Analysis
-
max time kernel
150s -
max time network
102s -
platform
windows11-21h2_x64 -
resource
win11-20250508-en -
resource tags
arch:x64arch:x86image:win11-20250508-enlocale:en-usos:windows11-21h2-x64system -
submitted
15/05/2025, 07:45
Behavioral task
behavioral1
Sample
2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe
Resource
win11-20250508-en
General
-
Target
2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe
-
Size
4.1MB
-
MD5
395c7f71f6117cd2506dab5d05f779ee
-
SHA1
31b29705353eb64662e5a77a3ee044a42c726ec3
-
SHA256
82be4a55e0a3645b631ed0600a970486dbb626478fabfb40c5a280a8d721d5e0
-
SHA512
9706a67dc66d214e6116bcc80a4959b52f5cb0c5106a062bfb43cf3279e0d1971f4695329dbd68f46b07c065c5da369c62edfa21700ce907e739e5eea55d5bf9
-
SSDEEP
49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q4J:ieF+iIAEl1JPz212IhzL+Bzz3dw/Vr
Malware Config
Signatures
-
Gofing
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
-
Gofing family
-
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation. 3 IoCs
resource yara_rule behavioral2/files/0x000300000002a23c-4.dat family_gofing behavioral2/files/0x000200000002980d-5410.dat family_gofing behavioral2/files/0x00020000000297d4-5430.dat family_gofing -
Renames multiple (52) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Drivers directory 22 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\en-US\ndiscap.sys.mui 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\en-US\wfplwfs.sys.mui 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\es-ES\NdisImPlatform.sys.mui 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\fr-FR\NdisImPlatform.sys.mui 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\gm.dls 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\ja-JP\wfplwfs.sys.mui 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\uk-UA\NdisImPlatform.sys.mui 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\de-DE\NdisImPlatform.sys.mui 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\de-DE\wfplwfs.sys.mui 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\fr-FR\ndiscap.sys.mui 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\gmreadme.txt 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\it-IT\wfplwfs.sys.mui 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\afunix.sys 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\de-DE\ndiscap.sys.mui 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\en-US\NdisImPlatform.sys.mui 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\es-ES\wfplwfs.sys.mui 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\fr-FR\wfplwfs.sys.mui 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\ja-JP\NdisImPlatform.sys.mui 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\ja-JP\ndiscap.sys.mui 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\es-ES\ndiscap.sys.mui 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\it-IT\NdisImPlatform.sys.mui 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\it-IT\ndiscap.sys.mui 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Manipulates Digital Signatures 2 IoCs
Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
description ioc Process File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pwrshsip.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\wintrust.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Executes dropped EXE 1 IoCs
pid Process 3220 Process not Found -
Loads dropped DLL 35 IoCs
pid Process 3220 Process not Found 3220 Process not Found 3220 Process not Found 3220 Process not Found 3220 Process not Found 3220 Process not Found 3220 Process not Found 3220 Process not Found 3220 Process not Found 3220 Process not Found 3220 Process not Found 3220 Process not Found 3220 Process not Found 3220 Process not Found 3220 Process not Found 3220 Process not Found 3220 Process not Found 3220 Process not Found 3220 Process not Found 3220 Process not Found 3220 Process not Found 3220 Process not Found 3220 Process not Found 3220 Process not Found 3220 Process not Found 3220 Process not Found 3220 Process not Found 3220 Process not Found 3220 Process not Found 3220 Process not Found 3220 Process not Found 3220 Process not Found 3220 Process not Found 3220 Process not Found 3220 Process not Found -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops Chrome extension 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\manifest.json 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Contacts\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Searches\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Media\Desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Favorites\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Videos\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Offline Web Pages\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Downloads\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Links\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Music\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Documents\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\AccountPictures\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Pictures\Camera Roll\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Downloaded Program Files\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\OneDrive\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Saved Games\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Videos\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Desktop\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Music\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\slwga.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\12520850.cpx 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\KBDIBO.DLL 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\clfsw32.