Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20250502-en -
resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system -
submitted
03/05/2025, 16:09
Behavioral task
behavioral1
Sample
2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe
Resource
win10v2004-20250502-en
General
-
Target
2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe
-
Size
5.5MB
-
MD5
69b3b3182dced676212aa210c6d1b788
-
SHA1
cbe2071ac02e133d393ef2e77b83b9f13b92c134
-
SHA256
bf70c00fb12aabed9ff74774348312b5e1a4228bddabf8ecbdefaf6a8ea40638
-
SHA512
fa05236d393a5662e8ba5676e806398d1ab9d08cdb5efb738daa4575a56d29c2deb3c23779e0e4ccc136788e2388791afef9fd419cab237cd543a6844135f4fa
-
SSDEEP
98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/V3BZN8WRYcJin+MW:pWvSDzaxztQVRJRYIHb
Malware Config
Signatures
-
Gofing
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
-
Gofing family
-
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation. 3 IoCs
resource yara_rule behavioral1/files/0x0003000000022a35-4.dat family_gofing behavioral1/files/0x0002000000021801-5419.dat family_gofing behavioral1/files/0x00020000000217fc-5451.dat family_gofing -
Drops file in Drivers directory 22 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\gmreadme.txt 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\ja-JP\NdisImPlatform.sys.mui 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\ja-JP\ndiscap.sys.mui 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\uk-UA\NdisImPlatform.sys.mui 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\de-DE\wfplwfs.sys.mui 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\es-ES\NdisImPlatform.sys.mui 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\fr-FR\NdisImPlatform.sys.mui 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\fr-FR\ndiscap.sys.mui 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\it-IT\wfplwfs.sys.mui 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\de-DE\NdisImPlatform.sys.mui 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\en-US\ndiscap.sys.mui 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\en-US\wfplwfs.sys.mui 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\es-ES\wfplwfs.sys.mui 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\it-IT\ndiscap.sys.mui 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\afunix.sys 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\es-ES\ndiscap.sys.mui 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\fr-FR\wfplwfs.sys.mui 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\gm.dls 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\it-IT\NdisImPlatform.sys.mui 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\ja-JP\wfplwfs.sys.mui 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\de-DE\ndiscap.sys.mui 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\en-US\NdisImPlatform.sys.mui 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe -
Manipulates Digital Signatures 2 IoCs
Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
description ioc Process File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pwrshsip.dll 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\wintrust.dll 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe -
Loads dropped DLL 64 IoCs
pid Process 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found 3472 Process not Found -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops Chrome extension 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\manifest.json 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File created C:\Users\Admin\Downloads\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Pictures\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Media\Desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Desktop\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\OneDrive\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Pictures\Camera Roll\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Saved Games\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Libraries\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Public\AccountPictures\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Desktop\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Downloaded Program Files\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Music\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Fonts\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Links\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Favorites\Links\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Music\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Offline Web Pages\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Videos\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Public\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Networking-merged-Package~31bf3856ad364e35~amd64~de-DE~10.0.19041.1.cat 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\ServiceSet\ServiceSet.Schema.psm1 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\perfmon.exe 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\Configuration\BaseRegistration\it-IT\MSFT_DSCMetaConfiguration.mfl 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\Get-DscConfigurationStatus.cdxml 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\C_28599.NLS 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-PhotoBasic-Feature-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Multimedia-MFCore-WCOSMinusHeadless-Package~31bf3856ad364e35~amd64~uk-UA~10.0.19041.1.cat 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\es-ES\cmbatt.inf_loc 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\eappgnui.dll 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\it-IT\adsnt.dll.mui 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-HvSocket-Package~31bf3856ad364e35~amd64~es-ES~10.0.19041.1.cat 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\ja-JP\lltdio.inf_loc 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WinMetadata\Windows.Devices.winmd 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Wdac\Wdac.format.ps1xml 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\wbem\de-DE\wininit.mfl 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Holographic-Desktop-Analog-Package~31bf3856ad364e35~amd64~~10.0.19041.264.cat 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-RemoteAssistance-Package-Client~31bf3856ad364e35~amd64~uk-UA~10.0.19041.1.cat 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\downlevel\api-ms-win-security-base-l1-1-0.dll 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\wbem\fr-FR\cli.mfl 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\wbem\it-IT\csv.xsl 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\write.exe 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-VID-Package~31bf3856ad364e35~amd64~de-DE~10.0.19041.1.cat 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-VmBus-VirtualDevice-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Multimedia-RestrictedCodecsExt-WCOSMinusHeadless-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\fr-FR\sisraid2.inf_loc 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\BOOTVID.DLL 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Presentation-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\IoTAssignedAccessLockFramework.dll 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\LicenseManagerSvc.dll 