Analysis
-
max time kernel
150s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20250502-en -
resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system -
submitted
19/05/2025, 14:42
Behavioral task
behavioral1
Sample
2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe
Resource
win11-20250508-en
General
-
Target
2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe
-
Size
4.2MB
-
MD5
a818eb5064fa0c5a4929baf32832853c
-
SHA1
b01570952a997a9f2ef84d1a17f06bf54e93477f
-
SHA256
0a6d055a00f21b3044aed28427d2cd4aadda46c986af2a1390c5e06af36fcf34
-
SHA512
6640668b498c04f44f4853f5ec861d02a84183ab8c158fc027d3eee66b136c6710a705e26e6aefda4ecbb663be5547f299ab710233e66a5689b751f38ead1393
-
SSDEEP
49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q4y:ieF+iIAEl1JPz212IhzL+Bzz3dw/VNe
Malware Config
Signatures
-
Gofing
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
-
Gofing family
-
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation. 3 IoCs
resource yara_rule behavioral1/files/0x0003000000022a6e-4.dat family_gofing behavioral1/files/0x0002000000021d6b-5476.dat family_gofing behavioral1/files/0x0002000000021d8e-5492.dat family_gofing -
Drops file in Drivers directory 22 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\fr-FR\ndiscap.sys.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\afunix.sys 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\de-DE\NdisImPlatform.sys.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\es-ES\NdisImPlatform.sys.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\gmreadme.txt 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\it-IT\ndiscap.sys.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\it-IT\wfplwfs.sys.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\ja-JP\ndiscap.sys.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\ja-JP\wfplwfs.sys.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\fr-FR\wfplwfs.sys.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\de-DE\wfplwfs.sys.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\en-US\ndiscap.sys.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\es-ES\ndiscap.sys.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\it-IT\NdisImPlatform.sys.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\uk-UA\NdisImPlatform.sys.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\en-US\wfplwfs.sys.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\gm.dls 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\ja-JP\NdisImPlatform.sys.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\de-DE\ndiscap.sys.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\en-US\NdisImPlatform.sys.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\es-ES\wfplwfs.sys.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\fr-FR\NdisImPlatform.sys.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Manipulates Digital Signatures 1 IoCs
Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
description ioc Process File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pwrshsip.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Loads dropped DLL 64 IoCs
pid Process 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found 3356 Process not Found -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops Chrome extension 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\manifest.json 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Pictures\Camera Roll\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Videos\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Videos\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Saved Games\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Libraries\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Downloaded Program Files\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Fonts\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Documents\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Pictures\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Searches\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Desktop\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Favorites\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Downloads\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Desktop\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Offline Web Pages\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\OneDrive\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\AccountPictures\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Documents\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Media\Desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\en-US\WsmSvc.dll.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\es-ES\tcmsetup.exe.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\ksproxy.ax 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Dism\es-ES\IntlProvider.dll.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\DriverStore\de-DE\ntprint.inf_loc 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Windows.Devices.Haptics.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppBackgroundTask\PS_BackgroundTask.cdxml 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\bthudtask.exe 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\d3d11on12.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\en-US\ActiveSyncProvider.dll.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\en-US\mciavi32.dll.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Speech\Engines\SR\it-IT\srloc.dll.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Speech_OneCore\Common\sapi_onecore.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\ja-JP\TestDtc.psd1 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetLbfo\MSFT_NetLbfoTeam.cdxml 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\WindowsOptionalFeatureSet\WindowsOptionalFeatureSet.psd1 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\dmprocessxmlfiltered.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\en-US\appmgmts.dll.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\es-ES\eapsimextdesktop.dll.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\es-ES\pubprn.vbs 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\es-ES\sndvol.exe.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\eventcreate.exe 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\fr-FR\avifil32.dll.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\fr-FR\quickassist.exe.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\ja\AuthFWWizFwk.Resources.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_PackageResource\es-ES\MSFT_PackageResource.schema.mfl 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\dot3ui.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\fr-FR\authfwgp.dll.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Windows.Internal.ShellCommon.PrintExperience.