BKDR_COBEACON.QNA

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

This malware arrives via the following means:

• Downloaded by:
  • W2KM_DLOADER.WIZ

Backdoor Routine

This Backdoor executes the following commands from a remote malicious user:

• Alternate Parent Process
• Change file time
• Escalate privilege
• Execute PowerShell commands
• File System Commands
• Get Drives
• Inject Code into a process
• List Processes
• Manage Service
• Open a process
• Sleep
• Steal or Make token
• Terminate process
• Upload and Download Files
• Use and Purge Kerberos Tickets
• Create, Connect and Disconnect to named pipe
• Add or modify an environment variable

It connects to the following websites to send and receive information:

• http://{Random}.img.{BLOCKED}ntent.co/

Information Theft

This Backdoor gathers the following data:

• Malware Process ID
• Operating System
• CPU ID
• Operating System Version
• IP Address
• Computer Name
• User name

Stolen Information

This Backdoor sends the gathered information via HTTP POST to the following URL:

• http://{Random}.content.{BLOCKED}ntent.co/submit.php?id={Random}

Other Details

This Backdoor does the following:

• It uses a named pipe to send and receive commands.