Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
30/03/2025, 19:09
Behavioral task
behavioral1
Sample
2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe
Resource
win7-20240903-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe
-
Size
5.3MB
-
MD5
e69dd18109678f31142c2765fb17ecea
-
SHA1
12930dc63fac9d962147328f13344ebc4d8e9494
-
SHA256
5c99e566021729e95f364fb67ce0927ea7a2f5066a731ba60ff2a1251cb3ab42
-
SHA512
11ad4df533622de701d6a58e3219472fdf613b8e62e90c9eb964ec23aae444fe5d16b6f4e3cfb986edc74ee2de9cb0a285877f4ab2d8527a2603dfd43e1cbe59
-
SSDEEP
98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/VQOL7Ox1lrsy0:pWvSDzaxztQVjL7bD
Malware Config
Signatures
-
Gofing
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
-
Gofing family
-
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation. 3 IoCs
resource yara_rule behavioral2/files/0x00050000000227be-4.dat family_gofing behavioral2/files/0x0002000000021965-5475.dat family_gofing behavioral2/files/0x0002000000021e38-5485.dat family_gofing -
Renames multiple (52) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe -
Loads dropped DLL 64 IoCs
pid Process 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found 3384 Process not Found -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops Chrome extension 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\manifest.json 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File created C:\Users\Public\Libraries\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Fonts\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\3D Objects\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Documents\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Pictures\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Saved Games\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Downloads\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Pictures\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Public\AccountPictures\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Music\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Searches\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Videos\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Favorites\Links\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Music\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\$Recycle.Bin\S-1-5-21-3342763580-2723508992-2885672917-1000\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Favorites\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Downloads\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Downloaded Program Files\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Links\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\OneDrive\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Pictures\Camera Roll\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Documents\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Contacts\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Desktop\desktop.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNotePageSmallTile.scale-200.png 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-pl.xrm-ms 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nl-nl\ui-strings.js 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-125_contrast-white.png 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square150x150Logo.scale-400.png 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\gl.pak.DATA 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-ul-oob.xrm-ms 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-80.png 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Resources\1033\msmdsrv.rll 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Linq.Resources.dll 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libfilesystem_plugin.dll 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-black\MedTile.scale-200.png 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-white\SmallTile.scale-200.png 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_zh_tw_135x40.svg 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\thaidict.md 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ul-oob.xrm-ms 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalSplashScreen.scale-200.png 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.1813.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.Win32.SystemEvents.dll 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Controls.Ribbon.resources.dll 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Cryptography.ProtectedData.dll 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_proxy\canary.identity_helper.exe.manifest 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\os_update_handler.exe 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-black\SmallTile.scale-125.png 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\WideTile.scale-400_contrast-black.png 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubStoreLogo.scale-200_contrast-black.png 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-gb\locimages\offsymxl.ttf 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeSmallTile.scale-200.png 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\circle.cur 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\Locales\nl.pak 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xmlresolver.md 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-pl.xrm-ms 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.exe 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\HoloAssets\HoloLens_HeadTracking.png 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptyView.scale-400.png 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\FetchingMail.scale-400.png 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-black\LargeTile.scale-200.png 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-60_altform-unplated_contrast-white.png 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\README.md 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\TextConversionModule.dll 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SPRING\PREVIEW.GIF 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\9.jpg 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\TimerMedTile.contrast-white_scale-200.png 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XmlDocument.dll 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\msedgeupdateres_it.dll 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\msedgeupdateres_mt.dll 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_BypassTrial180-ul-oob.xrm-ms 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sfodbc_sb64.dll 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\iacom2im.dll 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\TipRes.dll.mui 