Analysis
-
max time kernel
150s -
max time network
104s -
platform
windows11-21h2_x64 -
resource
win11-20250502-en -
resource tags
arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system -
submitted
19/05/2025, 13:39
Behavioral task
behavioral1
Sample
2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe
Resource
win11-20250502-en
General
-
Target
2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe
-
Size
4.1MB
-
MD5
5b9e5a89eb6c7826167c719c5467aa64
-
SHA1
9826337e2b30831871cde19d23c30d6f2b679756
-
SHA256
42e2feeb098bd035ccbd01d5bd59d6bdf3af9779d445e70085750479592d7376
-
SHA512
45f9d4f90617d7b233cae22ef484f6d4834eb4d3c17c46568f12901df86179c6be3c2220eb00eee5d46c25adf4abe5c9e619e009198249d0ab5237ec4e818a12
-
SSDEEP
49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q4U:ieF+iIAEl1JPz212IhzL+Bzz3dw/VWey
Malware Config
Signatures
-
Gofing
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
-
Gofing family
-
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation. 3 IoCs
resource yara_rule behavioral2/files/0x000300000002a259-4.dat family_gofing behavioral2/files/0x000200000002924e-5470.dat family_gofing behavioral2/files/0x000200000002923c-5496.dat family_gofing -
Renames multiple (51) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Drivers directory 22 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\en-US\ndiscap.sys.mui 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\en-US\wfplwfs.sys.mui 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\ja-JP\NdisImPlatform.sys.mui 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\es-ES\ndiscap.sys.mui 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\it-IT\wfplwfs.sys.mui 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\de-DE\wfplwfs.sys.mui 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\es-ES\wfplwfs.sys.mui 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\fr-FR\ndiscap.sys.mui 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\it-IT\NdisImPlatform.sys.mui 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\it-IT\ndiscap.sys.mui 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\ja-JP\ndiscap.sys.mui 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\uk-UA\NdisImPlatform.sys.mui 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\de-DE\NdisImPlatform.sys.mui 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\es-ES\NdisImPlatform.sys.mui 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\fr-FR\NdisImPlatform.sys.mui 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\fr-FR\wfplwfs.sys.mui 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\gm.dls 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\gmreadme.txt 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\ja-JP\wfplwfs.sys.mui 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\afunix.sys 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\de-DE\ndiscap.sys.mui 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\en-US\NdisImPlatform.sys.mui 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Manipulates Digital Signatures 2 IoCs
Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
description ioc Process File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pwrshsip.dll 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\wintrust.dll 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Executes dropped EXE 1 IoCs
pid Process 3264 Process not Found -
Loads dropped DLL 64 IoCs
pid Process 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops Chrome extension 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\manifest.json 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Desktop\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Favorites\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Desktop\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Saved Games\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\AccountPictures\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Downloads\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Videos\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Music\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Fonts\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Documents\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Downloads\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Downloaded Program Files\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Links\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Pictures\Camera Roll\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Documents\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Media\Desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Offline Web Pages\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Pictures\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Searches\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\$Recycle.Bin\S-1-5-21-330179853-1108322181-418488014-1000\desktop.