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\da-DK\APHostRes.dll.mui 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\fr-FR\iertutil.dll.mui 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\fr-FR\mmcbase.dll.mui 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-UX-UI-63-merged-Package~31bf3856ad364e35~amd64~es-ES~10.0.22000.1.cat 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\ja-JP\raschap.dll.mui 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\mfc110u.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\fr-FR\sndvol.exe.mui 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\AuditPolicyGPInterop.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Networking-VirtualDevice-Synthetic-Package~31bf3856ad364e35~amd64~uk-UA~10.0.22000.1.cat 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-UX-UI-63-Package~31bf3856ad364e35~amd64~ja-JP~10.0.22000.1.cat 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-DeliveryOptimization-MI-Package~31bf3856ad364e35~amd64~~10.0.22000.1.cat 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-IsolatedUserMode-Package~31bf3856ad364e35~amd64~es-ES~10.0.22000.1.cat 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\AdvancedEmojiDS.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-DataCenterBridging-WOW64-Package~31bf3856ad364e35~amd64~fr-FR~10.0.22000.1.cat 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\wbem\fr-FR\PolicMan.mfl 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\wbem\it-IT\nlmcim.mfl 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Networking-Containers-Server-merged-Package~31bf3856ad364e35~amd64~de-DE~10.0.22000.1.cat 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Virtio-Package~31bf3856ad364e35~amd64~fr-FR~10.0.22000.1.cat 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-EnterpriseClientSync-Host-Opt-Package~31bf3856ad364e35~amd64~en-US~10.0.22000.1.cat 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Holographic-Desktop-Merged-Package~31bf3856ad364e35~amd64~es-ES~10.0.22000.1.cat 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Multimedia-RestrictedCodecs-WOW64-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.22000.1.cat 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\GameChatTranscription.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\basecsp.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\de-DE\gpscript.dll.mui 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\ja-JP\PlayToStatusProvider.dll.mui 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\ja-JP\wimgapi.dll.mui 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\wbem\fr-FR\storagewmi_uninstall.mfl 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package02~31bf3856ad364e35~amd64~~10.0.22000.318.cat 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Optional-Features-Package~31bf3856ad364e35~amd64~~10.0.22000.318.cat 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Configuration\BaseRegistration\de-DE\MSFT_DSCMetaConfiguration.mfl 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\IEAdvpack.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Licenses\neutral\OEM\Professional\license.rtf 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\mprmsg.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\zh-TW\quickassist.exe.mui 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Containers-Client-Manager-Package~31bf3856ad364e35~amd64~~10.0.22000.318.cat 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-DynamicMemory-VirtualDevice-Package~31bf3856ad364e35~amd64~uk-UA~10.0.22000.1.cat 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Worker-Package~31bf3856ad364e35~amd64~~10.0.22000.434.cat 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\cmgrcspps.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\it-IT\explorer.exe.mui 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CallButtons.ProxyStub.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-BackgroundExecution-Group-Package~31bf3856ad364e35~amd64~~10.0.22000.120.cat 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-InternetExplorer-Package~31bf3856ad364e35~amd64~ja-JP~11.0.22000.1.cat 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\PerceptionDevice.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Provisioning\wiminterop.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Schemas\PSMaml\ManagedDeveloperStructure.xsd 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\es-ES\hidphone.tsp.mui 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\wbem\it-IT\MsDtcWmi.mfl 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0111~31bf3856ad364e35~amd64~uk-UA~10.0.22000.1.cat 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Multimedia-RestrictedCodecs-Package~31bf3856ad364e35~amd64~~10.0.22000.493.cat 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ServiceResource\uk-UA\MSFT_ServiceResource.strings.psd1 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\he-IL\cdosys.dll.mui 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-VmBus-VirtualDevice-merged-Package~31bf3856ad364e35~amd64~ja-JP~10.0.22000.1.cat 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-DirectoryServices-ADAM-Client-Admin-Package~31bf3856ad364e35~amd64~uk-UA~10.0.22000.1.cat 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\DiagnosticInvoker.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\UserDataLanguageUtil.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\UIRibbon.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\ktmw32.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\mfmpeg2srcsnk.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-EmbeddedExp-WOW64-Package~31bf3856ad364e35~amd64~de-DE~10.0.22000.1.cat 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-IMAPI-Package~31bf3856ad364e35~amd64~~10.0.22000.1.cat 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.WebHeaderCollection.