Analysis
-
max time kernel
150s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20250502-en -
resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system -
submitted
03/05/2025, 15:09
Behavioral task
behavioral1
Sample
2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe
Resource
win10v2004-20250502-en
General
-
Target
2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe
-
Size
4.2MB
-
MD5
c9de499faafeb8822a7b4e8a8f8b4db5
-
SHA1
95b3ecca714389bd6661c4ee0a7941ea7b3b0608
-
SHA256
d1ef69bbe35986e172c559cd4b69332ec2f8e195a287838b9c998fc773669ce7
-
SHA512
76459fbf3d9d61ed83ea121b227eece8ce3fde2aea124d009e8753bc81c9b6778dfbfcea7dd87a7694dc7820d777f59ca64575cdff72853490bb029061b5068a
-
SSDEEP
49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q4T:ieF+iIAEl1JPz212IhzL+Bzz3dw/VN
Malware Config
Signatures
-
Gofing
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
-
Gofing family
-
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation. 3 IoCs
resource yara_rule behavioral1/files/0x0004000000021822-4.dat family_gofing behavioral1/files/0x0002000000021d6b-5474.dat family_gofing behavioral1/files/0x0002000000021d8e-5486.dat family_gofing -
Drops file in Drivers directory 22 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\de-DE\wfplwfs.sys.mui 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\en-US\NdisImPlatform.sys.mui 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\en-US\wfplwfs.sys.mui 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\fr-FR\wfplwfs.sys.mui 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\gmreadme.txt 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\uk-UA\NdisImPlatform.sys.mui 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\gm.dls 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\it-IT\ndiscap.sys.mui 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\ja-JP\NdisImPlatform.sys.mui 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\ja-JP\wfplwfs.sys.mui 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\es-ES\NdisImPlatform.sys.mui 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\es-ES\ndiscap.sys.mui 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\fr-FR\NdisImPlatform.sys.mui 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\ja-JP\ndiscap.sys.mui 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\afunix.sys 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\de-DE\NdisImPlatform.sys.mui 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\de-DE\ndiscap.sys.mui 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\en-US\ndiscap.sys.mui 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\es-ES\wfplwfs.sys.mui 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\fr-FR\ndiscap.sys.mui 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\it-IT\NdisImPlatform.sys.mui 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\it-IT\wfplwfs.sys.mui 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe -
Manipulates Digital Signatures 2 IoCs
Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
description ioc Process File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pwrshsip.dll 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\wintrust.dll 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe -
Loads dropped DLL 60 IoCs
pid Process 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found 3292 Process not Found -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops Chrome extension 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\manifest.json 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File created C:\Users\Admin\Pictures\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Desktop\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Videos\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Pictures\Camera Roll\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Libraries\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Links\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Videos\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\$Recycle.Bin\S-1-5-21-3920234085-916416549-2700794571-1000\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Documents\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Documents\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Music\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Saved Games\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Searches\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\3D Objects\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Contacts\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Desktop\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Fonts\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Media\Desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Public\AccountPictures\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Downloads\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Public\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\iasdatastore.dll 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\nshipsec.dll 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\wbem\ja-JP\mispace.mfl 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\wbem\l2gpstore.mof 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\wbem\uk-UA\wscenter.mfl 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-OpenSSH-Common-Package~31bf3856ad364e35~amd64~~10.0.19041.964.cat 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\de-DE\Licenses\Volume\Professional\license.rtf 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\fr-FR\InstallService.dll.mui 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\fr-FR\dot3msm.dll.mui 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\it-IT\netcenter.dll.mui 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\migration\WSearchMigPlugin.dll 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-UX-PowerShell-Module-HyperV-merged-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\F12\es-ES\F12Platform2.dll.mui 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\wbem\ja-JP\npivwmi.mfl 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForSome\fr-FR\MSFT_WaitForSome.schema.mfl 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\it-IT\tapi3.dll.mui 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\uk-UA\qdvd.dll.mui 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\wbem\it-IT\netdacim.dll.mui 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\wbem\it-IT\wsp_sr_uninstall.mfl 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Composable-PlatformExtension-DragDropCommon-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Chakradiag.dll 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WSHTCPIP.DLL 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\ConfigCI\ConfigCI.psd1 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\de-DE\user32.dll.mui 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\fr-FR\dsregtask.dll.mui 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\iemigplugin.dll 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Containers-DisposableClientVM-merged-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Host-Compute-PowerShell-Module-Package~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.cat 