Analysis
-
max time kernel
150s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20250502-en -
resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system -
submitted
03/05/2025, 15:00
Behavioral task
behavioral1
Sample
2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe
Resource
win11-20250502-en
General
-
Target
2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe
-
Size
4.2MB
-
MD5
a3174b9e874a11e88e83ce11fdd021ce
-
SHA1
8366234ff15297dd02de48882f308faa4848f447
-
SHA256
e1d022ad5eb0ecee17695399bef467cd4727c35fb8a814d38414b7ec1a5b9038
-
SHA512
a13429d6261d8e32e29479e6a6b871c27440f56e5d1b36b7c5c756ed2e8b6dfe81f840d18b7a946fcb387c0afcf9dfc41173a15e5c49a80f2971342b0dafd0b7
-
SSDEEP
49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q4q:ieF+iIAEl1JPz212IhzL+Bzz3dw/Vg
Malware Config
Signatures
-
Gofing
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
-
Gofing family
-
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation. 3 IoCs
resource yara_rule behavioral1/files/0x0003000000022a64-4.dat family_gofing behavioral1/files/0x0002000000021e18-5469.dat family_gofing behavioral1/files/0x000200000002192a-5477.dat family_gofing -
Renames multiple (51) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe -
Loads dropped DLL 60 IoCs
pid Process 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found 3476 Process not Found -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops Chrome extension 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\manifest.json 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\3D Objects\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Music\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Fonts\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Videos\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Downloaded Program Files\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Downloads\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\$Recycle.Bin\S-1-5-21-3299287909-2279959458-198972791-1000\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Music\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Videos\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Public\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Media\Desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Documents\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Downloads\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Favorites\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Pictures\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Documents\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Searches\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Desktop\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\@AppHelpToast.png 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\@AudioToastIcon.png 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\AUDIOKSE.dll 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\AboveLockAppHost.dll 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\@EnrollmentToastIcon.png 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\@VpnToastIcon.png 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\@WirelessDisplayToast.png 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\APHostClient.dll 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\ARP.EXE 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\AarSvc.dll 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\12520437.cpx 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\12520850.cpx 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-48_contrast-white.png 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\GamesXboxHubLargeTile.scale-100.png 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-140.png 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailSmallTile.scale-100.png 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense_eula.txt 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libremap_plugin.dll 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libgradient_plugin.dll 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-24_altform-fullcolor.png 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-32.png 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Numerics.Vectors.dll 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\compare.png 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightDemiBold.ttf 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.TLB 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\de-DE\View3d\3DViewerProductDescription-universal.xml 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-96_altform-colorize.png 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\iacom2im.dll 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\smsconnect\torch1x.png 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.config 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\vccorlib140.dll 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-32_altform-unplated_contrast-black.png 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\HelpAndFeedback\HelpThumbnail.png 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteAppList.targetsize-256_altform-unplated.png 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_ellipses.svg 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Windows Portable Devices\sqmapi.dll 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\AppPackageLargeTile.scale-125_contrast-white.png 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Diagnostics.PerformanceCounter.dll 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\zh-tw\ui-strings.js 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Windows.Presentation.resources.dll 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Windows Photo Viewer\fr-FR\ImagingDevices.exe.mui 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\Weather_TileWide.scale-200.png 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailSplashLogo.scale-150.png 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Generic-Dark.scale-400.png 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\da-dk\ui-strings.js 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\MicrosoftAccount.scale-140.png 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Globalization.Extensions.dll 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\en-us\oregres.dll.mui 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\new_icons.png 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ExcelNaiveBayesCommandRanker.txt 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MedTile.scale-125_contrast-white.png 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\StopwatchLargeTile.contrast-white_scale-200.png 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-pl.xrm-ms 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\rsod\proof.es-es.msi.16.es-es.boot.tree.dat 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\LEELAWDB.TTF 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\AppPackageSplashScreen.scale-100_contrast-black.png 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalMedTile.scale-125_contrast-white.png 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionMedTile.scale-150.png 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-24_altform-unplated.png 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Overlapped.dll 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Java\jre-1.8\bin\ucrtbase.dll 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.VisualBasic.Targets 