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Schemas\PSMaml\structureList.xsd 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\it-IT\IEAdvpack.dll.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\powershell.exe.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\c_GSM7.DLL 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\en-US\Licenses\OEM\Professional\license.rtf 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\es-ES\WinSATAPI.dll.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\de-DE\connect.dll.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\en-US\fixmapi.exe.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\es-ES\setup16.exe.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\es-ES\spp.dll.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\fr-FR\apphelp.dll.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\fr-FR\shwebsvc.dll.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\it-IT\DevDispItemProvider.dll.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\it-IT\iologmsg.dll.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Dism\es-ES\AssocProvider.dll.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\KBDINHIN.DLL 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Provisioning\provcmdlets.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\en-US\qdv.dll.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\F12\ja-JP\F12Script.dll.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\KBDBR.DLL 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\auditpol.exe 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\es-ES\svchost.exe.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\ja-JP\hgcpl.dll.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\de-DE\telephon.cpl.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\downlevel\api-ms-win-security-base-l1-1-0.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\ja-JP\rasgcw.dll.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\mprext.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\DeviceFlows.DataModel.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\MapControlStringsRes.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Utility\Microsoft.PowerShell.Utility.psm1 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\en-US\p2p.dll.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\fr-FR\cmcfg32.dll.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\it-IT\p2pnetsh.dll.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\ja-JP\shutdown.exe.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE.HXS 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libaribsub_plugin.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-96_contrast-white.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AlarmsBadge.contrast-black_scale-100.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-40.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\StopReproTraceIcon-glyph-e916.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\Square150x150Logo.scale-125.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square150x150Logo.scale-125.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\winsdkfb\Images\fb_blank_profile_portrait.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\icudtl.dat 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-pl.xrm-ms 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-30_contrast-black.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotsHubApp.BackgroundWorker.winmd 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\he-il\ui-strings.js 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\VoiceRecorderLargeTile.contrast-black_scale-125.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\LargeTile.scale-100_contrast-black.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-256.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\Microsoft.VisualBasic.Forms.resources.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\WindowsBase.resources.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\server_ok.gif 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\W6.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Microsoft.Support.SDK\Assets\VALoading.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\StoreLogo.scale-200_contrast-white.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNewNoteMedTile.scale-125.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\management\snmp.acl.template 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ul-oob.xrm-ms 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libvpx_plugin.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\StoreLogo.scale-100.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleLargeTile.scale-200.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\WindowsFormsIntegration.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-gb\ui-strings.js 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Trust Protection Lists\Sigma\Entities 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageWideTile.scale-125_contrast-black.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\images\Square71x71Logo.scale-200.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-64_altform-unplated.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-white\LargeTile.scale-200.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\Movie-TVStoreLogo.scale-100_contrast-black.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\LinkedInboxLargeTile.scale-150.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Resources.Writer.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ul-phn.xrm-ms 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNotePageLargeTile.scale-400.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-36_altform-unplated_contrast-white.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Handles.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-core-xstate-l2-1-0.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-40_altform-unplated.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-60_altform-unplated.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\AppIcon.targetsize-64_contrast-white.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-80_contrast-white.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\ResiliencyLinks\Locales\cs.pak.DATA 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Windows Photo Viewer\PhotoAcq.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\MicrosoftSolitaireAppList.targetsize-24_altform-unplated.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionMedTile.scale-400.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-40_altform-unplated_contrast-black.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppCS\MemMDL2.1.85.ttf 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\core_icons_retina.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\dxcompiler.