Backdoor.Win32.COBEACON.OSH

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Backdoor adds the following processes:

• %System%\cmd.exe "{Malware Path}\{Malware FileName}.exe"

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It injects codes into the following process(es):

• added %System%\cmd.exe process with created pipe named "MSSE-{4 Random Numbers}-server"

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

Backdoor Routine

This Backdoor executes the following commands from a remote malicious user:

• Inject Code to Processes
• Manage Directory(Create/Sets/Deletes Path)
• Impersonate Tokens
• Open Processes and obtain process information
• Create, Terminate, and List Running Processes
• Connect to a named pipe
• List Drive Information
• Read/Modify file time
• Manage Files (Create, Delete, Modify, List files in Directory, Copy Files, Move Files)
• Manage Services (Create, Delete, Start)
• Adjust permissions in process
• Enumerate Registry Data
• Retrieve IP Address mapping table

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• {Generated-ID}.dns.{BLOCKED}pe.com
• {Generated-ID}.dns2.{BLOCKED}pe.com
• {Generated-ID}.dns3.{BLOCKED}pe.com

Information Theft

This Backdoor gathers the following data:

• User Name
• Computer Name
• Host Name
• Local IP Address
• OS Version and Architecture
• Current Process ID