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\hu.pak 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\gu.pak.DATA 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.onenotemui.msi.16.en-us.xml 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationClient.resources.dll 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\offsymsl.ttf 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarMediumTile.scale-125.png 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.DiaSymReader.Native.amd64.dll 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.PerformanceCounter.dll 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Fonts\ega80737.fon 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Fonts\serifft.fon 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\c_fdc.inf 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\errdev.PNF 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\pmem.PNF 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\wfcvsc.inf 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Boot\EFI\nl-NL\bootmgfw.efi.mui 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Boot\PCAT\ru-RU\bootmgr.exe.mui 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Fonts\ANTQUAI.TTF 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Fonts\BKANT.TTF 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Fonts\vga857.fon 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\MSDTC\0C0A\msdtcprf.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\acxhdaudiop.inf 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\mssmbios.inf 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\mdmntt1.inf 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Fonts\GARABD.TTF 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Fonts\tahomabd.ttf 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\ru-RU_BitLockerToGo.exe.mui 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Boot\EFI\kd_02_15b3.dll 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\athw8x.inf 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\buttonconverter.inf 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\mdmracal.inf 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Boot\Misc\PCAT\bootspaces.dll 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Branding\Basebrd\en-US\basebrd.dll.mui 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Cursors\aero_ns_l.cur 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Cursors\lnodrop.cur 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Fonts\courbd.ttf 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\ESENT\esentprf.hxx 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\ServiceModelOperation 3.0.0.0\0C0A\_ServiceModelOperationPerfCounters_D.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\input.PNF 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\mdmc26a.inf 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Help\mui\0410\msorcl32.chm 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\flpydisk.inf 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\netbc63a.inf 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\scunknown.inf 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Boot\EFI\zh-CN\memtest.efi.mui 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Boot\PCAT\ro-RO\bootmgr.exe.mui 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Cursors\ns.svg 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Globalization\ELS\SpellDictionaries\MsSp7it.dub 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\ServiceModelOperation 3.0.0.0\0407\_ServiceModelOperationPerfCounters_D.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\UGTHRSVC\0409\gthrctr.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\intelta.inf 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Boot\Fonts\segoe_slboot.ttf 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Boot\PCAT\hu-HU\bootmgr.exe.mui 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Cursors\pen_rl.cur 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\bcmwdidhdpcie.inf 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\net819xp.inf 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Branding\Basebrd\uk-UA\basebrd.dll.mui 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Fonts\GlobalSerif.CompositeFont 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\.NET Data Provider for SqlServer\0000\_dataperfcounters_shared12_neutral_d.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\c_scsiadapter.inf 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\mchgr.inf 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\wgencounter.inf 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Boot\PCAT\fr-FR\bootmgr.exe.mui 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Boot\Resources\ja-JP\bootres.dll.mui 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Cursors\aero_arrow_xl.cur 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Cursors\aero_ns_xl.cur 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\IME\IMEJP\help\IMJPCLE.CHM 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\MSDTC Bridge 4.0.0.0\0410\_TransactionBridgePerfCounters_d.ini 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\vdrvroot.inf 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Boot\PCAT\bootuwf.dll 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Fonts\seguili.ttf 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\intelta.PNF 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Cursors\wait_il.cur 2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2025-03-30_e69dd18109678f31142c2765fb17ecea_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe"1⤵
- Drops startup file
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
PID:3372
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.2MB
MD5948c6aaa2289e11fabd9e8f011bb7342
SHA192ce19e1aaa3d5b21ade19bab8279a13c5eafeb6
SHA2562a549c23b4e57a5f53bb227a4b62700b2395fa4d10253ec7fe68b51fb171bed9
SHA5128c290957d3dd162c299f89f7855c206e2b51aa2b29a3995a207113756537ac7a06500d485ab3955057c85756fee936c92cf5c821455faf8c21bb9d62b820656c
-
Filesize
4.4MB
MD5bcd4373fd74fded1c0b4d239bc1493a9
SHA1bebf78251b78fb34ba62795c2935d76529ecf617
SHA256d0154834022bcc5cfdf82414a13465ec2fd82077d17dd96e3c7d5714c2062b23
SHA512b35d7611607ea8b05a01d5d9a8711590c4745f9f2cc5bda8cdcc88737d68cb4e0c7501255254375b09b2d74de65dd3a7ee049c65137ed97497990685c23099fd
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
Filesize5.8MB
MD50b949b36e4d7bdefc4595ad34f60611a
SHA151f1a58be5aef91054cf6c4b2ca68265b70f1489
SHA2560f35893b09c5e9717b4728bf78360e314966aaddf69b52abd464b8bfb4b2557e
SHA512967df7d7fd49c9939b8ff278aa9900fcd112badaa58a24395fc9310b8397e3a79e1395bc1628fa0feaa57f888edb7d7e00399b889eb6830b0118d2c187d30ac5