Analysis
- max time kernel
150s - max time network
132s - platform
windows10-2004_x64 - resource
win10v2004-20250502-en - resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system - submitted
22/05/2025, 12:34
Behavioral task
behavioral1
Sample
2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe
Resource
win10v2004-20250502-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe
Resource
win11-20250502-en
windows11-21h2-x64
18 signatures
150 seconds
General
- Target 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe
- Size 4.2MB
- Sample250522-przntstk13
- SHA256 1c16318ca2d7dbe399b10ac4f6475c717ea0ff8f497e2996b1b98a46261736dd
- MD5 1e011d1d31cf08bb72f3f9f28c032ad3
- SHA1 481972945ce5e3dd633cb14f7c17d85f260dc460
- SHA512 dcb7d0ab9401025bb35e43b3e9ac57c3360d1d0f0edcd0df7ca73d80853f5ae037728f9c24a6ade2d7c40cbf67004e18cd202a3ff0e31b41ab5f45e3071ae75e
- SSDEEP 49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q47:ieF+iIAEl1JPz212IhzL+Bzz3dw/V5
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Gofing
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
- Gofing family
- Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation. 1 IoCs
resource yara_rule behavioral1/files/0x0003000000022a45-4.dat family_gofing - Drops file in Drivers directory 22 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\de-DE\NdisImPlatform.sys.mui 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\fr-FR\wfplwfs.sys.mui 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\it-IT\wfplwfs.sys.mui 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\ja-JP\NdisImPlatform.sys.mui 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\en-US\NdisImPlatform.sys.mui 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\en-US\wfplwfs.sys.mui 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\es-ES\NdisImPlatform.sys.mui 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\fr-FR\ndiscap.sys.mui 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\gm.dls 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\gmreadme.txt 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\it-IT\NdisImPlatform.sys.mui 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\it-IT\ndiscap.sys.mui 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\afunix.sys 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\en-US\ndiscap.sys.mui 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\es-ES\ndiscap.sys.mui 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\es-ES\wfplwfs.sys.mui 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\fr-FR\NdisImPlatform.sys.mui 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\ja-JP\ndiscap.sys.mui 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\uk-UA\NdisImPlatform.sys.mui 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\de-DE\ndiscap.sys.mui 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\de-DE\wfplwfs.sys.mui 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\drivers\ja-JP\wfplwfs.sys.mui 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe - Manipulates Digital Signatures 2 IoCs
Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
description ioc Process File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pwrshsip.dll 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\wintrust.dll 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe - Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops Chrome extension 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\manifest.json 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe - Drops desktop.ini file(s) 64 IoCs
description ioc Process File created C:\Users\Public\Videos\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\$Recycle.Bin\S-1-5-21-3623617754-4043701611-775564599-1000\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Downloads\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Desktop\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Favorites\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Offline Web Pages\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Links\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\OneDrive\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Favorites\Links\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Pictures\Camera Roll\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Searches\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Downloads\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Libraries\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Media\Desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Pictures\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Saved Games\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Downloaded Program Files\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Music\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Fonts\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Contacts\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Documents\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Documents\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Public\Pictures\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\Videos\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe - Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\FileRepository\nvdimm.inf_amd64_9bb46b0de5ea33cd\nvdimm.sys 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\es-ES\BthLCPen.inf_loc 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\F12\en-US\F12Script.dll.mui 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\AppVClientCmdlets.psm1 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\de\Microsoft.AppV.AppvClientComConsumer.resources.dll 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\it-IT\DeviceCenter.dll.mui 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\offlinesam.dll 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\PerceptionSimulation\VirtualCameraManager.dll 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Microsoft.Uev.Office2013CustomActions.dll 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\en-US\l2nacp.dll.mui 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\fr-FR\UserDeviceRegistration.Ngc.dll.mui 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Networking-VirtualDevice-Emulated-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0113~31bf3856ad364e35~amd64~de-DE~10.0.19041.1.cat 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Embedded-KeyboardFilter-Core-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.844.cat 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\en-US\msux64w10.INF_loc 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\KBDPO.DLL 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WinFax.dll 