Analysis
-
max time kernel
150s -
max time network
103s -
platform
windows11-21h2_x64 -
resource
win11-20250508-en -
resource tags
arch:x64arch:x86image:win11-20250508-enlocale:en-usos:windows11-21h2-x64system -
submitted
19/05/2025, 14:42
Behavioral task
behavioral1
Sample
2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe
Resource
win11-20250508-en
General
-
Target
2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe
-
Size
4.2MB
-
MD5
a818eb5064fa0c5a4929baf32832853c
-
SHA1
b01570952a997a9f2ef84d1a17f06bf54e93477f
-
SHA256
0a6d055a00f21b3044aed28427d2cd4aadda46c986af2a1390c5e06af36fcf34
-
SHA512
6640668b498c04f44f4853f5ec861d02a84183ab8c158fc027d3eee66b136c6710a705e26e6aefda4ecbb663be5547f299ab710233e66a5689b751f38ead1393
-
SSDEEP
49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q4y:ieF+iIAEl1JPz212IhzL+Bzz3dw/VNe
Malware Config
Signatures
-
Gofing
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
-
Gofing family
-
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation. 3 IoCs
resource yara_rule behavioral2/files/0x000300000002a23c-4.dat family_gofing behavioral2/files/0x00020000000297d4-5475.dat family_gofing behavioral2/files/0x000200000002980d-5498.dat family_gofing -
Renames multiple (52) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Drivers directory 22 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\fr-FR\wfplwfs.sys.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\ja-JP\ndiscap.sys.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\uk-UA\NdisImPlatform.sys.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\de-DE\NdisImPlatform.sys.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\de-DE\wfplwfs.sys.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\en-US\NdisImPlatform.sys.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\it-IT\wfplwfs.sys.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\ja-JP\NdisImPlatform.sys.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\ja-JP\wfplwfs.sys.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\fr-FR\ndiscap.sys.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\gm.dls 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\en-US\ndiscap.sys.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\es-ES\NdisImPlatform.sys.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\es-ES\ndiscap.sys.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\es-ES\wfplwfs.sys.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\fr-FR\NdisImPlatform.sys.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\gmreadme.txt 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\it-IT\NdisImPlatform.sys.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\it-IT\ndiscap.sys.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\afunix.sys 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\de-DE\ndiscap.sys.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\en-US\wfplwfs.sys.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Manipulates Digital Signatures 2 IoCs
Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
description ioc Process File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pwrshsip.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\wintrust.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Executes dropped EXE 1 IoCs
pid Process 3192 Process not Found -
Loads dropped DLL 47 IoCs
pid Process 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops Chrome extension 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\manifest.json 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File created C:\Users\Admin\Pictures\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Downloaded Program Files\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Music\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Videos\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Favorites\Links\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Downloads\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Saved Games\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Videos\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Offline Web Pages\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\OneDrive\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Searches\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\AccountPictures\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Music\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Media\Desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Fonts\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Pictures\Camera Roll\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-UX-UI-merged-Package~31bf3856ad364e35~amd64~en-US~10.0.22000.1.cat 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Client-License-Platform-Device-Licensing-Service-Package~31bf3856ad364e35~amd64~it-IT~10.0.22000.1.cat 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\D3D12Core.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-TerminalServices-AppCompat-Opt-Package~31bf3856ad364e35~amd64~en-US~10.0.22000.1.cat 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-WMPNetworkSharingService-Opt-WOW64-Package~31bf3856ad364e35~amd64~it-IT~10.0.22000.1.cat 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-msmq-dcomproxy-Opt-WOW64-Package~31bf3856ad364e35~amd64~~10.0.22000.1.cat 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\KBDGEO.DLL 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\MSFlacDecoder.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PrintManagement\MSFT_PrinterDriver.format.ps1xml 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\es-ES\rpcping.exe.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Embedded-UnifiedWriteFilterCSP-Package~31bf3856ad364e35~amd64~it-IT~10.0.22000.1.cat 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Media-Streaming-Package~31bf3856ad364e35~amd64~uk-UA~10.0.22000.1.cat 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Not-Supported-On-LTSB-Package~31bf3856ad364e35~amd64~it-IT~10.0.22000.1.cat 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\MultiPoint-Tools-Opt-Package~31bf3856ad364e35~amd64~it-IT~10.0.22000.1.cat 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\KBDDIV1.DLL 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\de-DE\mstask.dll.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\fr-FR\ieunatt.exe.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\wbem\de\Microsoft.AppV.AppVClientWmi.resources.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\C_10003.NLS 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Vpci-VirtualDevice-Gpup-Package~31bf3856ad364e35~amd64~~10.0.22000.318.cat 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-FCI-Client-Package~31bf3856ad364e35~amd64~ja-JP~10.0.22000.1.cat 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Legacy-Components-OC-Package~31bf3856ad364e35~amd64~en-US~10.0.22000.1.cat 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Dism\EdgeProvider.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ProcessResource\uk-UA\MSFT_ProcessResource.strings.psd1 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\wbem\en-US\mof.xsl 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\wbem\it-IT\netnccim_uninstall.mfl 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\AppExtension.