Analysis
-
max time kernel
149s -
max time network
104s -
platform
windows11-21h2_x64 -
resource
win11-20250502-en -
resource tags
arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system -
submitted
03/05/2025, 14:39
Behavioral task
behavioral1
Sample
2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe
Resource
win11-20250502-en
General
-
Target
2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe
-
Size
4.2MB
-
MD5
458ac649d306548cb8790ba14c527d45
-
SHA1
8d55dcfc4b855dc33d2c286f68d99c265e44ad51
-
SHA256
0eaf026cf260392efdd3c75a698b380cb03ad3fa6a8c1ccf19a6e273990e9752
-
SHA512
ab2490b605cffe74d99f9f7a46c2912e2699bf284578688c13a5d59eadc6efa21ab07e2a65b1b834bf87f37d53e09526cf752f18a1976d5118b083e0d012a67a
-
SSDEEP
49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q4k:ieF+iIAEl1JPz212IhzL+Bzz3dw/V/2
Malware Config
Signatures
-
Gofing
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
-
Gofing family
-
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation. 3 IoCs
resource yara_rule behavioral2/files/0x000300000002a252-4.dat family_gofing behavioral2/files/0x00020000000291f7-5423.dat family_gofing behavioral2/files/0x0002000000029671-5440.dat family_gofing -
Renames multiple (52) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Drivers directory 22 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\ja-JP\ndiscap.sys.mui 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\uk-UA\NdisImPlatform.sys.mui 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\afunix.sys 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\de-DE\wfplwfs.sys.mui 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\en-US\NdisImPlatform.sys.mui 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\it-IT\ndiscap.sys.mui 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\it-IT\wfplwfs.sys.mui 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\ja-JP\wfplwfs.sys.mui 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\de-DE\ndiscap.sys.mui 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\en-US\wfplwfs.sys.mui 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\fr-FR\NdisImPlatform.sys.mui 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\fr-FR\ndiscap.sys.mui 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\fr-FR\wfplwfs.sys.mui 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\gm.dls 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\es-ES\ndiscap.sys.mui 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\gmreadme.txt 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\ja-JP\NdisImPlatform.sys.mui 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\de-DE\NdisImPlatform.sys.mui 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\en-US\ndiscap.sys.mui 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\es-ES\NdisImPlatform.sys.mui 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\es-ES\wfplwfs.sys.mui 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\it-IT\NdisImPlatform.sys.mui 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe -
Manipulates Digital Signatures 2 IoCs
Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
description ioc Process File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pwrshsip.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\wintrust.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe -
Executes dropped EXE 1 IoCs
pid Process 3304 Process not Found -
Loads dropped DLL 64 IoCs
pid Process 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found 3304 Process not Found -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops Chrome extension 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\manifest.json 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Desktop\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Favorites\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Links\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Pictures\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Public\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Media\Desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Contacts\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Favorites\Links\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Music\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Videos\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Saved Games\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Pictures\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Videos\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Public\AccountPictures\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Downloaded Program Files\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Documents\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Fonts\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\OneDrive\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Searches\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Downloads\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Music\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\$Recycle.Bin\S-1-5-21-779059454-4269757009-3780780039-1000\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Documents\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Libraries\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Offline Web Pages\desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\scesrv.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\en-US\NETAX88179_178a.inf_loc 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\IasMigPlugin.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\d3d9.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\wbem\fr-FR\netttcim.dll.mui 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Media-Foundation-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.22000.1.cat 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-NetFx-Shared-Package~31bf3856ad364e35~amd64~de-DE~10.0.22000.1.cat 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\wbem\WMICOOKR.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\Boot\ja-JP\winload.exe.mui 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Feature-Containers-Package~31bf3856ad364e35~amd64~ja-JP~10.0.22000.1.cat 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Hyper-V-Offline-Core-Group-Package~31bf3856ad364e35~amd64~ja-JP~10.0.22000.1.cat 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~ja-JP~10.0.22000.1.cat 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\ja-JP\ts_wpdmtp.inf_loc 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\KBDINBE1.DLL 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\KBDUK.DLL 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\it-IT\spp.dll.mui 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\rdvvmtransport.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CXHProvisioningServer.