Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20250502-en -
resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system -
submitted
19/05/2025, 14:15
Behavioral task
behavioral1
Sample
2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe
Resource
win11-20250502-en
General
-
Target
2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe
-
Size
4.2MB
-
MD5
89ce1c4c62a5af18056e920e1a19d1e2
-
SHA1
8f9ce8a49444f2214f1cce130312821ba1020de3
-
SHA256
47a7bc388abe591e33fc5626fd252c42dd4835d021c24a313ad1ff2ac9605f83
-
SHA512
c83d390c057a42b316cee1df14baa378cfd4cca2eb358e6d852462dd0471c309ba5c8503ffb1440319487ec946def474e6cc162659e4fad8626548f3be46757f
-
SSDEEP
49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q48:ieF+iIAEl1JPz212IhzL+Bzz3dw/VGx
Malware Config
Signatures
-
Gofing
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
-
Gofing family
-
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation. 3 IoCs
resource yara_rule behavioral1/files/0x0003000000022a6e-4.dat family_gofing behavioral1/files/0x0002000000021d6b-5463.dat family_gofing behavioral1/files/0x0002000000021d8e-5480.dat family_gofing -
Drops file in Drivers directory 22 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\es-ES\NdisImPlatform.sys.mui 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\fr-FR\ndiscap.sys.mui 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\gmreadme.txt 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\it-IT\wfplwfs.sys.mui 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\es-ES\ndiscap.sys.mui 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\es-ES\wfplwfs.sys.mui 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\ja-JP\ndiscap.sys.mui 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\fr-FR\wfplwfs.sys.mui 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\de-DE\ndiscap.sys.mui 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\fr-FR\NdisImPlatform.sys.mui 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\it-IT\NdisImPlatform.sys.mui 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\it-IT\ndiscap.sys.mui 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\uk-UA\NdisImPlatform.sys.mui 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\de-DE\NdisImPlatform.sys.mui 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\en-US\NdisImPlatform.sys.mui 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\gm.dls 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\ja-JP\NdisImPlatform.sys.mui 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\ja-JP\wfplwfs.sys.mui 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\afunix.sys 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\de-DE\wfplwfs.sys.mui 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\en-US\ndiscap.sys.mui 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\en-US\wfplwfs.sys.mui 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Manipulates Digital Signatures 1 IoCs
Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
description ioc Process File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pwrshsip.dll 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Loads dropped DLL 64 IoCs
pid Process 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found 3420 Process not Found -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops Chrome extension 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\manifest.json 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File created C:\Users\Public\Downloads\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Libraries\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Music\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Fonts\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Media\Desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Desktop\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Favorites\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Links\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\$Recycle.Bin\S-1-5-21-3920234085-916416549-2700794571-1000\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Videos\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Documents\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Pictures\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Pictures\Camera Roll\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Contacts\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Favorites\Links\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Desktop\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\OneDrive\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\3D Objects\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Downloads\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Saved Games\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\default.help.txt 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\de-DE\g711codc.ax.mui 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\de-DE\iyuv_32.dll.mui 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\dmenrollengine.dll 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\eventcreate.exe 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\fr-FR\cmdl32.exe.mui 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_GroupResource\ja-JP\MSFT_GroupResource.strings.psd1 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\boot.sdi 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\en-US\jscript.dll.mui 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\es-ES\rpcnsh.dll.mui 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\PaymentMediatorServiceProxy.dll 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\chartv.dll 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\en-US\netcenter.dll.mui 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\en-US\rstrui.exe.mui 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\IndexedDbLegacy.dll 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\bthprops.cpl 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\en-US\eapsimextdesktop.dll.mui 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Windows.Internal.UI.Shell.WindowTabManager.dll 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Dism\en\Microsoft.Dism.Powershell.Resources.dll 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\es-ES\listsvc.dll.mui 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\AuthFWWizFwk.dll 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Dism\es-ES\CbsProvider.dll.mui 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\de-DE\sxs.dll.mui 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\en-US\mmc.exe.mui 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetworkConnectivityStatus\MSFT_DAConnectionStatus.types.ps1xml 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WindowsOptionalFeature\MSFT_WindowsOptionalFeature.schema.mof 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\WindowsOptionalFeatureSet\WindowsOptionalFeatureSet.psd1 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\iSCSI\iSCSISession.cdxml 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\de-DE\at.exe.mui 