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-TabletPC-Package~31bf3856ad364e35~amd64~ja-JP~10.0.22000.1.cat 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Wifi-Client-Broadcom-Bcmwl63al-FOD-Package~31bf3856ad364e35~amd64~~10.0.22000.1.cat 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DefaultQuestions.json 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\FileRepository\c_nettrans.inf_amd64_9859e6d1394d99d3\c_nettrans.inf 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\de-DE\netnb.inf_loc 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\Keywords\{A5A7C794-3D59-41DF-915F-19ACDA526FC9}4105.bin 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Dism\es-ES\FolderProvider.dll.mui 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\MiracastReceiver.dll 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\ja-JP\winver.exe.mui 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\shacct.dll 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\de-DE\winusb.inf_loc 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\en-US\netl1c63x64.inf_loc 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetAdapter\MSFT_NetAdapterSriovVf.cmdletDefinition.cdxml 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WindowsOptionalFeature\en-US\MSFT_WindowsOptionalFeature.schema.mfl 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\sxsstore.dll 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Composable-PlatformExtension-DragDropCommon-WOW64-Package~31bf3856ad364e35~amd64~~10.0.22000.1.cat 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Printing-PrintToPDF-Opt-Package~31bf3856ad364e35~amd64~uk-UA~10.0.22000.1.cat 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\LocationFramework.dll 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\IME\SHARED\IMETIP.DLL 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\inetcomm.dll 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-Graphics-DirectX-Package~31bf3856ad364e35~amd64~~10.0.22000.469.cat 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\Dism\en-US\UnattendProvider.dll.mui 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\Dsui.dll 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\accountaccessor.dll 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\shgina.dll 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-EnterpriseClientSync-Host-Opt-Package~31bf3856ad364e35~amd64~es-ES~10.0.22000.1.cat 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\Dism\de-DE\UnattendProvider.dll.mui 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\en-US\hdaudio.inf_loc 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetAdapter\MSFT_NetAdapterStatistics.cmdletDefinition.cdxml 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\lv-LV\quickassist.exe.mui 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\slc.dll 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Containers-Guest-Gated-Package~31bf3856ad364e35~amd64~en-US~10.0.22000.1.cat 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Multimedia-RestrictedCodecsCore-Package~31bf3856ad364e35~amd64~en-US~10.0.22000.1.cat 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\PhonePlatformAbstraction.dll 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\nb-NO\windows.ui.xaml.dll.mui 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Common-Drivers-merged-Package~31bf3856ad364e35~amd64~~10.0.22000.469.cat 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-WebcamExperience-WOW64-Package~31bf3856ad364e35~amd64~uk-UA~10.0.22000.1.cat 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\es-ES\circlass.inf_loc 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\fr-FR\buttonconverter.inf_loc 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ProcessResource\ja-JP\MSFT_ProcessResource.schema.mfl 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\pspluginwkr.dll.mui 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\es-ES\tcmsetup.exe.mui 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-OptionalFeatures-Package~31bf3856ad364e35~amd64~~10.0.22000.71.cat 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\pt-PT\cdosys.dll.mui 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetTCPIP\MSFT_NetTransportFilter.cdxml 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\it-IT\objsel.dll.mui 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\es-ES\WUDFUsbccidDriver.inf_loc 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\it-IT\mausbhost.inf_loc 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-TextPrediction-Package~31bf3856ad364e35~amd64~de-DE~10.0.22000.1.cat 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\FileRepository\prnge001.inf_amd64_d06a04ca781e27cc\prnge001.inf 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\en-US\3ware.inf_loc 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\es-ES\sisraid2.inf_loc 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\en-US\NetworkHelper.dll.mui 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-LanguagePack-Package~31bf3856ad364e35~amd64~en-US~10.0.22000.318.cat 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SMB1Deprecation-Package~31bf3856ad364e35~amd64~~10.0.22000.1.cat 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\en-US\mdmhayes.inf_loc 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\es-ES\netnvma.inf_loc 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\ja-JP\AudioEndpoint.inf_loc 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetAdapter\MSFT_NetAdapterHardwareInfo.cmdletDefinition.cdxml 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Desktop-Shared-Drivers-Package~31bf3856ad364e35~amd64~~10.0.22000.493.cat 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\FileRepository\nvdimm.inf_amd64_ccd884280893585c\nvdimm.inf 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\DismApi.dll 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.ProviderShared.dll 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\Assets\CameraLargeTile.scale-100.png 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\ps1file.targetsize-16.png 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-16.png 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\FilterModule.dll 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-32_altform-unplated_contrast-black.png 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\arrow-left.gif 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Generic-Dark.scale-200.png 