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_listview_selected-hover.svg 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\ui-strings.js 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\Match.ps1 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\It.Tests.ps1 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\DEEPBLUE\THMBNAIL.PNG 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-24_altform-lightunplated.png 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Images\Square44x44Logo.targetsize-96.png 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateComRegisterShell64.exe 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\BUSINESS.ONE 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-24_altform-unplated.png 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\FileExtension.targetsize-336.png 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover_2x.png 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sl-si\ui-strings.js 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-140.png 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7ES.LEX 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\SnippingTool\Assets\Square44x44Logo.targetsize-256_altform-unplated.png 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Tracing.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XPath.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\tpcps.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\7-Zip\Lang\sv.txt 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\resources.pri 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\S-1-5-21-3687046934-3833731302-526866946-1000-MergedResources-0.pri 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\FileExtension.targetsize-48.png 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\trdtv2r41.xsl 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\vlc.mo 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\Assets\FileAssociation\FileAssociation.targetsize-16.png 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-16_altform-unplated.png 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreWideTile.scale-200.png 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\HoloTile.glb 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\Locales\ar.pak 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Office 2007 - 2010.eftx 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.contrast-black_targetsize-64.png 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-24_altform-unplated_contrast-black.png 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\8080_20x20x32.png 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ro-ro\ui-strings.js 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Grace-ppd.xrm-ms 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreAppList.targetsize-72.png 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\Toggle.js 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-private-l1-1-0.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\api-ms-win-crt-convert-l1-1-0.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.IO.Log.Resources.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\resources.pri 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.50.24002.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\Locales\lo.pak 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-pl.xrm-ms 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CONCRETE\THMBNAIL.PNG 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libsmb_plugin.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-72_contrast-white.png 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-amd\components\DocumentCard\DocumentCardDetails.base.js 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ppd.xrm-ms 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Images\contrast-white\PowerAutomateSquare71x71Logo.scale-200.png 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SnipSketchAppList.targetsize-256_altform-unplated.png 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\CortanaCommands.xml 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\components\DocumentCard\DocumentCardActions.styles.js 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib\styled.js 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\back-arrow-disabled.svg 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\zh-cn_get.svg 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libmono_plugin.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\contrast-white\NotepadAppList.targetsize-48.png 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay.winmd 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\LinkedInboxWideTile.scale-150.png 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ppd.xrm-ms 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Boot\PCAT\de-DE\memtest.exe.mui 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ImmersiveControlPanel\images\TileSmall.contrast-white_scale-400.png 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Vsa.Vb.CodeDOMProcessor.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\wizardProviderInfo.ascx 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\de\System.Data.Linq.resources.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security.resources\v4.0_4.0.0.0_it_b03f5f7f11d50a3a\System.Security.resources.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\fr-FR\Search.adml 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Speech_OneCore\Engines\TTS\en-US\NUSData\M1033David.keyboard.WVE 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\CROATIAN.TXT 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\1033\alinkui.