Analysis
-
max time kernel
150s -
max time network
102s -
platform
windows11-21h2_x64 -
resource
win11-20250502-en -
resource tags
arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system -
submitted
15/05/2025, 07:44
Behavioral task
behavioral1
Sample
2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe
Resource
win11-20250502-en
General
-
Target
2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe
-
Size
4.1MB
-
MD5
f3ed9cd9921dfa3797fdd934bd8ac588
-
SHA1
0fa86de71b5db72945d23335ac0f2d0ed93c49dd
-
SHA256
b483a3149d98dc85a6bb102b1b7d77531a256cc92b811e8ee7aca50c99fe3d09
-
SHA512
cd7b1d6246bdaeb662400fc9bbb8563b21ce7c063f188ebb9c20c1d87baad4fc09fad3821f0246100b517909a6a41ad63e506cce355845059ae61870d7adb701
-
SSDEEP
49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q4+:ieF+iIAEl1JPz212IhzL+Bzz3dw/Vc
Malware Config
Signatures
-
Gofing
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
-
Gofing family
-
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation. 3 IoCs
resource yara_rule behavioral2/files/0x000300000002a244-4.dat family_gofing behavioral2/files/0x00020000000297c9-5477.dat family_gofing behavioral2/files/0x0002000000029343-5496.dat family_gofing -
Renames multiple (51) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Drivers directory 22 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\de-DE\ndiscap.sys.mui 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\de-DE\wfplwfs.sys.mui 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\en-US\NdisImPlatform.sys.mui 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\gm.dls 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\gmreadme.txt 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\ja-JP\NdisImPlatform.sys.mui 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\afunix.sys 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\en-US\ndiscap.sys.mui 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\es-ES\wfplwfs.sys.mui 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\fr-FR\ndiscap.sys.mui 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\fr-FR\wfplwfs.sys.mui 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\ja-JP\wfplwfs.sys.mui 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\de-DE\NdisImPlatform.sys.mui 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\en-US\wfplwfs.sys.mui 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\es-ES\NdisImPlatform.sys.mui 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\es-ES\ndiscap.sys.mui 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\it-IT\NdisImPlatform.sys.mui 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\it-IT\wfplwfs.sys.mui 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\ja-JP\ndiscap.sys.mui 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\uk-UA\NdisImPlatform.sys.mui 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\fr-FR\NdisImPlatform.sys.mui 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\it-IT\ndiscap.sys.mui 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Manipulates Digital Signatures 2 IoCs
Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
description ioc Process File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pwrshsip.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\wintrust.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Executes dropped EXE 1 IoCs
pid Process 3312 Process not Found -
Loads dropped DLL 35 IoCs
pid Process 3312 Process not Found 3312 Process not Found 3312 Process not Found 3312 Process not Found 3312 Process not Found 3312 Process not Found 3312 Process not Found 3312 Process not Found 3312 Process not Found 3312 Process not Found 3312 Process not Found 3312 Process not Found 3312 Process not Found 3312 Process not Found 3312 Process not Found 3312 Process not Found 3312 Process not Found 3312 Process not Found 3312 Process not Found 3312 Process not Found 3312 Process not Found 3312 Process not Found 3312 Process not Found 3312 Process not Found 3312 Process not Found 3312 Process not Found 3312 Process not Found 3312 Process not Found 3312 Process not Found 3312 Process not Found 3312 Process not Found 3312 Process not Found 3312 Process not Found 3312 Process not Found 3312 Process not Found -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops Chrome extension 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\manifest.json 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Downloaded Program Files\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\$Recycle.Bin\S-1-5-21-3588213599-686740421-4058676312-1000\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Contacts\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Desktop\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Documents\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Favorites\Links\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Music\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Pictures\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Searches\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Downloads\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Music\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Favorites\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Media\Desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Downloads\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Documents\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Libraries\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Pictures\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Links\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\OneDrive\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Videos\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\AccountPictures\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\ContactApis.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\InputInjectionBroker.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Provisioning\provcmdlets.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\de-DE\wlanapi.dll.mui 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\dmxmlhelputils.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\it-IT\StorageContextHandler.dll.mui 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\ConfigureExpandedStorage.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\it-IT\pots.dll.mui 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\IME\SHARED\IMELM.DLL 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\de-DE\WWAHost.exe.mui 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\en-US\WinSATAPI.dll.mui 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\objsel.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\rasman.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\wbem\texttable.xsl 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\EhStorAPI.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\PrintPlatformConfig.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_PackageResource\ja-JP\PackageProvider.psd1 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Schemas\PSMaml\developerManagedClass.xsd 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\downlevel\api-ms-win-core-rtlsupport-l1-1-0.