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\DDORes.dll 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Com\en-US\comrepl.exe.mui 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Dism\ja-JP\ProvProvider.dll.mui 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Windows.Media.Protection.PlayReady.dll 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\downlevel\API-MS-Win-Security-Lsalookup-L2-1-1.dll 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\dxtrans.dll 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\es-ES\MFC40u.dll.mui 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\es-ES\appmgr.dll.mui 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Nlsdl.dll 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\ja-JP\pubprn.vbs 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Speech\SpeechUX\sapi.cpl 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Storage\FileServer.cdxml 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\es-MX\windows.ui.xaml.dll.mui 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Dism\it-IT\VhdProvider.dll.mui 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetEventPacketCapture\MSFT_NetEventVmNetworkAdatper.cdxml 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\es-ES\g711codc.ax.mui 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Dism\ja-JP\CbsProvider.dll.mui 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_EnvironmentResource\MSFT_EnvironmentResource.schema.mof 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\cmstp.exe 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\es-ES\DevicePairing.dll.mui 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\fr-FR\perfhost.exe.mui 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\TestDtc.psm1 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ScriptResource\uk-UA\MSFT_ScriptResource.schema.mfl 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\de-DE\winmsipc.dll.mui 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\en-US\html.iec.mui 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\KBDSYR2.DLL 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\en-US\DeviceDisplayStatusManager.dll.mui 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\SyncHost.exe 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\es-ES\msmpeg2enc.dll.mui 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\SCardDlg.dll 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\XPSViewer\es-ES\XPSViewer.exe.mui 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\de-DE\netcenter.dll.mui 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\fr-FR\els.dll.mui 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptyView.scale-100.png 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationCore.resources.dll 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ko-kr\ui-strings.js 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-phn.xrm-ms 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\AdeModule.dll 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Services.Client.resources.dll 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\InsiderHubSplashWideTile.scale-125_contrast-black.png 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubMedTile.scale-200_contrast-high.png 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-125_8wekyb3d8bbwe\resources.pri 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Yahoo-Dark.scale-100.png 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightItalic.ttf 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-180.png 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-140.png 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\NewCommentRTL.White.png 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\LargeTile.scale-400.png 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxSignature.p7x 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNotebookLargeTile.scale-200.png 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-80_contrast-white.png 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-40.png 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.Upgrade.dll 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.2.2_2.2.27405.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TextWriterTraceListener.dll 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\System.Xaml.resources.dll 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\index_poster.jpg 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\132.0.2957.140.manifest 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-pl.xrm-ms 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxSignature.p7x 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\seqchk10imm.dll 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\Microsoft.PackageManagement.MetaProvider.PowerShell.dll 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\server_lg.gif 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\core_icons_retina.png 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Trust Protection Lists\Sigma\Other 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\LargeTile.scale-400_contrast-white.png 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosLogoExtensions.targetsize-63.png 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ppd.xrm-ms 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\DSMESSAGES.XML 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\db2v0801.xsl 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\AppxSignature.p7x 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-72_altform-lightunplated.png 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\SpotlightMail_2017-09.gif 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Shims.dll 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\GKWord.dll 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\InstallerMainShell.tlb 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.VisualElementsManifest.xml 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Templates\Presentation Designs\Maple.gif 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BREEZE\THMBNAIL.PNG 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\MsEdgeCrashpad\metadata 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\SimpleProgressBarTheme.xbf 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\microsoft.system.package.metadata\S-1-5-21-3920234085-916416549-2700794571-1000-MergedResources-0.pri 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-200_contrast-black.png 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-96.png 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-gb\officons.ttf 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Advanced-Dark.scale-200.png 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-multibyte-l1-1-0.dll 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\dark\rhp_world_icon.png 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\identity_proxy\win10\identity_helper.Sparse.Stable.msix.DATA 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\FindRename.kix 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-black\MedTile.scale-125.png 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\24.png 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square150x150Logo.scale-125.png 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\SplashScreen.scale-125_contrast-white.png 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\DebugAndTrace.aspx 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\caspol.exe.config 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ja\System.Security.resources.dll 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.SDCommon\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDCommon.dll 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities.Core.Presentation.resources\v4.0_4.0.0.0_fr_31bf3856ad364e35\System.Activities.Core.Presentation.resources.dll 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Workflow.Activities.resources\v4.0_4.0.0.0_es_31bf3856ad364e35\System.Workflow.Activities.resources.dll 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Boot\PCAT\zh-CN\memtest.exe.mui 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\.NET CLR Networking\0411\_Networkingperfcounters_v2_d.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\.NET Data Provider for SqlServer\0407\_dataperfcounters_shared12_neutral_d.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\es\DropSqlPersistenceProviderSchema.sql 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities.DurableInstancing.resources\v4.0_4.0.0.0_ja_31bf3856ad364e35\System.Activities.DurableInstancing.resources.dll 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Entity.resources\v4.0_4.0.0.0_es_b77a5c561934e089\System.Web.Entity.resources.dll 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\en-US\DmaGuard.adml 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Cursors\size2_rm.cur 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfc100chs_x64 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Drawing.tlb 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\es-ES\Programs.adml 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\it-IT\LeakDiagnostic.adml 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Resources\Themes\aero\fr-FR\aerolite.msstyles.mui 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Fonts\arialbd.ttf 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\mdmaiwat.inf 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ImmersiveControlPanel\images\logo.scale-150.png 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\App_LocalResources\home1.aspx.resx 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Data.Services.Design.dll 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\ja\UIAutomationClientsideProviders.resources.dll 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\it\System.DirectoryServices.Resources.dll 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.log 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\MSDTC\0410\msdtcprf.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Providers\App_LocalResources\chooseProviderManagement.aspx.ja.resx 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ThirdPartyNotices.txt 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\fr\mscorrc.dll 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\es\System.Web.resources.dll 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fr\System.Xml.Linq.resources.dll 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\v4.0_10.0.0.0_de_31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.resources.dll 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Services.Client.resources\v4.0_4.0.0.0_it_b77a5c561934e089\System.Data.Services.Client.resources.dll 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\SOS.dll 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\Browsers\winwap.browser 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\App_LocalResources\WebAdminHelp_Internals.aspx.fr.resx 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Workflow.ComponentModel\v4.0_4.0.0.0__31bf3856ad364e35\System.Workflow.ComponentModel.dll 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\it-IT\Netlogon.adml 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\ja-JP\WindowsColorSystem.adml 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\App_LocalResources\navigationBar.ascx.ja.resx 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\Browsers\ie.browser 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.rsp 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\normnfc.nlp 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\es-ES\DCOM.adml 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\es-ES\Reliability.adml 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\it-IT\OOBE.adml 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\srm-fci.admx 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\npsvctrig.inf 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\termmou.PNF 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\3082\cscompui.dll 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fr\System.ServiceModel.Discovery.resources.dll 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\it\System.Numerics.Vectors.resources.dll 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\it-IT\Logon.adml 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Speech_OneCore\Engines\TTS\en-US\M1033Eva.ACL 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Speech_OneCore\Engines\TTS\es-ES\MSTTSLocEsES.dat 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Cursors\person.svg 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\fr\InstallUtil.resources.dll 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Threading.Overlapped.dll 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\it\System.RunTime.Serialization.resources.dll 2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2025-05-19_89ce1c4c62a5af18056e920e1a19d1e2_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe"1⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Drops startup file
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4360
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.2MB
MD576da82ad2c387ed31854eb7e72d6a5d6
SHA1ec921c3d069a21fdcbb6bb8b342f9bc8caecabd2
SHA2560dc55064c684c4c510e3281c6422fb61563c63be36d02ca06e28e8bf3b6cc23e
SHA5128d79e57abfbd22200b8becb79937a9d5037bd07cbb34fc116c8a832981c235f2061d3bd9b8b47c306fcc29ad7f50fcd638ae69538015a0687e1b4fde40d0bab1
-
Filesize
4.4MB
MD5302751612475c6e873168cca677f37a2
SHA15a7120f28e6997312ae6f993f99cd8ba410b2c25
SHA256a5267ce107436c740fcc63ef84c03746330544d9eb9e38908e6150a8fe9a95aa
SHA5127210f3d178345d2aef880a230de915ce57ceeee7e78794c5058f25b305b90a1b95d3610124605ffdd6543eee78b8772d19e93af621d6ce65401dada3bac6fb93
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
Filesize5.8MB
MD560f48ceea14b67780412e9cd2d8417aa
SHA12f26cd516874f27d49305e829086db651dda3745
SHA256ce0ec48522a6c657de02f1795ae6e1969e2d5a90fd2e12658062fecfee07d040
SHA5129ce31011d1ed4c1c5bb7161a037d16294d5829d458ecf3c2d8ddaf7190cf29c8401af28321c0513ba65ee84cb0e1786d389a75cd32e5a0b713710485f1eeb1f7