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-LegacyChipset-Package~31bf3856ad364e35~amd64~~10.0.22000.348.cat 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Vpci-VSP-merged-Package~31bf3856ad364e35~amd64~fr-FR~10.0.22000.1.cat 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\es-ES\c_fsencryption.inf_loc 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSScheduledJob\PSScheduledJob.psd1 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\FileRepository\uicciso.inf_amd64_15e93601cb9cde54\uicciso.inf 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\it-IT\virtdisk.inf_loc 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\fr-FR\netshell.dll.mui 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Hyper-V-ClientEdition-WOW64-Package~31bf3856ad364e35~amd64~it-IT~10.0.22000.1.cat 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\de-DE\hidserv.inf_loc 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Feature-ApplicationGuard-Package~31bf3856ad364e35~amd64~en-US~10.0.22000.37.cat 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\Com\ja-JP\comrepl.exe.mui 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\FileRepository\netathr10x.inf_amd64_2691c4f95b80eb3b\Data9377_2_0.msc 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\FileRepository\wudfrd.inf_amd64_7e92bb4a6d306eb1\wudfrd.inf 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\fr-FR\vstxraid.inf_loc 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\es-ES\msacm32.drv.mui 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-Common-Package~31bf3856ad364e35~amd64~en-US~10.0.22000.1.cat 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-DirectPlay-OC-Opt-Package~31bf3856ad364e35~amd64~en-US~10.0.22000.1.cat 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Multimedia-MFCore-WCOSHeadless-WOW64-Package~31bf3856ad364e35~amd64~de-DE~10.0.22000.1.cat 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\FXSEXT32.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\wininet.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\C_20005.NLS 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms001.inf_amd64_202973c89a035606\MXDW.gpd 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-SD-Package~31bf3856ad364e35~amd64~~10.0.22000.258.cat 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_585900615f764770\usbohci.sys 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\AssignedAccessRuntime.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\F12\uk-UA\F12Platform2.dll.mui 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Embedded-EmbeddedLogon-Package~31bf3856ad364e35~amd64~uk-UA~10.0.22000.1.cat 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\FileRepository\qcwlan64.inf_amd64_71c84e1405061462\bdwlan_qca6390_2p0_NFA524_DE_1902.elf 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\KBDYAK.DLL 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\KBDNTL.DLL 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\PresentationHostProxy.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\wwancfg.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Holographic-Desktop-Analog-Package~31bf3856ad364e35~amd64~de-DE~10.0.22000.1.cat 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\KBDHAU.DLL 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\en-US\miguiresource.dll.mui 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-Graphics-IndirectDisplays-Package~31bf3856ad364e35~amd64~~10.0.22000.1.cat 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-LanguageFeatures-Basic-en-us-Package-Wrapper~31bf3856ad364e35~amd64~~10.0.22000.348.cat 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Multimedia-MF-WOW64-Package~31bf3856ad364e35~amd64~es-ES~10.0.22000.1.cat 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\fr-FR\61883.inf_loc 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Hyper-V-Online-Services-merged-Package~31bf3856ad364e35~amd64~~10.0.22000.1.cat 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\fr-FR\iaLPSS2i_I2C_BXT_P.inf_loc 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\Boot\fr-FR\winresume.efi.mui 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CscMig.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\es-ES\authfwgp.dll.mui 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\wbem\wsp_health.mof 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Compute-System-VmDirect-merged-Package~31bf3856ad364e35~amd64~de-DE~10.0.22000.1.cat 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-48_altform-unplated_contrast-black.png 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailBadge.scale-400.png 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\TextConversionModule.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_12008.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreWideTile.scale-200.png 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-16_altform-lightunplated_contrast-white.png 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-amd\keyboard.js 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\Tentative.scale-100_contrast-black.png 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\nl-nl\ui-strings.js 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_elf.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\WeatherMedTile.scale-200_contrast-white.png 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarSmallTile.scale-125.png 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Advanced-Dark.scale-125.png 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.WebSockets.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\PresentationFramework.resources.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\base_uris.js 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\MEIPreload\manifest.json 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\eventlog_provider.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_filter\librecord_plugin.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libinvert_plugin.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_12008.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.scale-200.png 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-60_altform-unplated.png 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\AppList.scale-400.png 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\lib\types\Theme.js 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Xaml.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SnipSketchAppList.targetsize-256_altform-unplated.png 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sv-se\ui-strings.js 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\tt.pak 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\7-Zip\Lang\th.txt 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-80.png 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_12104.1001.1.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\LibrarySquare71x71Logo.scale-125.png 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_12104.1001.1.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\StoreLargeTile.scale-125_altform-colorful_theme-light.png 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\components\Breadcrumb\Breadcrumb.js 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\Microsoft.Build.Engine.resources.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\Locales\he.pak 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\bg_get.svg 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\Exist.Tests.ps1 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processenvironment-l1-1-0.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-24.png 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-amd\ComboBox.js 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Web.Entity.Resources.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngcc.md 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ul-phn.xrm-ms 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-pl.xrm-ms 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-ppd.xrm-ms 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\SnipSketchSmallTile.scale-100.png 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\contrast-white\LargeTile.scale-200_contrast-white.png 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-64_contrast-white.png 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\en-gb\locimages\offsymt.ttf 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_1.0.38.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\VoiceRecorderMedTile.scale-125_contrast-black.png 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WideTile.scale-200_contrast-white.png 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-20.png 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\coreclr.