Seeing this has two votes, I'll try to explain it.
Drupal uses the built-in PHP session mechanism, which as you rightly suspect is based on a cookie. The cookie name is SESS followed by a long string of characters, and its value is another long string of characters. PHP detects this cookie and makes it available to Drupal's session implementation, which by default uses the database table
sessions for storage, with the value of the cookie as the key
The session entry also records the user ID: early in the Drupal bootstrap sequence the session is loaded and then the corresponding user object, which is subsequently used to govern access to resources, based on the user's roles and other attributes.
Data stored in the PHP global array $_SESSION is automatically saved to the current session's database entry by Drupal at the end of a page request. This is typically used to store relatively transient data such as items in a shopping cart.
There's a lot more that could be said and I'll add some good references when I have a chance.