Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20250502-en -
resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system -
submitted
18/05/2025, 14:52
Behavioral task
behavioral1
Sample
2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe
Resource
win10v2004-20250502-en
General
-
Target
2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe
-
Size
4.1MB
-
MD5
06c29549810b4973e4d12e9f7c275892
-
SHA1
3062854b6b2001b5a5a8d7a4b51edf403b052329
-
SHA256
6e285adb69def0f37eb2a6cb3742d3f8d012f98bce958a369a1316478b10ba56
-
SHA512
14aca7253b90d59d2cd01877638c4e2f12dbffd00d75bea1c8db730009bb0cddfaaffbabe87195d7ee02c01e6ff7a4ab93b92d057ba57159058d1e042986aab1
-
SSDEEP
49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q4+:ieF+iIAEl1JPz212IhzL+Bzz3dw/Vw
Malware Config
Signatures
-
Gofing
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
-
Gofing family
-
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation. 3 IoCs
resource yara_rule behavioral1/files/0x0003000000022a60-4.dat family_gofing behavioral1/files/0x00020000000220b2-5490.dat family_gofing behavioral1/files/0x0002000000021bef-5496.dat family_gofing -
Drops file in Drivers directory 22 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\en-US\NdisImPlatform.sys.mui 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\en-US\wfplwfs.sys.mui 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\es-ES\NdisImPlatform.sys.mui 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\fr-FR\ndiscap.sys.mui 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\gm.dls 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\es-ES\wfplwfs.sys.mui 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\fr-FR\NdisImPlatform.sys.mui 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\fr-FR\wfplwfs.sys.mui 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\it-IT\ndiscap.sys.mui 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\ja-JP\ndiscap.sys.mui 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\ja-JP\wfplwfs.sys.mui 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\uk-UA\NdisImPlatform.sys.mui 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\de-DE\NdisImPlatform.sys.mui 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\en-US\ndiscap.sys.mui 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\es-ES\ndiscap.sys.mui 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\gmreadme.txt 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\it-IT\NdisImPlatform.sys.mui 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\afunix.sys 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\de-DE\wfplwfs.sys.mui 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\it-IT\wfplwfs.sys.mui 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\ja-JP\NdisImPlatform.sys.mui 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\de-DE\ndiscap.sys.mui 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Manipulates Digital Signatures 1 IoCs
Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
description ioc Process File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pwrshsip.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Loads dropped DLL 64 IoCs
pid Process 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found 3368 Process not Found -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops Chrome extension 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\manifest.json 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Documents\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Pictures\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Desktop\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Documents\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Fonts\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Downloads\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\$Recycle.Bin\S-1-5-21-3674642747-2260306818-3009887879-1000\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Music\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Music\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Saved Games\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Searches\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Libraries\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\AccountPictures\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Media\Desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Links\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Downloads\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Downloaded Program Files\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Favorites\Links\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Favorites\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Desktop\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Videos\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\dlnashext.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\en-US\NetworkExplorer.dll.mui 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\0804\_setup.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Management\Microsoft.PowerShell.Management.psd1 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetLbfo\MSFT_NetLbfoTeamMember.format.ps1xml 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetSecurity\NetFirewallSecurityFilter.cmdletDefinition.cdxml 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Schemas\PSMaml\structureTable.xsd 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\cnvfat.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\en-US\authfwgp.dll.mui 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\AcLayers.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\AccountsRt.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Configuration\BaseRegistration\de-DE\MSFT_MetaConfigurationExtensionClasses.Schema.mfl 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\SyncCenter.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Windows.Graphics.Display.BrightnessOverride.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\EventTracingManagement\MSFT_EtwTraceProvider_v1.0.cdxml 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\de-DE\hh.exe.mui 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\de-DE\winmsipc.dll.mui 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Com\mtsadmin.tlb 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\CoreShellAPI.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\EditionUpgradeManagerObj.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\OneDrive.ico 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\SubRange.uce 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WerEnc.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RegistryResource\uk-UA\MSFT_RegistryResource.schema.mfl 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Provisioning\provcommon.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Dism\en-US\AppxProvider.dll.mui 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PKI\pki.psd1 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\audiodev.