugger Evasion

T1622

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Debugger Evasion

T1622

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 070e2dc002fee5d6c6ae0611713bb24a9f01d741d964e7f1ece4f61789724a94
MD5 95e9928464a1f3425068f7e64a74060a
SHA1 9bdbd59bea34afd0aebf4d0c3d3cfe0317aa4d57
SHA512 a150525324ebe4a0dc28577f089c1f45ef0902355ecd9d5f10c91d45fe57d44d09c6d133a92c3f32dca0c73b97b259d5ad7ff4316edafa2cb00e38d64e043f06
TLSH
T1E9216833F3DD8654C899413A10CEAC1035B7C7DB40DECEDB6B84D559A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_n3v4j1vx.myz.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n3v4j1vx.myz.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

f0md0web.bat

Path C:\Users\Admin\AppData\Local\Temp\f0md0web.bat
Size 202B
SHA256 9744b13181b77440e2af218b740751ba56475d6b897885cea84187cf742c8b20
MD5 97c464c7fc06023fe2c0e953a63e1294
SHA1 91d755158aa54b8a966a5906fd99b0fc0d6efd29
SHA512 474622b628043230eb17cc3743171a89ee2acca7a6b27c4fba7f9a236d5b9e3c4f93762feaeac3abf4d67de40966a53592be4f080016abb5b59285f77774d919
TLSH
T111D01209218BC7D5180428760EBF60A9B0A94CA79E8476528265C0BE569745F97E7BC1
MD5 SHA1 SHA512 TLSH

Submit Download

tagSyncID.exe

Path C:\Users\Admin\AppData\Local\Temp\tagSyncID.exe
Size 542KB
SHA256 7d5b65482b802bfd9bbdf098b6561a75d8855646c57815171cc1092f368cf6e1
MD5 626257baad0e9fa3a6e98953bd46a010
SHA1 600a6a3144e8eb87bab42814fa392c1bddadfb10
SHA512 037b7ca36b3af0344f67519ef6f1f258ce1440d30e38acd5d4a5ebd30e7fe903719780f0263eb0e61f82abef104ce0a16e462902db762d2374a8d8728203c7dc
SSDEEP 6144:Ar5F/Yp+wEBkVhXGTsEPCKDJ/T69gmWTMCvnjCDr2CcGU0BJAiPmiba9:ArUGKzOfJ7/TdnjC+GU0PAi9ba
TLSH
T149C46B17B6965D30C1841B3BE1EB900027F5A646B6FBDB89798D13CA4D073FED88A187
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.dat

Path C:\Users\Admin\AppData\Roaming\SpecsOptimizer\STD002\install.dat
Size 65B
SHA256 03359febf99c8b7e547ab28fdd8cfed7cd5de135724492a4b64a09215e6c2c77
MD5 52b7207735b0aed43ca4d76ea190970e
SHA1 b197b6dc3ef5193a34ba3fc07556acd868b267dc
SHA512 07907f9f41f7c361a47e388d751351024fcc6af59c19783f403ea64d5a2d6464aea1209f52a887a1520c757f566813dfe824a77fda56cb930c7d02db2500ed69
TLSH
T1D9A0022051CECB29540284E79FB7A04986EB46416AE4355F9772D498D180FA8A9C2613
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3564-40-0x00000119329D0000-0x00000119329EE000-memory.dmp

Download

memory/3564-38-0x0000011932B80000-0x0000011932BF6000-memory.dmp

Download

memory/3564-35-0x000001191A150000-0x000001191A1A4000-memory.dmp

Download

memory/3564-33-0x0000011918300000-0x000001191838C000-memory.dmp

Download

memory/4232-20-0x0000019BDD6E0000-0x0000019BDD6EA000-memory.dmp

Download

memory/4232-19-0x0000019BDD910000-0x0000019BDD9C2000-memory.dmp

Download

memory/4232-15-0x0000019BC5530000-0x0000019BC5552000-memory.dmp

Download

memory/4232-18-0x0000019BDD8F0000-0x0000019BDD90E000-memory.dmp

Download

memory/4844-9-0x0000000000400000-0x0000000001BD0000-memory.dmp

Download

memory/4844-0-0x0000000000400000-0x0000000001BD0000-memory.dmp

Download

memory/4844-11-0x00007FFFBD7F0000-0x00007FFFBE194000-memory.dmp

Download

memory/4844-22-0x00007FFFBD7F0000-0x00007FFFBE194000-memory.dmp

Download

memory/4844-23-0x00007FFFBD7F0000-0x00007FFFBE194000-memory.dmp

Download

memory/4844-25-0x000000001EE70000-0x000000001FA02000-memory.dmp

Download

memory/4844-10-0x00007FFFBD7F0000-0x00007FFFBE194000-memory.dmp

Download

memory/4844-12-0x00007FFFBD7F0000-0x00007FFFBE194000-memory.dmp

Download

memory/4844-8-0x0000000000400000-0x0000000001BD0000-memory.dmp

Download

memory/4844-7-0x00007FFFBD7F0000-0x00007FFFBE194000-memory.dmp

Download

memory/4844-6-0x00007FFFBD7F0000-0x00007FFFBE194000-memory.dmp

Download

memory/4844-5-0x00007FFFBD97F000-0x00007FFFBD980000-memory.dmp

Download

memory/4844-2-0x00007FFF80030000-0x00007FFF80031000-memory.dmp

Download

memory/4844-1-0x00007FFF80000000-0x00007FFF80002000-memory.dmp

Download

memory/4844-47-0x00007FFFBD7F0000-0x00007FFFBE194000-memory.dmp

Download

memory/4844-50-0x0000000000400000-0x0000000001BD0000-memory.dmp

Download

memory/4844-51-0x00007FFFBD7F0000-0x00007FFFBE194000-memory.dmp

Download