761181dec1d22dc212a6592cbe459950cc59101a2a7c503e92ea32eb1f2a85ce

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20250207-en
resource tags

arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system
submitted
21/03/2025, 08:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
Size

10.4MB
MD5

9282b9c6cae1582190963583c43102af
SHA1

bb37f1efbf8793e0126dc958851b2bf2f3917235
SHA256

761181dec1d22dc212a6592cbe459950cc59101a2a7c503e92ea32eb1f2a85ce
SHA512

109c7feb589cb32cec4f10431b509364e5fb0c27075950241cc17c9cb80b27ee3c98e6157c25d21192fa82a433b9edff903ffdb2d7a31ea47fd3da1159014038
SSDEEP

196608:I+D5q1SGs2yRwtkpqShRBhRhhRQhRWhRkhRWhRw:DAkLRLRrRMRCR4RCRw

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\p = "c:\\Windows\\System32\\p.exe"	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bdb = "c:\\Windows\\System32\\bdb.exe"	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UitX = "c:\\Windows\\System32\\UitX.exe"	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe

Drops desktop.ini file(s) 9 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Microsoft Games\Hearts\desktop.ini	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Microsoft Games\Chess\desktop.ini	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File created	C:\Program Files\desktop.ini	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\bdb.exe	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File created	\??\c:\Windows\System32\UitX.exe	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File created	\??\c:\Windows\System32\p.exe	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\masterix.gif	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Port-au-Prince	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml.exe	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\splashscreen.dll	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\Java\jre7\lib\security\java.security	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\fr-FR\Hearts.exe.mui	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.dll.exe	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Management.Instrumentation.dll.exe	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libreal_plugin.dll	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rssBackBlue_docked.png.exe	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\IpsMigrationPlugin.dll.exe	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-tools_zh_CN.jar.exe	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+3	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\control\libgestures_plugin.dll.exe	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Windows Journal\Templates\Memo.jtp	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square_dot.png	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\(144DPI)redStateIcon.png	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh.htm	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-uihandler.xml.exe	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup-impl_zh_CN.jar.exe	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\Java\jre7\bin\jaas_nt.dll	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Knox	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Windows.Presentation.resources.dll.exe	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_divider_left.png	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Internet Explorer\ie9props.propdesc.exe	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\about.html.exe	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-core-kit.xml.exe	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler_ja.jar	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\Mozilla Firefox\platform.ini	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stucco.gif.exe	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\am.pak.exe	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-awt.xml	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-templates.xml.exe	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\jamendo.luac.exe	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libx265_plugin.dll.exe	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\combo-hover-left.png.exe	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IpsMigrationPlugin.dll.mui.exe	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipssrb.xml.exe	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_cs.jar	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\feature.xml	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861240811.profile.gz.exe	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Java\jre7\lib\psfontj2d.properties.exe	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libcc_plugin.dll.exe	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_ButtonGraphic.png.exe	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\blackbars80.png.exe	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_zh_4.4.0.v20140623020002.jar.exe	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-print_zh_CN.jar.exe	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-settings.xml.exe	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File created	C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\vlc.mo.exe	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libimage_plugin.dll	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tipskins.dll	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Kaliningrad.exe	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.filetransfer_5.0.0.v20140827-1444.jar	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-swing-outline.xml	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libwasapi_plugin.dll	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square_h.png	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Common Files\System\ado\msadomd.dll.exe	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\feature.xml	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Ushuaia.exe	2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe

C:\Users\Admin\AppData\Local\Temp\2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2025-03-21_9282b9c6cae1582190963583c43102af_cobalt-strike_ezcob_poet-rat_sliver_snatch.exe"
1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip32.dll

Filesize
11.2MB

MD5
3e82ec59270ead3c496e9e0402ca6682

SHA1
0609234271ea2a8bdacc67ee98bd721b8aaea1c1

SHA256
1b26e24c1beefff15d8c2965d1210efacaf2825ed08878ae01d38539536f2089

SHA512
e3c94b40fd3bf6a0e0a2a780c732ef9210cdf051ba6de7861f819ac9ec1e541eef48209c9b9dba5c574bb2042cf8b1db3323758e0787e28a0d09188e9d567fd7

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads