Analysis
-
max time kernel
150s -
max time network
105s -
platform
windows11-21h2_x64 -
resource
win11-20250508-en -
resource tags
arch:x64arch:x86image:win11-20250508-enlocale:en-usos:windows11-21h2-x64system -
submitted
19/05/2025, 14:52
Behavioral task
behavioral1
Sample
2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe
Resource
win11-20250508-en
General
-
Target
2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe
-
Size
4.2MB
-
MD5
b4c01a7bb82133671d1de6aa357bc1d7
-
SHA1
6be490181cacc3fa25a245008e70003f25c0a0b8
-
SHA256
f246897aa86b4318d9bf6c9fd3436e7716eddca951ba8d5afb2eb3439dcb0010
-
SHA512
d4b4dfb07f434c4e6eca19cbc915d60437183917840a7b47dce78dd11e22a168d444bc3c628b58aa9b1dd60cea17cac153bbac8f29b60a563ef9111c15a215b7
-
SSDEEP
49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q4M:ieF+iIAEl1JPz212IhzL+Bzz3dw/Vy
Malware Config
Signatures
-
Gofing
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
-
Gofing family
-
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation. 2 IoCs
resource yara_rule behavioral2/files/0x000300000002a23c-4.dat family_gofing behavioral2/files/0x00020000000297d4-5471.dat family_gofing -
Renames multiple (52) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Drivers directory 22 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\fr-FR\wfplwfs.sys.mui 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\gm.dls 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\de-DE\ndiscap.sys.mui 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\en-US\ndiscap.sys.mui 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\en-US\wfplwfs.sys.mui 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\es-ES\wfplwfs.sys.mui 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\gmreadme.txt 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\ja-JP\NdisImPlatform.sys.mui 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\afunix.sys 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\de-DE\wfplwfs.sys.mui 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\ja-JP\wfplwfs.sys.mui 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\uk-UA\NdisImPlatform.sys.mui 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\de-DE\NdisImPlatform.sys.mui 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\en-US\NdisImPlatform.sys.mui 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\es-ES\NdisImPlatform.sys.mui 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\fr-FR\ndiscap.sys.mui 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\it-IT\NdisImPlatform.sys.mui 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\it-IT\wfplwfs.sys.mui 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\es-ES\ndiscap.sys.mui 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\fr-FR\NdisImPlatform.sys.mui 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\it-IT\ndiscap.sys.mui 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\ja-JP\ndiscap.sys.mui 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Manipulates Digital Signatures 2 IoCs
Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
description ioc Process File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pwrshsip.dll 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\wintrust.dll 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Executes dropped EXE 1 IoCs
pid Process 3276 Process not Found -
Loads dropped DLL 44 IoCs
pid Process 3276 Process not Found 3276 Process not Found 3276 Process not Found 3276 Process not Found 3276 Process not Found 3276 Process not Found 3276 Process not Found 3276 Process not Found 3276 Process not Found 3276 Process not Found 3276 Process not Found 3276 Process not Found 3276 Process not Found 3276 Process not Found 3276 Process not Found 3276 Process not Found 3276 Process not Found 3276 Process not Found 3276 Process not Found 3276 Process not Found 3276 Process not Found 3276 Process not Found 3276 Process not Found 3276 Process not Found 3276 Process not Found 3276 Process not Found 3276 Process not Found 3276 Process not Found 3276 Process not Found 3276 Process not Found 3276 Process not Found 3276 Process not Found 3276 Process not Found 3276 Process not Found 3276 Process not Found 3276 Process not Found 3276 Process not Found 3276 Process not Found 3276 Process not Found 3276 Process not Found 3276 Process not Found 3276 Process not Found 3276 Process not Found 3276 Process not Found -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops Chrome extension 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\manifest.json 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\OneDrive\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Links\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Libraries\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Offline Web Pages\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Documents\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Downloads\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Documents\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Downloaded Program Files\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Media\Desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Saved Games\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Searches\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\AccountPictures\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Favorites\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Music\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Pictures\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\en-US\PerceptionSimulationSixDofModels.inf_loc 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\ja-JP\ks.inf_loc 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\ELSCore.dll 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\es-ES\odbcji32.dll.mui 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\it-IT\webcheck.dll.mui 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-ShareMedia-ControlPanel-Package~31bf3856ad364e35~amd64~fr-FR~10.0.22000.1.cat 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\ja-JP\1394.inf_loc 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\ucmhc.dll 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\Configuration\BaseRegistration\MSFT_DSCMetaConfiguration.mof 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\FileRepository\acpitime.inf_amd64_4456a4584af0a603\acpitime.sys 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetworkTransition\MSFT_NetIpHTTPsConfiguration.cdxml 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\it-IT\wstorflt.inf_loc 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\AuthFWSnapin.dll 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-ConfigCI-Package~31bf3856ad364e35~amd64~ja-JP~10.0.22000.1.cat 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmaiwa3.inf_amd64_128a51f285ab9a86\mdmaiwa3.inf 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\Hydrogen\BakedPlugins\Physics\presetbodyqualitytrianglewelding.hbakedbodyquality 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAny\MSFT_WaitForAny.schema.mof 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\AppVReporting.dll 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-ConfigCI-Onecore-Package~31bf3856ad364e35~amd64~it-IT~10.0.22000.1.cat 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\FileRepository\xboxgipsynthetic.inf_amd64_f322983f46cb84b4\xboxgipsynthetic.inf 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\de-DE\iaLPSS2i_GPIO2_SKL.inf_loc 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\UserDeviceRegistration.dll 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\de-DE\wuapi.dll.mui 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\wbem\fr-FR\MMFUtil.dll.mui 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-ProfessionalEdition~31bf3856ad364e35~amd64~~10.0.22000.493.cat 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\Dism\fr-FR\ImagingProvider.dll.mui 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\es-ES\acpipmi.inf_loc 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\en-US\UserDeviceRegistration.dll.mui 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\ActionCenterCPL.dll_BUP 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-DataCenterBridging-WOW64-Package~31bf3856ad364e35~amd64~ja-JP~10.0.22000.1.cat 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-InternetExplorer-Required-Package~31bf3856ad364e35~amd64~fr-FR~11.0.22000.1.cat 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\en-US\prm.inf_loc 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\F12\en-US\IEChooser.exe.mui 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\wbem\mofd.dll 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-VmBus-VirtualDevice-merged-Package~31bf3856ad364e35~amd64~fr-FR~10.0.22000.1.cat 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-ConsentUx-Package~31bf3856ad364e35~amd64~~10.0.22000.1.cat 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-Common-Package~31bf3856ad364e35~amd64~ja-JP~10.0.22000.1.cat 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-EmbeddedExp-WOW64-Package~31bf3856ad364e35~amd64~fr-FR~10.0.22000.1.cat 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\de-DE\ivfsrc.ax.mui 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\it-IT\WF.msc 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\wbem\portabledevicetypes.mof 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\Boot\es-ES\winload.exe.mui 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-EmbeddedExp-WOW64-Package~31bf3856ad364e35~amd64~it-IT~10.0.22000.1.cat 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetQos\MSFT_NetQosPolicy.Format.ps1xml 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\Com\fr-FR\comrepl.exe.mui 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\fr-FR\wvmic_guestinterface.inf_loc 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\MaintenanceUI.dll 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\de-DE\devmgmt.msc 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\es-ES\searchfolder.dll.mui 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Internet-Browser-Package~31bf3856ad364e35~amd64~~10.0.22000.120.cat 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Multimedia-MFCore-WCOSMinusHeadless-Package~31bf3856ad364e35~amd64~ja-JP~10.0.22000.1.cat 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\mfc140deu.dll 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0010~31bf3856ad364e35~amd64~en-US~10.0.22000.282.cat 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\IME\IMEJP\IMJPRANKER.DLL 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\Microsoft.Uev.ModernAppAgent.dll 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\msidle.dll 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-PortableWorkspaces-Package~31bf3856ad364e35~amd64~~10.0.22000.1.cat 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Printing-XpsDocumentWriter-Opt-Package~31bf3856ad364e35~amd64~it-IT~10.0.22000.1.cat 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\en-US\input.inf_loc 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForSome\es-ES\MSFT_WaitForSome.schema.mfl 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\downlevel\api-ms-win-core-namedpipe-l1-1-0.dll 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\dsquery.dll 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\hu-HU\quickassist.exe.mui 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\spp\tokens\skus\csvlk-pack\csvlk-pack-Volume-CSVLK-8-ul-phn-rtm.xrm-ms 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\Assets\TipsAppList.targetsize-64_altform-unplated_contrast-black.png 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-64_altform-unplated_contrast-black.png 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-amd\math.js 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ul-oob.xrm-ms 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Mso98win32client.dll 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SyncFusion.Grid.Grouping.Windows.dll 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\th-TH\PAD.Console.Host.resources.dll 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ReachFramework.dll 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sv-se\ui-strings.js 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\de-DE\msdaorar.dll.mui 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\microsoft_shell_integration.dll 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PaintAppList.targetsize-32_altform-unplated.png 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-amd\MarqueeSelection.js 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib\localStorage.js 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\Be.Tests.ps1 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.resources.dll 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_sendforcomments_18.svg 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Common Files\System\msadc\msdarem.dll 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-96_altform-unplated.png 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\LensSDK\Assets\Icons\icon_play_prs.png 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-24.png 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-64_altform-lightunplated.png 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationClientSideProviders.resources.dll 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\BeLessThan.Tests.ps1 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\nunit_schema_2.5.xsd 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-ppd.xrm-ms 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-pl.xrm-ms 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\Assets\Store\LargeTile.scale-200.png 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\OutlookMailBadge.scale-100.png 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\Locales\bs.pak 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\it\Microsoft.PowerShell.PackageManagement.resources.dll 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\manifest.xml 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\1033\BHOINTL.DLL 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCalculator_10.2012.21.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\CalculatorStoreLogo.scale-125.png 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\Assets\chatemail.png 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\contrast-black\NotepadLargeTile.scale-150.png 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\contrast-white\NotepadWideTile.scale-400.png 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ppd.xrm-ms 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-crt-locale-l1-1-0.dll 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\Assets\TipsSplashScreen.scale-100_contrast-black.png 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\SplashScreen.scale-200_contrast-white.png 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\components\DocumentCard\DocumentCard.types.js 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\OutlookMailWideTile.scale-125.png 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.Extensions.dll 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationClient.resources.dll 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Java\jre-1.8\bin\wsdetect.dll 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GetHelp_10.2008.32311.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GetHelpBadgeLogo.scale-125.png 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\Theme_Photo_Watercolor_Background_Dark.jpg 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Advanced-Light.scale-300.png 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\s_close.png 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationProvider.dll 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\NotepadAppList.targetsize-80_altform-unplated.png 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_editpdf_18.svg 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\Assets\TipsAppList.targetsize-40_contrast-white.png 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\Assets\PhotosLargeTile.contrast-black_scale-200.png 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Logo.scale-100.png 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\de-de\ui-strings.js 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\WhatsNew.Store.dll 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\SnippingTool\Assets\Square44x44Logo.targetsize-16_altform-unplated.png 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-20_altform-unplated_contrast-white.png 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-commonjs\Async.js 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Classic.dll 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\1031\cscui.dll 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\it\Tracking_Schema.sql 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fr\Microsoft.Build.Conversion.v4.0.resources.dll 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets.Resources\v4.0_1.0.0.0_fr_31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.Resources.dll 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\ja-JP\WindowsConnectNow.adml 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Fonts\ega40737.fon 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\SQL\ja\SqlPersistenceProviderSchema.sql 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fr\System.Activities.resources.dll 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fr\aspnet_regsql.resources.dll 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\napinit.resources\v4.0_10.0.0.0_de_31bf3856ad364e35\napinit.Resources.dll 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\de-DE\LocationProviderAdm.adml 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Prefetch\RUNDLL32.EXE-56E309E9.pf 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SKB\LanguageModels\lm.en-AU.dat 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\hal.inf 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\wstorflt.inf 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\App_LocalResources\WebAdminHelp_Internals.aspx.resx 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\webAdminNoButtonRow.master 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\de-DE\WinCal.adml 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\en-US\FramePanes.adml 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\it-IT\MSDT.adml 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Prefetch\SEARCHFILTERHOST.EXE-77482212.pf 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\mdm5674a.inf 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfc100esn_x64 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\fr-FR\DmaGuard.adml 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Cursors\arrow_r.cur 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\.NET CLR Data\0C0A\_DataPerfCounters_d.ini 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\usbstor.PNF 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adoberfp.dll 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\CreateAppSetting.aspx.ja.resx 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Providers\App_LocalResources\chooseProviderManagement.aspx.es.resx 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Xml.XPath.XDocument.dll 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Cursors\person_r.cur 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\c_mouse.inf 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\System.EnterpriseServices.Resources.dll 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\wizardPermission.ascx.it.resx 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\it\SqlPersistenceService_Schema.sql 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ja\System.Core.resources.dll 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.KeyDistributionService.Cmdlets.Resources\v4.0_10.0.0.0_it_31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.Resources.dll 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_7d58b7de-fc14-4db3-8130-ea4cbe32dfd1 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Cursors\aero_link_i.cur 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\netl1c63x64.inf 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\CreateAppSetting.aspx.es.resx 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Luna\v4.0_4.0.0.0__31bf3856ad364e35\PresentationFramework.Luna.dll 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.Composition.resources\v4.0_4.0.0.0_de_b77a5c561934e089\System.ComponentModel.Composition.resources.dll 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PLA\Rules\Rules.System.Performance.xml 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\ja-JP\Logon.adml 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Prefetch\ReadyBoot\ReadyBoot.etl 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\netvwifibus.inf 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscordbc.dll 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\web_hightrust.config 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\EditAppSetting.aspx.resx 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\fr-FR\EnhancedStorage.adml 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Prefetch\PSEXEC.EXE-80F89DAE.pf 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Speech_OneCore\Engines\TTS\en-US\M1033Eva.NNM 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\mdmlasno.inf 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Permissions\App_LocalResources\createPermission.aspx.ja.resx 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\DE\shfusion.chm 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMdiagnostics.dll 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Data.Entity.dll 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\v4.0_1.0.0.0_it_31bf3856ad364e35\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Controls.Ribbon\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Controls.Ribbon.dll 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Cursors\cross_i.cur 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Media\Windows Startup.wav 2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2025-05-19_b4c01a7bb82133671d1de6aa357bc1d7_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe"1⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Drops startup file
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:752
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.2MB
MD5450f4d1b6d1125da9136a37d0d625425
SHA181d38c101df3ee6e49ca298aa454b9cf96050f3e
SHA25674e66ba58005cc2f72505991733b6431785f3d4baee2dbcca5d968b6a81cdb30
SHA5122e32ce92703c06cb82a0d694af1660c69fc22137c46acecac3cd918fb4d2db513e5c13bc08f255ffe9588b6b1cbd07f43ad2eec5e773f62bb385d7654df0a923
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
Filesize5.8MB
MD50bcd8078b4f2270a6f38b63f39341417
SHA189b1ecce0a0d686dfc573108b32ce9b6828b5b93
SHA256500d7982640cbe760816ea2025f3220010a2bb9da836ec6b6d1683555852c2c0
SHA5124f061d424304425cf9aae265fbed6153c92e233cec5629235e2b1d0d50409fd37c3dad03bba6e70643e2c232d77ff0e88e89c6fceae4cd0cf8c49299c19b2ed4