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-LegacyChipset-merged-Package~31bf3856ad364e35~amd64~~10.0.22000.194.cat 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Onecore-SPP-VirtualDevice-Package~31bf3856ad364e35~amd64~~10.0.22000.493.cat 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\KBDTAJIK.DLL 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\takeown.exe 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\uk-UA\DeviceSetupStatusProvider.dll.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\ActiveSyncCsp.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Casting-Platform-merged-Package~31bf3856ad364e35~amd64~~10.0.22000.1.cat 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0113~31bf3856ad364e35~amd64~en-US~10.0.22000.318.cat 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-TextPrediction-Package~31bf3856ad364e35~amd64~es-ES~10.0.22000.1.cat 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\DataExchange.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\UserDataAccessRes.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\en\Microsoft.AppV.AppVClientPowerShell.resources.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\ctl3d32.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\de-DE\wldap32.dll.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Composable-PlatformExtension-AccountsControlExperienceModal-Package~31bf3856ad364e35~amd64~~10.0.22000.120.cat 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-CoreSystem-RemoteFS-Client-Package~31bf3856ad364e35~amd64~ja-JP~10.0.22000.1.cat 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Desktop-Required-ClientOnly-Removable-Package~31bf3856ad364e35~amd64~~10.0.22000.318.cat 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\de-DE\Windows.Internal.SecurityMitigationsBroker.dll.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\fsutil.exe 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\secproc_isv.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\AuthFWGP.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Onecore-Identity-TenantRestrictions-Package~31bf3856ad364e35~amd64~it-IT~10.0.22000.1.cat 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-DirectoryServices-ADAM-Snapins-Group-Package~31bf3856ad364e35~amd64~uk-UA~10.0.22000.1.cat 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-FCI-Client-Package~31bf3856ad364e35~amd64~es-ES~10.0.22000.1.cat 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-MSPaint-FoD-Package~31bf3856ad364e35~amd64~fr-FR~10.0.22000.1.cat 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\ja-JP\Apphlpdm.dll.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\ntdll.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\srmclient.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\wbem\uk-UA\wscenter.mfl 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\C_20003.NLS 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-DataCenterBridging-Package~31bf3856ad364e35~amd64~es-ES~10.0.22000.1.cat 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Multimedia-RestrictedCodecsCore-WOW64-Package~31bf3856ad364e35~amd64~es-ES~10.0.22000.1.cat 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\InkEd.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Multimedia-RestrictedCodecs-WOW64-merged-Package~31bf3856ad364e35~amd64~~10.0.22000.282.cat 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-StorageService-Package~31bf3856ad364e35~amd64~it-IT~10.0.22000.1.cat 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\fr-FR\netcenter.dll.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\System\Ole DB\msdaorar.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ppd.xrm-ms 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-ul-oob.xrm-ms 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.scale-200.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.contrast-black_targetsize-60.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\AppIcon.targetsize-24_altform-unplated_contrast-black.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-96.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\merge-styles\dist\merge-styles.js 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\1949_24x24x32.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ppd.xrm-ms 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-ul-oob.xrm-ms 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\MySite.ico 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\System.Text.Encoding.Extensions.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-amd\components\ComboBox\ComboBox.classNames.js 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailFirstRunLogo.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.Cryptography.Encoding.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Threading.AccessControl.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\strings.resjson 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\Assets\contrast-black\StoreLogo.scale-150_contrast-black.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\cloud_secured_lg.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\Locales\ta.pak 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Grace-ul-oob.xrm-ms 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\System.Security.Cryptography.Encoding.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsWideTile.scale-100_contrast-black.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Text.Encoding.Extensions.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\selector.js 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDFImpl64.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Java\jre-1.8\lib\tzdb.dat 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\STSUPLD.DLL 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\dxcompiler.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Engine.resources.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-180.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Mozilla Firefox\mozavcodec.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Images\PowerAutomateSquare70x70Logo.scale-80.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\AppxSignature.p7x 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\AppIcon.targetsize-256_contrast-white.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\Tentative.scale-125.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Parallel.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ppd.xrm-ms 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vreg\office.x-none.msi.16.x-none.vreg.dat 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_neutral_split.scale-200_8wekyb3d8bbwe\Win10\contrast-black\MicrosoftSolitaireLargeTile.scale-200_contrast-black.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\PaintWideTile.scale-200.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-16_altform-lightunplated_contrast-white.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.OpenSsl.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-variant2-2x.gif 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\Locales\fil.pak 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Windows Media Player\ja-JP\wmpnscfg.exe.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-80_contrast-white.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-24_altform-lightunplated_contrast-black.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationClientSideProviders.resources.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sk-sk\ui-strings.js 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\edge_game_assist\VERSION 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\S-1-5-21-3687046934-3833731302-526866946-1000-MergedResources-0.pri 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\StoreStoreLogo.scale-100.