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\AdHocReportingExcelClient.dll 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\ThankYou\GenericEnglish-3.jpg 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-white\LargeTile.scale-200_contrast-white.png 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-libraryloader-l1-1-0.dll 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-80.png 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\control\libwin_hotkeys_plugin.dll 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\People.BackgroundTasks.dll 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\onboarding\landing_page_whats_new_v1.png 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-48.png 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\App_LocalResources\home2.aspx.de.resx 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.Resources\v4.0_10.0.0.0_en_31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.Resources.dll 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\de-DE\Explorer.adml 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\en-US\OOBE.adml 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Speech\Engines\SR\de-DE\l1031.mllr 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Prefetch\RUNDLL32.EXE-E66A223C.pf 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Speech_OneCore\Engines\TTS\it-IT\M1040ElsaV2.TON 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\.NET Data Provider for Oracle\0411\_DataOracleClientPerfCounters_shared12_neutral_d.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ImmersiveControlPanel\images\splashscreen.contrast-black_scale-400.png 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\fr\Tracking_Schema.sql 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\it\DropSqlPersistenceProviderSchema.sql 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Configuration.Install.dll 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SKB\LanguageModels\lm.en-GB.dat 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Globalization\ELS\SpellDictionaries\Fluency\uk-UA\punctuation.json 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\apps.inf 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\EdmGen.exe 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Boot\PCAT\pt-PT\bootmgr.exe.mui 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\IME\IMETC\HELP\IMTCEN14.CHM 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\b57nd60a.inf 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\caspol.exe.config 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\ja-JP\AVSValidationGP.adml 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\WPF\ja\PresentationUI.resources.dll 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Users\App_LocalResources\manageUsers.aspx.ja.resx 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Boot\EFI\pt-PT\bootmgfw.efi.mui 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.ServiceModel.Channels.dll 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\JA\Microsoft.Build.Tasks.resources.dll 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.Serialization.Json.dll 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Setup\State\State.ini 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\c_tapedrive.inf 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\mdmke.inf 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\3082\cscompui.dll 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Speech_OneCore\Engines\TTS\it-IT\NUSData\M1040ElsaV2.tbtdirection.wve 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Deployment.dll 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\App_LocalResources\security.aspx.fr.resx 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\it\System.Management.resources.dll 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation.Resources\v4.0_3.0.0.0_ja_31bf3856ad364e35\System.Management.Automation.Resources.dll 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SoftwareDistribution\DataStore\Logs\edbtmp.log 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Logs\MoSetup\UpdateAgent.log 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\PLA\Rules\de-DE\Rules.System.Wireless.xml 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\en-US\SettingSync.adml 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\it-IT\ExploitGuard.adml 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Cursors\size3_rl.cur 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\App_LocalResources\setUpAuthentication.aspx.ja.resx 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Users\App_LocalResources\editUser.aspx.es.resx 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\de\DropSqlPersistenceProviderSchema.sql 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\it\SqlPersistenceProviderLogic.sql 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\de\System.IO.Log.resources.dll 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\fr-FR\WindowsDefenderSecurityCenter.adml 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\IA32.api 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ISymWrapper.dll 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\fr\System.Net.Http.WebRequest.resources.dll 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\fr\aspnet.mfl.uninstall 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\it\Microsoft.Transactions.Bridge.Resources.dll 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fr\System.Activities.Core.Presentation.resources.dll 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Fonts\WINGDNG3.TTF 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\wstorflt.PNF 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\SQL\it\Tracking_Logic.sql 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\es\System.Net.Http.WebRequest.resources.dll 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\ManageAppSettings.aspx.fr.resx 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\App_LocalResources\error.aspx.de.resx 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xaml.resources\v4.0_4.0.0.0_fr_b77a5c561934e089\System.Xaml.resources.dll 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\fr-FR\IIS.adml 2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2025-05-03_a3174b9e874a11e88e83ce11fdd021ce_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe"1⤵
- Drops startup file
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:5768
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.2MB
MD5cf572bb5af34b939e7440cb68a941119
SHA15ca066f83c7d98600dbb44a5125e9ee4776384c9
SHA25633964e5cd1852d88ccc901cbd6d8f3453fe3dccf9c47707deaafb58c34922736
SHA512f95cf9f84121ed424125d973c24c1eae8ba28eda75a7b9c9c3b5e0fa68bf159264f5d5e4c5b389d6e97abce8a86995fbca1e8069cecbf0b28025383e6ac64d46
-
Filesize
4.4MB
MD52a234dc538768d1cae0d2a887aaeebed
SHA1cf7feb85c8d2d2af8af348dcae9d3080d1703d26
SHA256d322a952963e66dce7680c7bb750f9527eecb2d6da5febb89961556589615ac5
SHA5120b322f994a8cd1839d50b22dfe4bc9be1051442b53525f545cf94c031180573809aa1c0b2d41562ceb12f4b96443e0a43d2a3550c7a558e3376081805a7b2616
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
Filesize5.8MB
MD59ad94b851d37a7a98eb0189b0ffdf8c1
SHA184bb18a4d9437ec9ccdd4dc26da85c22a0b5e66c
SHA25614f282c4b83552acea817dc39ff24c5d32e69d50ee56c8bd11be77094200fcd3
SHA512e1c37611944d0fe82b5a24bc703c09b62d24dbbb7d6bc4e006512b9baa6a137dc81addf5b1629ac354cbd220262a3adb620a7e7b34024453f65e006582c9f33f