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\biwinrt.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\cryptxml.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\dinput8.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Dism\fr-FR\GenericProvider.dll.mui 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\de-DE\WinSATAPI.dll.mui 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\downlevel\api-ms-win-service-core-l1-1-1.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\DefaultAccountTile.png 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Dism\ja-JP\DmiProvider.dll.mui 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Licenses\neutral\_Default\Professional\license.rtf 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WinMetadata\Windows.Devices.winmd 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WinTypes.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\AppvClient.psd1 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetConnection\NetConnection.psd1 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Dism\fr-FR\ImagingProvider.dll.mui 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Dism\ja-JP\SmiProvider.dll.mui 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\F12\it-IT\F12Platform.dll.mui 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\MSDRM\MsoIrmProtector.xls 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\MSFlacDecoder.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ProcessResource\ja-JP\MSFT_ProcessResource.strings.psd1 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\ProcessSet\ProcessSet.Schema.psm1 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Storage\ResiliencySetting.cdxml 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\0005\_setup.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RoleResource\de-DE\MSFT_RoleResourceStrings.psd1 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\da-DK\quickassist.exe.mui 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\ddraw.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\de-DE\MFC40u.dll.mui 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\de-DE\Windows.ApplicationModel.Store.TestingFramework.dll.mui 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\de-DE\joy.cpl.mui 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\de-DE\pots.dll.mui 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Dism\DismCorePS.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\MUI\0411\mscorees.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WinMetadata\Windows.Data.winmd 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\de-DE\gptext.dll.mui 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\de-DE\secinit.exe.mui 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Dism\TransmogProvider.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\en\DatabaseCompare_col.hxc 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\MicrosoftSolitaireSmallTile.scale-100.jpg 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\MicrosoftAccount.scale-100.png 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.contrast-white_targetsize-16.png 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.scale-200.png 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsSmallTile.scale-200.png 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\bg_get.svg 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\ResiliencyLinks\vk_swiftshader_icd.json.DATA 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-pl.xrm-ms 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-100.png 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-32_altform-unplated_contrast-white.png 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\VideoEditor.Common\Resources\ResourceDictionary.xbf 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubStoreLogo.scale-200_contrast-black.png 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationClient.resources.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-100.png 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\index.win32.bundle 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\MixedRealityPortalMedTile.scale-125.png 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\Microsoft.PackageManagement.resources.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\QRCode.pmp 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.43\msedgeupdateres_fa.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ul-oob.xrm-ms 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libmirror_plugin.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_2019.125.2243.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\import_google_contacts\googleImportNoResults.png 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppxSignature.p7x 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-72.png 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Xaml.resources.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\new_icons_retina.png 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-flag.png 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_setid_plugin.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\ResiliencyLinks\identity_proxy\win10\identity_helper.Sparse.Beta.msix.DATA 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\de\Microsoft.PackageManagement.MetaProvider.PowerShell.resources.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ul-oob.xrm-ms 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jfr\default.jfc 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-environment-l1-1-0.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL077.XML 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-96_altform-unplated_contrast-black.png 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\VideoFrameExtractor\UserControls\RangeSelector.xbf 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-black\SmallTile.scale-100.png 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.ComponentModel.EventBasedAsync.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\System.Windows.Forms.resources.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\LibrarySquare150x150Logo.scale-125.png 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-black_targetsize-80.png 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-gb\wintlim.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sl-si\ui-strings.js 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\WindowsBase.resources.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\7-Zip\Lang\ug.txt 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-memory-l1-1-0.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Java\jre-1.8\bin\gstreamer-lite.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Java\jre-1.8\lib\management\management.properties 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\ISO690.XSL 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-il\ui-strings.js 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Windows Media Player\setup_wm.exe 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-64_altform-unplated_contrast-high.png 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\mraut.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreLargeTile.scale-200.png 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-60.png 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\AdobeID.pdf 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hr-hr\ui-strings.js 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ui-strings.js 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ja\System.Runtime.WindowsRuntime.resources.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Utilities.v4.0.resources\v4.0_4.0.0.0_it_b03f5f7f11d50a3a\Microsoft.Build.Utilities.v4.0.resources.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\de-DE\nca.adml 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Fonts\vgasysr.fon 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\hidspi_km.PNF 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\spaceport.PNF 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\webengine.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\de\Microsoft.JScript.resources.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Workflow.VisualBasic.Targets 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.Appx.PackageManager.Commands.Resources\v4.0_10.0.0.0_ja_31bf3856ad364e35\Appx.psd1 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\Windows Workflow Foundation 4.0.0.0\0000\PerfCounters_d.ini 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\cht4vx64.PNF 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\netnb.inf 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\System.Configuration.Install.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\es\system.data.sqlxml.resources.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\PERFLIB\0407\perfh.dat 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\mdmgen.inf 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_LocalResources\WebAdminHelp_Application.aspx.resx 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Users\App_LocalResources\findUsers.aspx.ja.resx 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\WsatConfig.exe 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\de\SqlWorkflowInstanceStoreLogic.sql 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\es\System.ComponentModel.Composition.resources.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ja\System.Xml.Linq.resources.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Accessibility.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_filter.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\en-US\MicrosoftEdge.adml 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\es-ES\UserExperienceVirtualization.adml 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\fr-FR\FileRecovery.adml 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\iSCSI.admx 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Fonts\Inkfree.ttf 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ImmersiveControlPanel\images\TinyTile.contrast-black_scale-400.png 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\wizardAddUser.ascx.ja.resx 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Build.Conversion.v4.0.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Management.Instrumentation.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ja\System.Data.resources.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets.Resources\v4.0_1.0.0.0_fr_31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.Resources.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100esn_x86 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\ja\UIAutomationClient.resources.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\migration.dat.LOG1 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\fr-CA_BitLockerToGo.exe.mui 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Fonts\corbelb.ttf 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\es\sysglobl.resources.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fr\System.Activities.DurableInstancing.resources.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\CEIPEnable.admx 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\es-ES\Handwriting.adml 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Installer\SourceHash{64A3A4F4-B792-11D6-A78A-00B0D0180381} 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp_Security.aspx 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ja\System.RunTime.Serialization.resources.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ja\sysglobl.resources.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\OCR\it-it\MsOcrRes.orp 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\de-DE\EventViewer.adml 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\es-ES\PeerToPeerCaching.adml 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\ja-JP\AVSValidationGP.adml 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\eaphost.inf 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\netwew00.inf 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\libcef.dll.15EE1C08_ED51_465D_B6F3_FB152B1CC435 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clretwrc.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Cursors\aero_link_im.cur 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Fonts\ARIALNB.TTF 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Installer\SourceHash{90160000-008C-0000-1000-0000000FF1CE} 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\dfdll.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\es\Microsoft.Build.Conversion.v4.0.resources.dll 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\de-DE\Printing.adml 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Boot\EFI\es-ES\bootmgr.efi.mui 2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2025-05-18_06c29549810b4973e4d12e9f7c275892_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe"1⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Drops startup file
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4896
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.2MB
MD5c75cff4c50e998014ee71f3796118dc7
SHA11132cec24ad31be0e52a7670c42ed6879ac02d7e
SHA256513c90019d720c39b65ffb5749f8cce1b7904b2911592cce07f3ec5796198839
SHA5125d6e0e4857a722dc87d96429b7a8ad489b45c32370c801b54ba8ffc4b0e4c6d3aa16e801acf76fc564867b74a31daa4c5bf27faafafc717f6ef87107b96ffa5b
-
Filesize
4.4MB
MD5abb4eea3878fbe935fd963d5fb4086aa
SHA14fa217e37752778ef04e09b2f11095d9e444a973
SHA2562acc16e9bcfec425fa59f91c64359b75cc87131f8d79c6c6f6ded1e4b1544983
SHA512dab14e5a3b00d37926bd0e9824bcfa1fec7a993b3d1bad6d337a7b4e129d615b4cab9f525eb75f2b76e17351576b8eaab69a5744e4eee25eb6e54f0ba90d0e67
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
Filesize5.8MB
MD514d8c97debc772d4c0b11d27271a74d7
SHA1b5755f64ed0e9fa744311e26c633ff484e989f9c
SHA256451d4826a93736b23adc4605eb1ee066ac90493eec77de261fbff512e437f55e
SHA5128e582281bd3abfeb19de6d76e1d854cea331102dcf6df8589daecf8e76ed5fbf3c7fe0d205b0df3fe81c69bd46e5b58a5155cbd4fe275249fab5374a7fc8c9f8