Backdoor.Win64.COBEACON.QND

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any file infection routine.

It does not have any propagation routine.

It executes commands from a remote malicious user, effectively compromising the affected system.

It does not have any information-stealing capability.

It connects to certain websites to send and receive information.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Infection Points

This Backdoor does not have any file infection routine.

Installation

This Backdoor adds the following processes:

• %System%\notepad.exe

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It injects codes into the following process(es):

• added %System%\notepad.exe process

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

Propagation

This Backdoor does not have any propagation routine.

Backdoor Routine

This Backdoor executes the following commands from a remote malicious user:

• Execute PowerShell commands
• Upload/Download files
• Manage files
• Manage services
• Read/Modify file time
• Obtain/Create access tokens
• Impersonate tokens
• Open processes
• Inject codes to processes
• Adjust permissions in process
• Connect to a named pipe
• Use/Purge Kerberos tickets
• Escalate privileges

Rootkit Capabilities

This Backdoor does not have rootkit capabilities.

Information Theft

This Backdoor does not have any information-stealing capability.

Other Details

This Backdoor connects to the following website to send and receive information:

• http://12491.{BLOCKED}.somberbagel-hx.org/weye?param={value}
• http://12491.{BLOCKED}.wistfuleye.net,/weye?param={value}
• http://12491.{BLOCKED}.cobaltfinder.org/weye?param={value}

It does the following:

• This malware starts the following service:
  • DceRpcSs

It does not exploit any vulnerability.