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\poqexec.exe 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\wbem\UserStateWMIProvider.mof 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\wbem\es-ES\wsp_fs_uninstall.mfl 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\ja-JP\prnport.vbs 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\msimtf.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\srmtrace.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\winhttp.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\wshom.ocx 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\C_IS2022.DLL 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Containers-OptionalFeature-DisposableClientVM-Package~31bf3856ad364e35~amd64~uk-UA~10.0.22000.1.cat 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Chipset-Package~31bf3856ad364e35~amd64~uk-UA~10.0.22000.1.cat 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\IME\IMEJP\APPLETS\IMJPCAC.DLL 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\ProcessSet\ProcessSet.Schema.psm1 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\it-IT\shwebsvc.dll.mui 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\wbem\en-US\netdacim.dll.mui 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\zh-CN\SyncRes.dll.mui 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Speech_OneCore\Common\en-US\VES-Select.0409.grxml 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\en-US\shellstyle.dll.mui 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\ja-JP\p2p.dll.mui 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\it-IT\prnjobs.vbs 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\es-ES\p2pnetsh.dll.mui 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\ksuser.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\0011\_setup.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\SortWindows6Compat.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_PackageResource\ja-JP\MSFT_PackageResource.schema.mfl 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\en-US\DeviceDisplayStatusManager.dll.mui 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\iscsicpl.exe 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\uk-UA\iernonce.dll.mui 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WinMetadata\Windows.Management.winmd 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\en-US\RunAsHelper.strings.psd1 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\fr-FR\mscpxl32.dll.mui 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\iertutil.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\it-IT\ntdll.dll.mui 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\ja-JP\tcmsetup.exe.mui 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\winbio.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ProcessResource\fr-FR\MSFT_ProcessResource.schema.mfl 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\de-DE\azroleui.dll.mui 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\wbem\en-US\FolderRedirectionWMIProvider.mfl 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\C_ISCII.DLL 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_LogResource\it-IT\MSFT_LogResource.schema.mfl 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\fr-FR\tapisrv.dll.mui 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsClient\MSFT_DnsClientDohServerAddress.cdxml 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe.config 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\ja-JP\gpapi.dll.mui 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.29231.0_x64__8wekyb3d8bbwe\mfc140rus.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\libGLESv2.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Locales\ca.pak 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-ppd.xrm-ms 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ul.xrm-ms 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ppd.xrm-ms 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherAppList.targetsize-80_altform-lightunplated.png 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-16.png 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\contrast-black\FeedbackHubAppList.targetsize-256.png 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\resources.pri 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Yahoo-Dark.scale-125.png 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACEXBE.DLL 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RADIAL\RADIAL.INF 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\FPWEC.DLL 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\NewsAppList.targetsize-256_altform-unplated.png 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.Calendars.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Xml.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\tr-tr\ui-strings.js 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ui-strings.js 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-140.png 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\Assets\GetHelpAppList.targetsize-36_altform-unplated.png 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\it-it\ui-strings.js 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\scanAppLogo.png 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-32_altform-lightunplated.png 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\FeedbackHubSplashScreen.scale-100_altform-colorful.png 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\AppxSignature.p7x 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\warning_2x.png 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Grace-ul-oob.xrm-ms 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\Interceptor.tlb 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_filter-default_32.svg 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\ko_get.svg 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\he-il\ui-strings.js 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\Microsoft.PowerShell.PackageManagement.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunec.jar 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\vlc.mo 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_neutral_split.scale-100_8wekyb3d8bbwe\Images\contrast-black\PowerAutomateSquare71x71Logo.scale-100.png 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\GamesXboxHubStoreLogo.scale-100.png 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-80_altform-unplated.png 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ui-strings.js 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.GamingApp_2105.900.24.0_x64__8wekyb3d8bbwe\XboxStub.winmd 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\PaintAppList.targetsize-72_altform-lightunplated.png 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailLargeTile.scale-400.png 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\illustrations.png 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WideTile.scale-100_contrast-white.png 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Images\PowerAutomateSquare70x70Logo.scale-80.png 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\StoreLogo.scale-125.png 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\contrast-white\FeedbackHubAppList.targetsize-32_altform-lightunplated.png 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.MSHWLatin.txt 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSSOAP30.DLL 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_h264_plugin.