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\nb-no\ui-strings.js 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\icudtl.dat 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Net.Resources.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-80_contrast-white.png 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\core_icons.png 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\7-Zip\Lang\sr-spc.txt 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\rsod\wordmui.msi.16.en-us.tree.dat 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\TextIntelligence.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Windows Media Player\uk-UA\wmpnscfg.exe.mui 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\CP1253.TXT 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ja\aspnet_regbrowsers.resources.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\App_LocalResources\home0.aspx.ja.resx 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Drawing.tlb 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data.resources\v4.0_10.0.0.0_es_b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.resources.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.AddIn.resources\v4.0_4.0.0.0_es_b77a5c561934e089\System.AddIn.resources.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\de-DE\WindowsFileProtection.adml 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ImmersiveControlPanel\pris\resources.uk-UA.pri 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\wizardPermission.ascx.es.resx 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Roles\App_LocalResources\manageAllRoles.aspx.resx 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IO.Compression.ZipFile.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\en-US\CipherSuiteOrder.adml 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\fr-FR\NetworkProvider.adml 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\it-IT\SoundRec.adml 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\iaLPSS2i_I2C_SKL.inf 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ES\System.Design.Resources.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\JA\System.Security.Resources.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Fonts\seguibli.ttf 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\CP1251.TXT 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\SQL\it\SqlPersistenceProviderSchema.sql 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\vbc.rsp 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.IO.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Runtime.Numerics.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\Users\App_LocalResources\editUser.aspx.resx 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\bcmfn2.PNF 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\QRCode.pmp 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File opened for modification C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\FDFFile_8.ico 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\wizardCreateRoles.ascx.fr.resx 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\es\System.xml.Resources.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\es\AddInUtil.resources.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ja\System.Messaging.resources.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Entity.Design.resources\v4.0_4.0.0.0_ja_b77a5c561934e089\System.Data.Entity.Design.resources.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Boot\EFI\sr-Latn-RS\bootmgfw.efi.mui 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\mdmpn1.inf 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\ja-JP\WindowsFileProtection.adml 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ImmersiveControlPanel\images\Apps.png 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.JScript.tlb 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\legacy.web_minimaltrust.config 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Entity.resources\v4.0_4.0.0.0_it_b77a5c561934e089\System.Data.Entity.resources.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Services.Design.resources\v4.0_4.0.0.0_it_b77a5c561934e089\System.Data.Services.Design.resources.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem.resources\v4.0_4.0.0.0_it_b77a5c561934e089\System.IO.Compression.FileSystem.resources.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Entity.Design.resources\v4.0_4.0.0.0_es_b77a5c561934e089\System.Web.Entity.Design.resources.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\PLA\Reports\it-IT\Report.System.Wired.xml 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_LocalResources\WebAdminHelp_Security.aspx.fr.resx 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe.config 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\UIAutomationTypes.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\it\System.Data.Linq.resources.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\SmtpSettings.aspx.de.resx 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\es\System.Activities.Presentation.resources.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\v4.0_1.0.0.0_ja_31bf3856ad364e35\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Diagnostics.Tracing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Diagnostics.Tracing.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\qd3x64.inf 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\IdentityCRL\WLive48x48.png 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\MUI\0410\mscorsecr.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\fr\System.Core.resources.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\it\System.Workflow.Runtime.resources.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\PLA\Reports\en-US\Report.System.NetDiagFramework.xml 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\en-US\NewsAndInterests.adml 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\ja-JP\DmaGuard.adml 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Fonts\constanz.ttf 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\AppSetting.ascx.it.resx 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Policy.1.0.Microsoft.Interop.Security.AzRoles\v4.0_10.0.22000.1__31bf3856ad364e35\Policy.1.0.Microsoft.Interop.Security.AzRoles.dll 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\en-US\Windows.adml 2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2025-05-03_458ac649d306548cb8790ba14c527d45_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe"1⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Drops startup file
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4028
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD51feb0b824d6b1d033c6ae867e27f1ba9
SHA199f1dd68c548506ce651933a33c9537fc5936880
SHA25628755826d3662dc7b9de71c983fec11f10d6e8df31f72b4b8a1f798b5fc62753
SHA51264e3b6a0e998392f257b8c2415da6eab5100b0db068330a07a3ddc195e9f9ad2dfb45b301ee3a139fc8752659d7ea38289bd08486abcfba7719b73a01a799347
-
Filesize
4.4MB
MD584eceae5206a8dd3072b02b1f5fc3e81
SHA1d5fd0b1f9e2f75a380a4ae31163f94a4e1481a43
SHA2561d007ec3b29af77924abd208e25a398af8e43789fa207e10e25fe7800e6e365a
SHA5126d568ba4ad8662b636b4c64419e045e501d99414974dd566aaf21c531c983c55b88b71458504fa6175acc8fa35f728667805c00c76ba7fb621c0989bab261f65
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
Filesize5.8MB
MD5defb9e4fb389cac9440a6562a254f7a8
SHA15220b2e5dd2f9aadb11a2c2231f20f1fcf4db886
SHA256471dbca58b9ae4a4c3961beeeaaf332451f76c9074e78615342c9bdace4f0bee
SHA51203bc901bfde83f8cea36676cb0085f0e5616669bfd2623aa8a29e65e8357f3e783007c52f188646c0980270408a711b4514e42bb6271894ae619c018a4aac4b7