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherAppList.targetsize-80_altform-lightunplated.png 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-16.png 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\contrast-white\FeedbackHubAppList.targetsize-36.png 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Images\LockScreenLogo.scale-100_contrast-black.png 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-36_altform-lightunplated.png 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.EventBasedAsync.dll 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\msedgeupdateres_ms.dll 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-commonjs\warn\warn.js 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.GamingApp_2105.900.24.0_x64__8wekyb3d8bbwe\Assets\Xbox_WideTile.scale-200_contrast-black.png 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_12008.1001.1.0_x64__8wekyb3d8bbwe\Store.Purchase.Component.winmd 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\MusicWhatsNewItems.json 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\HxMailWideTile.scale-150.png 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Net.Resources.dll 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-amd\IRectangle.js 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Printing.dll 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\Microsoft.VisualBasic.Forms.resources.dll 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PaintWideTile.scale-400.png 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubSplashScreen.scale-200.png 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\mso40uiimm.dll 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Numerics.dll 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\PresentationFramework.Luna.dll 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Common Files\System\ado\msadrh15.dll 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ppd.xrm-ms 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleSplashScreen.scale-200.png 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AlarmsStoreLogo.scale-100.png 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.targetsize-20_altform-lightunplated.png 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\GamesXboxHubAppList.scale-100.png 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ppd.xrm-ms 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\api-ms-win-crt-convert-l1-1-0.dll 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\UnlockHide.clr 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_10.0.561.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-32_contrast-white.png 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pl\Microsoft.VisualBasic.Forms.resources.dll 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\hr-hr\ui-strings.js 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-ul-oob.xrm-ms 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN065.XML 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftStickyNotes_4.0.2.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Icons\StickyNotesWideTile.scale-125.png 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\PeopleUtilRT.dll 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.50.24002.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\GameBar_SmallTile.scale-100.png 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\RunningLate.scale-64.png 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linesdistinctive.dotx 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-24_altform-lightunplated.png 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\A12_Spinner.gif 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_proxy\win11\identity_helper.Sparse.Canary.msix 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\WindowsFormsIntegration.resources.dll 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ul-phn.xrm-ms 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PaintStoreLogo.scale-200.png 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxSignature.p7x 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-32.png 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Security.Cryptography.Pkcs.dll 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\s_filetype_xd.svg 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\pl-pl\ui-strings.js 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Cultures\OFFICE.ODF 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\folder.gif 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\default.win32manifest 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\de-DE\SoundRec.adml 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\en-US\SearchOCR.adml 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\it-IT\AttachmentManager.adml 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Security.SecureString.dll 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\1031\clretwrc.dll 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\legacy.web_lowtrust.config 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Linq.resources\v4.0_4.0.0.0_ja_b77a5c561934e089\System.Data.Linq.resources.dll 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Services.Design.resources\v4.0_4.0.0.0_ja_b77a5c561934e089\System.Data.Services.Design.resources.dll 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\de-DE\WindowsRemoteShell.adml 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Fonts\FRSCRIPT.TTF 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\c_dot4print.inf 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Users\App_LocalResources\editUser.aspx.resx 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\es\System.Speech.resources.dll 