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\de-DE\SyncRes.dll.mui 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\uk-UA\msfeedsbs.dll.mui 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\wbem\fr-FR\netdacim.dll.mui 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\wship6.dll 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Help-ClientUA-Client-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\es-ES\Windows.Internal.SecurityMitigationsBroker.dll.mui 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\KBDLT1.DLL 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Schemas\PSMaml\glossary.xsd 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\dbnmpntw.dll 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\en-US\adsnt.dll.mui 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\mfc100fra.dll 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\wbem\de-DE\wsp_sr.mfl 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\winrssrv.dll 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\F12\F12AppFrame2.dll 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\es-ES\localsec.dll.mui 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\opencl.dll 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CameraCaptureUI.dll 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Storage-VirtualDevice-SCSI-merged-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Windows.Media.Streaming.dll 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\de-DE\rpcnsh.dll.mui 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\ja-JP\wlanutil.dll.mui 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Embedded-KeyboardFilter-WOW64-Package~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.cat 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetSecurity\NetSecurity.types.ps1xml 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\uk-UA\UIRibbon.dll.mui 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\wbem\en-US\ServDeps.dll.mui 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\AppVPublishing.dll 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ScriptResource\uk-UA\MSFT_ScriptResource.schema.mfl 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\mscpxl32.dLL 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\wbem\en-US\PrintManagementProvider.mfl 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\AuthHost.exe 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-UX-PowerShell-Module-HyperV-merged-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Common-RegulatedPackages-Package~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.cat 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Windows.Security.Authentication.OnlineId.dll 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ArchiveResource\fr-FR\ArchiveProvider.psd1 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSplashLogo.scale-150.png 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-60_altform-unplated.png 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\de-DE\PackageManagementDscUtilities.strings.psd1 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-ae\ui-strings.js 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\CalculatorLargeTile.contrast-black_scale-125.png 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-64_contrast-black.png 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\models\en-GB.PhoneNumber.ot 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeTile.scale-125.png 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-white\WideTile.scale-125.png 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteAppList.targetsize-96_altform-unplated.png 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionLargeTile.scale-100.png 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\en-ae\ui-strings.js 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-256.png 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_proxy\win10\identity_helper.Sparse.Dev.msix 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Java\jre-1.8\bin\plugin2\vcruntime140_1.dll 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-96_altform-unplated.png 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeMediumTile.scale-100.png 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Net.WebHeaderCollection.dll 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\DemoModeInk.dat 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-60_altform-unplated_contrast-white.png 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-30.png 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Yahoo-Dark.scale-200.png 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\models\fr-FR.mail.config 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\PresentationUI.resources.dll 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\FREN\MSB1FREN.ITS 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\resources\strings\LocalizedStrings_en-GB.json 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\clrcompression.dll 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\UIAutomationTypes.resources.dll 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Common Files\System\msadc\msdaremr.dll 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\Content.xml 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-pl.xrm-ms 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\stickers\word_art\sticker31.png 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xe7d9.png 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationCore.resources.dll 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote.gpd 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\lua\http\requests\status.json 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\StopwatchMedTile.contrast-black_scale-125.png 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jsoundds.dll 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-40.png 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Common Files\System\ado\msadrh15.dll 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Windows Photo Viewer\it-IT\ImagingDevices.exe.mui 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\vpaid.js 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\sr-Latn-RS\View3d\3DViewerProductDescription-universal.xml 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\Office.UI.Xaml.Core.dll 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-200_contrast-black.png 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.scale-200.png 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\2d.x3d 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-handle-l1-1-0.dll 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\lib\ant-javafx.jar 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RICEPAPR\PREVIEW.GIF 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Square44x44Logo.scale-100.png 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-80_altform-unplated.png 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-16_contrast-white.png 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.AppContext.dll 