Backdoor.Win64.COBEACON.RN

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It connects to a website to send and receive information.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Backdoor adds the following processes:

• backgroundtaskhost.exe

It injects codes into the following process(es):

• Added backgroundtaskhost.exe

Backdoor Routine

This Backdoor connects to the following websites to send and receive information:

• https://{BLOCKED}c47sa.execute-api.us-east-1.amazonaws.com,/bfs/seed/log/report/log-reporter.js

Information Theft

This Backdoor gathers the following data:

• Computer Name
• User Name
• Loader Process Name
• OEM Charset
• ANSI Charset

Other Details

This Backdoor does the following:

• It checks if it is loaded by svchost.exe.
  • If it is loaded by svchost.exe, it will open and read the file {Loader File Path}\setting.dat into its memory, decrypt the file in memory and execute the decrypted code.
  • If it is not, it creates a new process of its loader in such a way that Windows will prevent non-Microsoft-signed binaries from being injected into that process.
• It requires the following file in order to continue with its malicious routine:
  • {Loader File Path}\setting.dat → detected as Backdoor.Win64.COBEACON.SMAC.stg