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\FileRepository\ialpss2i_i2c_glk.inf_amd64_7b6c08738ca8a856\iaLPSS2i_I2C_GLK.sys 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\ja\Microsoft.Dtc.PowerShell.Resources.dll 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\ja-JP\PlayToStatusProvider.dll.mui 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\ja-JP\els.dll.mui 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\wmidx.dll 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-NetFx4-US-OC-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Notepad-FoD-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-msmq-runtime-Opt-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Media-Streaming-Package~31bf3856ad364e35~amd64~de-DE~10.0.19041.1.cat 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\fr-FR\netrasa.inf_loc 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\fr-FR\netrtl64.inf_loc 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\downlevel\api-ms-win-core-registry-l2-1-0.dll 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\mrt100.dll 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-WordPad-FoD-Package~31bf3856ad364e35~amd64~es-ES~10.0.19041.1.cat 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\it-IT\NdisImPlatform.inf_loc 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\APHostClient.dll 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\de-DE\authfwgp.dll.mui 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DeviceDirectoryClient.dll 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\FileRepository\circlass.inf_amd64_9f3f831d13d3df1f\circlass.inf 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\FileRepository\netathr10x.inf_amd64_2691c4f95b80eb3b\eeprom_qca9377_1p1_NFA425_olpc_A_TP203NA.bin 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\ja-JP\rpcping.exe.mui 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SMB1Deprecation-Group-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\FileRepository\netathr10x.inf_amd64_2691c4f95b80eb3b\eeprom_qca9377_1p1_NFA435_olpc_LE_9.bin 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\en-US\AMDGPIO2.inf_loc 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\it-IT\intelpep.inf_loc 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\it-IT\wvmic_kvpexchange.inf_loc 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\es-ES\mmcshext.dll.mui 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\fr-FR\PeerDistSh.dll.mui 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\taskkill.exe 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\FileRepository\cpu.inf_amd64_0abeab1ee6572232\amdk8.sys 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\ja-JP\netrtwlans.inf_loc 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Schemas\PSMaml\Maml.tbr 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\de-DE\windows.ui.xaml.dll.mui 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\oobe\SetupCleanupTask.dll 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedSplash.scale-100_contrast-white.png 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNotebookSmallTile.scale-100.png 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionGroupSmallTile.scale-150.png 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-64.png 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubWideTile.scale-200_contrast-white.png 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-256_altform-unplated_contrast-black.png 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Tracing.dll 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraSmallTile.contrast-black_scale-125.png 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Primitives.dll 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Threading.Timer.dll 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\WindowsFormsIntegration.resources.dll 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\check.cur 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\Locales\ro.pak 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Locales\hi.pak 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_wer.dll 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ul-oob.xrm-ms 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul.xrm-ms 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\SmallTile.scale-100.png 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\vk_swiftshader.dll 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\rsod\dcfmui.msi.16.en-us.boot.tree.dat 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-black\WideTile.scale-125.png 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_scale-125.png 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Locales\ml.pak 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Extreme Shadow.eftx 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageSmallTile.scale-200_contrast-black.png 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\System.Windows.Forms.Primitives.resources.dll 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Windows Media Player\de-DE\WMPMediaSharing.dll.mui 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\libxml2.md 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\santuario.md 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O17EnterpriseVL_Bypass30-ppd.xrm-ms 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office15\pkeyconfig-office.xrm-ms 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\index.win32.bundle.map 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-72.png 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\es\Microsoft.PackageManagement.MetaProvider.PowerShell.resources.dll 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\PresentationCore.resources.dll 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\Json\EmailAction-AdaptiveCard.json 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-96_contrast-black.png 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-72_altform-fullcolor.png 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\LibrarySquare150x150Logo.scale-200_contrast-black.png 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\FetchingMail-Dark.scale-400.png 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\zh-cn_get.svg 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\css\main.css 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\micaut.dll 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNotePageLargeTile.scale-200.png 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\tifffilt.dll 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Locales\kn.pak 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\kok.pak 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomTracing_06.jpg 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-48_altform-unplated.png 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-125_contrast-black.png 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStoreTasksWrapper.dll 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Generic-Light.scale-100.png 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-32_altform-lightunplated.png 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\uk-ua\ui-strings.js 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\text_2x.png 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\LTSHYPH_EN.LEX 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\lua\http\custom.lua 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libau_plugin.dll 