Backdoor.Win64.COBEACON.YXEENZ

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

It gathers certain information on the affected computer.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Backdoor injects codes into the following process(es):

• %System%\lsass.exe

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

Backdoor Routine

This Backdoor executes the following commands from a remote malicious user:

• Connect and disconnect to a named pipe
• Escalate privileges
• Execute arbitrary commands
• Impersonate tokens
• Inject code into processes
• Manage directories (Create, Remove, Set Directory)
• Manage files (List, Create, Delete, Modify, Rename, Copy)
• Manage processes (List, Create, Terminate)
• List Drive Information
• Use/purge Kerberos tickets

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}t22.execute-api.us-west-1.amazonaws.com
• {BLOCKED}jfwg.execute-api.ap-northeast-1.amazonaws.com

As of this writing, the said sites are inaccessible.

Information Theft

This Backdoor gathers the following information on the affected computer:

• Username
• Computer name
• Current process ID
• Operating system version and Architecture