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\DE\MSBuild.resources.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Runtime.Serialization.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\System.DirectoryServices.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fr\Microsoft.VisualBasic.Compatibility.Data.resources.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\en-US\FolderRedirection.adml 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\fr-FR\DFS.adml 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\de\System.Windows.Forms.resources.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\MiguiControls.Resources\v4.0_1.0.0.0_de_31bf3856ad364e35\MIGUIControls.resources.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Boot\EFI\lv-LV\bootmgfw.efi.mui 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Fonts\cga80woa.fon 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_LocalResources\WebAdminHelp_Security.aspx.resx 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\fr\SMDiagnostics.resources.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\App_LocalResources\default.aspx.resx 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\es\ComSvcConfig.resources.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\es\System.Device.resources.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\fr\Microsoft.VisualBasic.Resources.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Providers\App_LocalResources\providerList.ascx.it.resx 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ja\sysglobl.resources.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\TPM.admx 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\en-US\TabletPCInputPanel.adml 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\00006109E70000000100000000F01FEC\16.0.12527\msvcp140.dll_x86 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\L2Schemas\WWAN_profile_v3.xsd 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ja\System.Web.DynamicData.Design.resources.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.InteropServices.WindowsRuntime.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.DynamicData.Design.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\it\PresentationCore.resources.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fr\System.Activities.Presentation.resources.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\fr-FR\Globalization.adml 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\ja\PresentationUI.resources.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Media\Focus3_48000Hz.raw 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\XPThemes.manifest 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\normalization.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\es\EdmGen.resources.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Configuration.Install.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Speech_OneCore\Engines\TTS\en-US\M1033Mark.APM 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Boot\Resources\ja-JP\bootres.dll.mui 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ImmersiveControlPanel\images\logo.targetsize-60_contrast-white.png 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\DebugAndTrace.aspx.resx 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\Browsers\avantgo.browser 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\DebugAndTrace.aspx.es.resx 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\es-ES\EventForwarding.adml 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Fonts\WINGDNG2.TTF 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\.NET Data Provider for SqlServer\_dataperfcounters_shared12_neutral.ini 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Media\Speech Off.wav 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\WinInit.admx 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Fonts\GARABD.TTF 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ja\EdmGen.resources.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\CreateAppSetting.aspx.ja.resx 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PLA\Rules\es-ES\Rules.System.Common.xml 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\mdmdyna.inf 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\DE\System.ServiceProcess.Resources.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\it\System.Data.Services.resources.dll 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Boot\PCAT\ro-RO\bootmgr.exe.mui 2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2025-05-15_395c7f71f6117cd2506dab5d05f779ee_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe"1⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Drops startup file
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4776
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.2MB
MD5624df3e8a73d573f4aaec943378b8e52
SHA1e20a416e449be87249a467b9b1752e36e56d4115
SHA256fb308598e0d254e1e527033ccd2c4a9040f55cb9ae5a109caab38f94eac78ace
SHA51225c42b5119789f99725a4f93e5282519f482553a20e17c1474124d730023128eae0f2dfbe408565c81cf118317c01f7c6bba35a07db97cd9da4d0416e6e1d2df
-
Filesize
4.4MB
MD50a4584b717656166250fba90baca5ab7
SHA1d4f89c55604a6e01c058d974f5ff837175cb2a04
SHA2569a2803117533346b837eeef4bc969439b99f13f9dd0296d5254bb0de5ce9d7b6
SHA512e9990480c1c738b7d6b7deab8a2ae62ae328ea3f5205b9cc027a397541d4f143b1f7d5192f0558f5619aaf56ff42bdb68757c45e039011cdbc3c549dd1d57eaf
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
Filesize5.8MB
MD5692c330589587f23a3ed0aacc13e9b72
SHA1856b83b68afe1459dac15a5728365bebcad62d07
SHA256c999f69ac8ab227ed95fc4953f39729591942df148e0916803d32d17cefb770c
SHA5120b68a3c9665a7faaac33d12ea967ca8474a5c6f071c33eb30c31b05ea6ca127503f7b973932e8e0f18b0db213f57e7b6f9553f2fe2f6717b03a81193b7dde6bd