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QRYINT32.DLL 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\keystore\libfile_keystore_plugin.dll 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Windows Defender\ja-JP\ProtectionManagement_Uninstall.mfl 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\files_icons2x.png 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Security.Cryptography.Encoding.dll 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.ApplicationId.Framework.dll 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Provisioning\Packages\Power.EnergyEstimationEngine.StandbyActivation.ppkg 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Boot\PCAT\tr-TR\bootmgr.exe.mui 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\iaLPSS2i_I2C_CNL.inf 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\iaLPSS2i_I2C_SKL.inf 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\App_Code\SecurityPage.cs 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ja\JSC.resources.dll 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\de-DE\Sensors.adml 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Speech\Engines\SR\es-ES\wp3082.bin 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\SQL\en\Tracking_Schema.sql 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\de\System.Web.Mobile.resources.dll 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\es\Microsoft.Build.Tasks.v3.5.resources.dll 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\App_LocalResources\security0.aspx.es.resx 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\XsdBuildTask.resources\v4.0_4.0.0.0_es_31bf3856ad364e35\XsdBuildTask.resources.dll 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\PLA\Rules\it-IT\Rules.System.Network.xml 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\es-ES\WindowsFileProtection.adml 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Cursors\move_im.cur 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\DefaultWsdlHelpGenerator.aspx 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Globalization\ELS\SpellDictionaries\Fluency\fr-FR\charactermap.json 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\web_mediumtrust.config.default 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ja\System.Runtime.WindowsRuntime.UI.Xaml.resources.dll 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\App_LocalResources\security.aspx.fr.resx 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Services.resources\v4.0_4.0.0.0_it_b03f5f7f11d50a3a\System.Web.Services.resources.dll 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\en-US\Desktop.adml 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\es-ES\DCOM.adml 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\it-IT\CloudContent.adml 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Diagnostics.StackTrace.dll 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\de\WsatConfig.resources.dll 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Conversion.v4.0.resources\v4.0_4.0.0.0_it_b03f5f7f11d50a3a\Microsoft.Build.Conversion.v4.0.resources.dll 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\fr\aspnet_regbrowsers.resources.dll 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\SQL\fr\SqlPersistenceService_Schema.sql 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\SQL\de\DropSqlPersistenceProviderLogic.sql 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\fr\System.Xml.Linq.resources.dll 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Build.dll 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\NlsData0009.dll 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\Sharing.admx 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\SmartScreen.admx 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\netvwififlt.inf 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ImmersiveControlPanel\appxsignature.p7x 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\it\Microsoft.VisualBasic.Compatibility.resources.dll 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\it-IT\ServiceModelPerformanceCounters.dll.mui 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.AddIn.resources\v4.0_4.0.0.0_es_b77a5c561934e089\System.AddIn.resources.dll 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\PLA\Rules\de-DE\Rules.System.Common.xml 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\de-DE\ServerManager.adml 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\en-US\UserProfiles.adml 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\SQL\es\SqlPersistenceService_Logic.sql 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\it\System.Web.Services.resources.dll 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\App_LocalResources\default.aspx.it.resx 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\it\System.Deployment.resources.dll 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\netmyk64.inf 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\setUpAuthentication.aspx 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\fr-FR\PresentationHost_v0400.dll.mui 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\fr\System.Web.DynamicData.resources.dll 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\PeerToPeerCaching.admx 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Cursors\aero_pin.cur 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Fonts\courbd.ttf 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\SQL\ja\SqlPersistenceProviderSchema.sql 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\es\System.Web.Entity.Design.resources.dll 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WMINet_Utils.dll 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\TaskScheduler.Resources\v4.0_10.0.0.0_it_31bf3856ad364e35\TaskScheduler.resources.dll 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\es-ES\PerformancePerftrack.adml 2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2025-05-03_c9de499faafeb8822a7b4e8a8f8b4db5_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe"1⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Drops startup file
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:2144
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.2MB
MD57c4a1c3394b621ce9a6ad29bfb99e922
SHA1ea5399c799338fc325ca4082cbd2a7ce4d15c50a
SHA256a350b1555b0a6cdba7ee3a55c05bc1e95208a5126ef6f497137a3997ad169212
SHA51247a6d13ab8eaa3c6a758c159866e1940c83275380d3108aef1a4efcd974f63b94f0a4193a6839c744a49ad59f652243ed5eb968e63dbb8c393601e0a8d5dd021
-
Filesize
4.4MB
MD56493102987f2f9a7aa86f8d25f99f8df
SHA16648478d1aa8e29b6eb41e631a1acd45061f1602
SHA256fc764a54c73764638a5c6b67f06bdeed359e17672ba2e711aab7d70718ce7e3d
SHA5120eec7b49e01f35656d306e7319cf345a8c2662a22a0ea9b0282dc12f81f56af468d9d32c30ab87144eed73177d0f0cb8c218d042c010e57a5ab8ce70090c9e77
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
Filesize5.8MB
MD50f24c0d788900c8a3d784b5fee6dd228
SHA17d37e938b7a79d28b0158f7c0376891b065c57b6
SHA256c16664a5b9d9f7c2e891a7b318ddb7e7f3817be96b0a8bbc0ac95fff6ef4a830
SHA512a60711dea5087d64671b95b0a6b96e8b810d25f48baa4ceff47e849d2c742b756704a3d463ace7b8af06ff3d4af717d93969087d332781f28af31270fd0c2b11