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-64_altform-unplated.png 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Common Files\System\msadc\adcjavas.inc 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\prefs_enclave_x64.dll 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.ConnectionUI.Dialog.dll 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-140.png 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.IO.UnmanagedMemoryStream.dll 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\fr\aspnetmmcext.resources.dll 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\DebugAndTrace.aspx.es.resx 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ScheduledJob.Resources\v4.0_3.0.0.0_en_31bf3856ad364e35\Microsoft.PowerShell.ScheduledJob.Resources.dll 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Workflow.Runtime.resources\v4.0_4.0.0.0_it_31bf3856ad364e35\System.Workflow.Runtime.resources.dll 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Cursors\arrow.svg 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Fonts\vga861.fon 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\acpi.inf 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\pci.inf 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\L2Schemas\WLAN_profile_v1.xsd 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\DE\ShFusRes.dll 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallPersistSqlState.sql 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\fr\System.Workflow.ComponentModel.resources.dll 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reflow.api_NON_OPT 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Media\Windows Shutdown.wav 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Users\App_LocalResources\manageUsers.aspx.it.resx 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ja\System.Device.resources.dll 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\webengine4.dll 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\v4.0_3.0.0.0_es_31bf3856ad364e35\Microsoft.WSMan.Management.resources.dll 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\en-US\EncryptFilesonMove.adml 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Speech_OneCore\Engines\TTS\fr-FR\NUSData\M1036Nathalie.tbtdirection.wve 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\es\System.Web.Extensions.resources.dll 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\de\UIAutomationTypes.resources.dll 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\es\System.ServiceModel.Routing.resources.dll 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\de-DE\ActiveXInstallService.adml 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\es-ES\FileServerVSSProvider.adml 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\es-ES\PreviousVersions.adml 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\it-IT\srm-fci.adml 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Media\MovePrevious_48000Hz.raw 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_1x1.gif 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\fr\System.IO.Log.resources.dll 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\es\SMDiagnostics.resources.dll 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.ApplicationServices.resources\v4.0_4.0.0.0_es_31bf3856ad364e35\System.Web.ApplicationServices.resources.dll 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\PLA\Reports\en-US\Report.System.Memory.xml 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\en-US\EdgeUI.adml 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Speech_OneCore\Engines\TTS\it-IT\NUSData\M1040Cosimo.keyboard.RAD 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Cursors\size4_l.cur 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\L2Schemas\WFD_LEGACY_profile_v1.xsd 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\unSelectedTab_leftCorner.gif 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallRoles.sql 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.tlb 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ja\System.IO.Log.resources.dll 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms.DataVisualization\v4.0_4.0.0.0__31bf3856ad364e35\System.Windows.Forms.DataVisualization.dll 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\SMSvcHost 4.0.0.0\0410\_SMSvcHostPerfCounters_d.ini 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\mdmzoom.inf 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Installer\cbde.msi 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\App_LocalResources\security.aspx.ja.resx 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\DefineErrorPage.aspx.es.resx 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\SQL\fr\SqlWorkflowInstanceStoreSchema.sql 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Activities.Presentation.dll 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\DE\System.EnterpriseServices.Resources.dll 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\wsearchidxpi\idxcntrs.h 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\web.config.default 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\CreateAppSetting.aspx 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\DefineErrorPage.aspx 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\XsdBuildTask.dll 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\it\aspnet.mfl 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.Dtc.dll 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp.resources\v4.0_4.0.0.0_de_b03f5f7f11d50a3a\Microsoft.CSharp.resources.dll 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Help\mui\0410\cliconf.chm 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\CreateAppSetting.aspx.it.resx 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Activities.Resources\v4.0_3.0.0.0_ja_31bf3856ad364e35\Microsoft.PowerShell.Activities.Resources.dll 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationUI.resources\v4.0_4.0.0.0_de_31bf3856ad364e35\PresentationUI.resources.dll 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem.resources\v4.0_4.0.0.0_fr_b77a5c561934e089\System.IO.Compression.FileSystem.resources.dll 2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2025-05-03_69b3b3182dced676212aa210c6d1b788_cobalt-strike_frostygoop_ghostlocker_luca-stealer_sliver_snatch.exe"1⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Drops startup file
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:2680
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD546a54192443cf738ec82bb1423d6e201
SHA1dd427ac5aa578c7e0fd4acba2f65655bcd0a39d3
SHA256845be97b3e4200b4124b92d7cbef87f2237fdfde2a48800578ccacfc7bed460f
SHA51289756bee440d0e35bfcc111c43402f9cd55560dc27237637db88adb8998aec5726399c6049cf4934c705d228018e16e62ea5206d22c32379392439947f7273e2
-
Filesize
4.4MB
MD5cc4f23eaa2c26e8bf39ac1193436ddd4
SHA1ce18e5bcc7ee0cf0c998aaeb8e78c9f5b55bb049
SHA2563806ff20a8bac74962437a0815a6a38168ebd68fcbca34505f2da1485b54c4af
SHA512eea6612ca057220261f7c44fa9701c3a0065a97d5d9b4a22e3031a6b96a223aa27619c918a4bbc588a963fcee8d53e3791d8be50e083fda5a51815fda88b1dd6
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
Filesize5.8MB
MD5d02e29ef8284ae54eef790922bb09619
SHA1e9179a49fc23b8b0eae2f12d48f9b61d62ae87b7
SHA256d54c8330a013d3b8cad6008c8b646b6e9edf10b62e42ffc5eaf474c9629c2f9e
SHA512bb293855e6b1f8b945475fee955e8dddeaa869ec6e426917f31efedb96f7a0138e45c3702edd3a7bd5c987a32fb52cba3e9779e37921db2c8ec709d4e6000674