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Trust Protection Lists\Mu\Advertising.DATA 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-tw\ui-strings.js 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\freebxml.md 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\OSFPROXY.DLL 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-256_altform-unplated_contrast-white.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Fonts\arial.ttf 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\1036\mscorsecr.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.Serialization.Primitives.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.ApplicationId.RuleWizard.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\ja-JP\PushToInstall.adml 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\ja-JP\SkyDrive.adml 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\ja-JP\TerminalServer.adml 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\JA\aspnet_regbrowsers.resources.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\App_LocalResources\WebAdminHelp_Provider.aspx.ja.resx 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\de\System.DirectoryServices.Protocols.resources.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\es\Microsoft.Workflow.Compiler.resources.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp_Application.aspx 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\it\System.Runtime.Remoting.resources.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SKB\LanguageModels\lm.en.dat 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Speech_OneCore\Engines\TTS\ja-JP\M1041Haruka.BR2 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Media\town.mid 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\wizardCreateRoles.ascx.fr.resx 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\SQL\it\SqlPersistenceProviderSchema.sql 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Users\findUsers.aspx 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\DE\System.Runtime.Remoting.Resources.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\JA\mscorrc.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\de\System.Windows.Presentation.resources.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fr\System.IdentityModel.resources.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Boot\Resources\en-US\bootres.dll.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\it\System.ComponentModel.DataAnnotations.resources.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands.Resources\v4.0_10.0.0.0_es_31bf3856ad364e35\Microsoft.SecureBoot.Commands.Resources.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\Sensors.admx 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\en-US\AllowBuildPreview.adml 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\ja-JP\Setup.adml 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Prefetch\RUNDLL32.EXE-AE5EC6E9.pf 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ImmersiveControlPanel\images\logo.scale-100_altform-lightunplated.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.ComponentModel.EventBasedAsync.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fr\System.Web.Services.resources.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\wvmic_ext.inf 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.JScript.tlb 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\webAdminButtonRow.master 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\ja\DropSqlPersistenceProviderSchema.sql 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\de\System.Data.DataSetExtensions.resources.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Prefetch\PfPre_7d37fba9.mkd 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Speech_OneCore\Engines\TTS\en-US\M1033Zira.SPEECHUX.NUS 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Transactions.Bridge.Dtc.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Channels.resources\v4.0_4.0.0.0_ja_31bf3856ad364e35\System.ServiceModel.Channels.resources.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\zh-TW_BitLockerToGo.exe.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Cursors\arrow_i.cur 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\SQL\it\SqlPersistenceService_Logic.sql 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Threading.Overlapped.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\es\System.RunTime.Serialization.resources.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_perf2.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Installer\$PatchCache$\Managed\00006109E70000000100000000F01FEC\16.0.12527\vccorlib140.dll_x64 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\it\System.Data.Services.Client.resources.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\App_LocalResources\security0.aspx.resx 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\DE\System.Configuration.Install.resources.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\th-TH_BitLockerToGo.exe.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ES\System.DirectoryServices.Resources.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\de\System.Messaging.resources.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\it\XsdBuildTask.resources.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\DefineErrorPage.aspx.resx 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\WindowsColorSystem.admx 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\PERFLIB\0C0A\perfd.dat 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Providers\App_LocalResources\chooseProviderManagement.aspx.it.resx 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\wizardAddUser.ascx.fr.resx 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe"1⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Drops startup file
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4880
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.2MB
MD5fa95791edb6f7f9e170e0ca8d39ab94b
SHA1c11c24fde0339d9a79830abccfcf15683fb21a54
SHA256f1551028c2b62804b1f93ec708ed2d11a240d1d1cb42d0b64ab5689d9490a1c2
SHA5121ccb82d9fbd8954ce4907a111417a4cd17a0520f15a3e51c7100da3baccfaaa99018a4ba7e857f6340db1519364cca05708da89bc11f02d3371fa122a5838af3
-
Filesize
4.4MB
MD5d69a71081fe1bb09f00a5af73a7dda98
SHA1f479a258b5dd574656b130df23cbbeecfbdc981f
SHA2562e03f3166fad0a3b11d9045aa9da64941e890dcae5073873d8c855a3014f5c36
SHA5127d93fef387e175a3b106b4e408ca37d6a3c0d95ab9f7a4be23619d9a4f5d442520bb24c8aef1fbb4227d7b3a9d49c70c804c01a380f53a2ef59d583981bc6959
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
Filesize5.8MB
MD517ae70a8bfe1ee11b83ca8189c409a61
SHA136092e0d5337a7ee70f6cbc0f83e9ae3b6fabcff
SHA2560c7ae7decd873e2e99a3165d0591fc9ccb75ece6bdcd54ba7e42da7d83d847cd
SHA5120143d9b14e453de40052723713c6226cbb220f3617dd10f24980f8db220e1cf08c9d286cd4d6351b3b62dda9c54c941cab96d3cd1821c8d181ec1c362aefcf75