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\de\SqlPersistenceService_Logic.sql 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\it\System.ServiceModel.Internals.resources.dll 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\fr\System.Net.Http.WebRequest.resources.dll 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\confirmation.ascx.it.resx 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\intelpep.inf 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clientexclusionlist.xml 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\es-ES\iSCSI.adml 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\it-IT\SystemRestore.adml 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\InboxApps\OutlookPWA.msix 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\AppSetting.ascx.resx 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\NetFx40_IIS_schema_update.xml 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Boot\PCAT\memtest.exe 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\.NET Memory Cache 4.0\0411\netmemorycache_d.ini 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Activities.Resources\v4.0_3.0.0.0_es_31bf3856ad364e35\Microsoft.PowerShell.Activities.Resources.dll 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\fr-FR\DnsClient.adml 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\3082\alinkui.dll 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\App_LocalResources\WebAdminHelp.aspx.resx 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Microsoft.WinFX.targets 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\DebugAndTrace.aspx.resx 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Conversion.v4.0.resources\v4.0_4.0.0.0_fr_b03f5f7f11d50a3a\Microsoft.Build.Conversion.v4.0.resources.dll 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals.resources\v4.0_4.0.0.0_de_31bf3856ad364e35\System.ServiceModel.Internals.resources.dll 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PLA\Rules\Rules.System.Common.xml 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Cursors\help_r.cur 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\storufs.PNF 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Users\App_LocalResources\manageUsers.aspx.es.resx 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fr\System.Security.resources.dll 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel.Selectors.resources\v4.0_4.0.0.0_de_b77a5c561934e089\System.IdentityModel.Selectors.resources.dll 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Routing.resources\v4.0_4.0.0.0_es_31bf3856ad364e35\System.ServiceModel.Routing.resources.dll 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ja\System.Data.DataSetExtensions.resources.dll 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\DebugAndTrace.aspx 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Cmdletization.OData.Resources\v4.0_3.0.0.0_fr_31bf3856ad364e35\Microsoft.PowerShell.Cmdletization.OData.Resources.dll 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\v4.0_3.0.0.0_de_31bf3856ad364e35\Microsoft.PowerShell.Gpowershell.resources.dll 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\es-ES\ControlPanelDisplay.adml 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\mdmcxpv6.inf 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\netvchannel.inf 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v1.1.4322\regsvcs.exe.config 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\fr\DataSvcUtil.resources.dll 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\de-DE\Cpls.adml 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\de-DE\DigitalLocker.adml 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Cursors\aero_busy.ani 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Fonts\smaf1257.fon 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\wizard.aspx.fr.resx 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\SQL\en\SqlPersistenceService_Schema.sql 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\Fonts\GlobalUserInterface.CompositeFont 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\es\System.Activities.Core.Presentation.resources.dll 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Log.resources\v4.0_4.0.0.0_de_b03f5f7f11d50a3a\System.IO.Log.resources.dll 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PLA\Rules\ja-JP\Rules.System.Wired.xml 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Boot\EFI\fi-FI\memtest.efi.mui 2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2025-05-19_5b9e5a89eb6c7826167c719c5467aa64_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe"1⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Drops startup file
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:2688
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.2MB
MD540ef069cd90d74e877702e4fc5c9c6c6
SHA1df7b4a90e378cf8c240b27b5b549e941b079dbd4
SHA256f4feb4b71144108f1299face1d3ffdaf05fe56fa5cf141d33e4b5e716eb16f89
SHA512da516a9889294545f5d6130825934fcc401c8fce2d875b0012bbcb4e13f5f8fc6ccf1622cb7858f7956562109f147487ab4a0444b58b089f5dfb98f7fff9877d
-
Filesize
4.4MB
MD5c5d52414b2d73abd15c16df2746fcbc2
SHA175e93f9ab461845ac19f9b21c84b74f7164a49c1
SHA256fcd26addd2856efd485aec57dfd2e4df3d17d102be531ef34aff8181fc1b4f04
SHA512709494508e8567754d81ab03cd00fd53d4e9bfded5403f3ce5cadd8116f234bb2891c0240dd23cc91d5560fa4a6aab412524da16f46a1e9cd250702a905fdd6c
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
Filesize5.8MB
MD54d06c408703b55d4dbca43568ebf9993
SHA1e7bf3391be63b305e58bbc0ca178cde885a2ea9c
SHA25676e59b08fbdbc988924bad72694da7a4811b31145d00e548ed0167143374a023
SHA51208bc57c72972448dd04e573b3479aaed0ff4caa257ff51d25740c30b35f4a0e1ad0cf49512f69fabcccd3824d19f2d2c4c8b66b578519204dd1affa9d2bc6a12