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Win10\MicrosoftSolitaireAppList.targetsize-24.png 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\AppCS\Assets\OneDrive_consumer_systray_block_light.svg 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Paint_10.2104.17.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Images\LargeTile.scale-150_contrast-white.png 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\ExchangeLargeTile.scale-100.png 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XmlDocument.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsBase.resources.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\INF\mdmzyp.inf 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Media\ringout.wav 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\SQL\ja\SqlPersistenceService_Logic.sql 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\it\System.IdentityModel.Services.resources.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\aspx_file.gif 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Providers\App_LocalResources\providerList.ascx.es.resx 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\SmtpSettings.aspx.de.resx 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.KeyDistributionService.Cmdlets.Resources\v4.0_10.0.0.0_de_31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.Resources.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\iastorv.PNF 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\mdmmhzel.inf 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\wizardPermission.ascx.de.resx 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PLA\Rules\en-US\Rules.System.Finale.xml 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\WindowsMediaPlayer.admx 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\fr-FR\appv.adml 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\en-US\StorageSense.adml 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\net7500-x64-n650f.inf 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_msvcr100_x64 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\1040\admin.chm 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Net.NetworkInformation.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\AppConfigHome.aspx.es.resx 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\MSBuild\Microsoft.Build.Core.xsd 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\compatjit.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\CreateAppSetting.aspx.ja.resx 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\Permissions\App_LocalResources\createPermission.aspx.resx 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\de\System.IdentityModel.Services.resources.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data.resources\v4.0_10.0.0.0_ja_b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.resources.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Caching.resources\v4.0_4.0.0.0_ja_b03f5f7f11d50a3a\System.Runtime.Caching.resources.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PLA\Reports\de-DE\Report.System.Summary.xml 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Help\mui\0410\mmc.CHM 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Threading.Thread.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\App_LocalResources\home0.aspx.fr.resx 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\wizardFinish.ascx.es.resx 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fr\System.Drawing.Design.resources.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\it-IT\Globalization.adml 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\ServiceModelOperation 3.0.0.0\0410\_ServiceModelOperationPerfCounters_D.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\es\UIAutomationProvider.resources.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\fr\MSBuild.resources.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IO.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\es-ES\ExploitGuard.adml 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Fonts\calibri.ttf 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Fonts\sylfaen.ttf 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\Windows Workflow Foundation 4.0.0.0\0000\PerfCounters_d.ini 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\1031\vbc7ui.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\JA\System.Web.Mobile.Resources.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Microsoft.WinFX.targets 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\PERFLIB\040C\perfc.dat 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Installer\957c.msi 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Runtime.DurableInstancing.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\1040\Microsoft.VisualBasic.Activities.CompilerUI.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.Routing.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fr\MSBuild.resources.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Activation.resources\v4.0_4.0.0.0_ja_31bf3856ad364e35\System.ServiceModel.Activation.resources.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.DynamicData.Design.resources\v4.0_4.0.0.0_de_31bf3856ad364e35\System.Web.DynamicData.Design.resources.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\es\System.ComponentModel.Composition.Registration.resources.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\EventLog.admx 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\ja-JP\fthsvc.adml 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\L2Schemas\WWAN_profile_v6.xsd 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\System.EnterpriseServices.Wrapper.dll 2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2025-05-15_f3ed9cd9921dfa3797fdd934bd8ac588_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe"1⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Drops startup file
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:5124
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.2MB
MD5cf6708cb247db374c572b02f48db93cd
SHA100681fe624f0feee1f309b557a15b38b36a03f0c
SHA256f8226c6c6c18a8643582dc787a447765d9a2054b4646ddeda225822c35cf2ece
SHA51240626de8b09b7189f48e3697145816b5dc2e488628c4d3d27d0df0235d2c9af69c3d1ca3333f506b879295d76ebb4721fc72b0675cd249816b9cc9c51af7854a
-
Filesize
4.4MB
MD51ee751b39cf11e07eec58dffd4b4a442
SHA1f1c44fff097aa08ed7991ed3bc3f50b9f4d00367
SHA256c024242a7837765240e8314adca606609176549a811d888f97cda56503067b24
SHA5120cdd9d52d8744a078bc785e00345545e6451d4d1b9a6a77aae2f175e012fe1339e075529445e3201cca1b92669fd23fc42e3ca56607f4f3624f083639cf2e9e5
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
Filesize5.8MB
MD52767954b4cb01d918a6bea64ab931a34
SHA14a3da83d2bb5d29bd34661d7baaeefb22a7b24e8
SHA25698d246e06a19c7563e5296aa94cc9764f7af57fbf58245fea6704aafae8aa308
SHA512f0a23d1c3180f39bbb0bfae7f34fab39eac9fa7de7860d8d54c7e3ce32bc81fd4a61e300b237cdcb84189bacfe0421c72e6ae5632fb1f7830ed1139aa0d83ae6