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-convert-l1-1-0.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Java\jre-1.8\bin\wsdetect.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Mozilla Firefox\libGLESv2.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\paintpicture.targetsize-16.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\AppxManifest.xml 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\Assets\contrast-white\CameraAppList.targetsize-30.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\contrast-black\NotepadAppList.targetsize-60.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsFormsIntegration.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fr\System.Activities.Core.Presentation.resources.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices.Protocols\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap.resources\v4.0_4.0.0.0_es_b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.resources.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xaml.Hosting.resources\v4.0_4.0.0.0_fr_31bf3856ad364e35\System.Xaml.Hosting.resources.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\it-IT\DeviceGuard.adml 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\ja-JP\MobilePCPresentationSettings.adml 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Fonts\GlobalSerif.CompositeFont 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\ServiceModelService 3.0.0.0\0407\_ServiceModelServicePerfCounters_D.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\CacheSize.txt 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Media\Alarm02.wav 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\es\DataSvcUtil.resources.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\dv_aspnetmmc.chm 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fr\System.IO.Compression.resources.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ja\System.RunTime.Serialization.resources.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Boot\PCAT\tr-TR\bootmgr.exe.mui 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\fr\System.DirectoryServices.Protocols.resources.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regsvcs.exe.config 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Design.resources\v4.0_4.0.0.0_es_b03f5f7f11d50a3a\System.Design.resources.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\en-US\InkWatson.adml 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfc100rus_x64 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\aspnet_regsql.resources.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Panther\setup.etl 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\es-ES\AppPrivacy.adml 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ImmersiveControlPanel\images\Contact.png 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\JA\System.Security.Resources.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fr\system.data.sqlxml.resources.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Presentation.resources\v4.0_4.0.0.0_fr_b77a5c561934e089\System.Windows.Presentation.resources.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\en-US\SkyDrive.adml 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Prefetch\RUNDLL32.EXE-5B70F332.pf 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AXE8SharedExpat.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\msbuild.exe.config 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\App_LocalResources\WebAdminHelp.aspx.resx 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Boot\PCAT\bootnxt 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\SMSvcHost 4.0.0.0\040C\_SMSvcHostPerfCounters_d.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\prnms013.inf 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\es\Microsoft.Build.Tasks.resources.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\NlsData0007.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\de\System.Data.Services.Design.resources.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\v4.0_10.0.0.0_fr_31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Reflection.Context.resources\v4.0_4.0.0.0_de_b77a5c561934e089\System.Reflection.Context.resources.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\fr\System.Transactions.resources.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\Users\App_LocalResources\addUser.aspx.es.resx 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WindowsBase.resources\v4.0_4.0.0.0_ja_31bf3856ad364e35\WindowsBase.resources.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\TAPISRV\0407\tapiperf.ini 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\mdmcpv.inf 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\mdmsupr3.inf 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fr\System.Data.Services.Design.resources.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ja\System.Workflow.Activities.resources.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.SecureBoot.Commands.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data.OracleClient\v4.0_4.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Fonts\DUBAI-BOLD.TTF 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\mdmmhzel.inf 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Media\Windows Startup.wav 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\PresentationFramework-SystemXml.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Fonts\framd.ttf 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Logs\WindowsUpdate\WindowsUpdate.20250508.121003.989.1.etl 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Device.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Web.Entity.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.tlb 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\MUI\0409\mscorsecr.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\fr\System.Configuration.Install.resources.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\fr\SMDiagnostics.resources.dll 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\mdmusrg.inf 2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2025-05-19_a818eb5064fa0c5a4929baf32832853c_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe"1⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Drops startup file
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:1400
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.2MB
MD586982cb1882bee72890799cd1f7f4f30
SHA1b1436cad59759717e02f45bf2c52a40b122b5fd1
SHA2563715ebe17fa688ab609394d3f195468439f641e87a9b6bf1b2cc1052fb0a8b19
SHA512283dbfc789fbff2062d5cffdc8f89fa0a854bc69c29c502cfadbeb873544fd7863206fdc2386bcf177a55392e584bf06761fa37b6c73ad64deb375b5d9805a93
-
Filesize
4.4MB
MD5d3a297ed59fdecf0411bab369b7e5997
SHA19a5cd27e74382f3c066229bf168f49f035aa687c
SHA256b7b4d6b66de569eb78032236455e98bc36ea35019e698e4c670115abcc08800b
SHA512011f58ac10ea16be9f2f93b47b6e514fbb6c6ecb9b239f6404e4aaa587f1bdecef3646ffacda4d2ea42337b1f4bb29667f85ef2e2b52cd480795703c5f357d14
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
Filesize5.8MB
MD50d51d19605a454e1999521d335ab2f64
SHA17c3dd86c48a8ff6b0dd388c4ce1912bf6c5f8913
SHA256d8c2a56451b781fff97c060772a32faa8964c03630d8b5158a3d2ecf800f28cb
SHA5121a7f8abb219146b0eb313701d3ecb5afed15e274a25eabd68dd8df4f13a13a7321f070e15f1e862d44b8506d6b6e103cc0c251527632a47958539d4eaccfa67d