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\ja-JP\apphelp.dll.mui 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Storage-VirtualDevice-SMB-Package~31bf3856ad364e35~amd64~ja-JP~10.0.19041.1.cat 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DdcComImplementationsDesktop.dll 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\SystemUWPLauncher.exe 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\Windows.Networking.HostName.dll 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Schemas\PSMaml\baseConditional.xsd 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\Dism\en-US\OfflineSetupProvider.dll.mui 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\ja-JP\rtux64w10.inf_loc 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\it-IT\cmmon32.exe.mui 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Compute-System-VirtualMachine-Package~31bf3856ad364e35~amd64~de-DE~10.0.19041.1.cat 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\en-US\sndvolsso.dll.mui 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\wbem\fastprox.dll 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\it-IT\rtvdevx64.INF_loc 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\GameBarPresenceWriter.exe 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_LogResource\de-DE\MSFT_LogResource.schema.mfl 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\ja-JP\WsmSvc.dll.mui 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\ngccredprov.dll 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-WPD-UltimatePortableDeviceFeature-Feature-WOW64-Package~31bf3856ad364e35~amd64~es-ES~10.0.19041.1.cat 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\FileRepository\cpu.inf_amd64_0abeab1ee6572232\amdk8.sys 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PrintManagement\MSFT_LprPrinterPort_v1.0.cdxml 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-TerminalServices-WMIProvider-Package~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.cat 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_12_for_KB5005699~31bf3856ad364e35~amd64~~19041.1220.1.0.cat 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\fr-FR\microsoft_bluetooth_a2dp_snk.inf_loc 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\MapGeocoder.dll 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\wbem\de-DE\netdacim_uninstall.mfl 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Hyper-V-Hypervisor-merged-Package~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.cat 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\de-DE\netwmbclass.inf_loc 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\en-US\c_smartcard.inf_loc 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\F12\en-US\IEChooser.exe.mui 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\fr-FR\msxml6r.dll.mui 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-VID-Package~31bf3856ad364e35~amd64~es-ES~10.0.19041.1.cat 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.1081.cat 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\KBDCZ2.DLL 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\MouseSystemToastIcon.contrast-white.png 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\Windows.Internal.Feedback.Analog.ProxyStub.dll 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\ServiceSet\ServiceSet.psd1 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Identity-Foundation-Opt-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-WPD-UltimatePortableDeviceFeature-Feature-WOW64-Package~31bf3856ad364e35~amd64~de-DE~10.0.19041.1.cat 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DisplaySystemToastIcon.contrast-white.png 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetLbfo\MSFT_NetLbfoTeam.cdxml 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SysWOW64\wbem\schedprov.dll 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-NetFx-Shared-Typelibs~31bf3856ad364e35~amd64~~10.0.19041.1.cat 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\Configuration\Registration\MSFT_FileDirectoryConfiguration\de-DE\MSFT_FileDirectoryConfiguration.Registration.mfl 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\en-US\CompositeBus.inf_loc 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\DriverStore\es-ES\iaLPSS2i_I2C_SKL.inf_loc 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\System32\GameInput.dll 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\System\Ole DB\msxactps.dll 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_Fur.dxt 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\PeopleSmallTile.scale-100.png 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Outlook.scale-400.png 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\ReadOutLoud.api 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libedgedetection_plugin.dll 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\TimerWideTile.contrast-black_scale-100.png 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailLargeTile.scale-100.png 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sk-sk\ui-strings.js 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ul-oob.xrm-ms 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-40_contrast-black.png 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-48_contrast-white.png 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\bg4.jpg 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarWideTile.scale-125.png 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.ReaderWriter.dll 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sk-sk\ui-strings.js 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ar-ae\ui-strings.js 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-ppd.xrm-ms 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\COIN.WAV 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ITCKRIST.TTF 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-ae\ui-strings.js 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Locales\fr.pak 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ppd.xrm-ms 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\flat_officeFontsPreview.ttf 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-64.png 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionLargeTile.scale-150.png 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\CardUIBkg.scale-200.HCWhite.png 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-64.png 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\System.Windows.Forms.Primitives.resources.dll 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN092.XML 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\index.win32.bundle.map 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\FileExtension.targetsize-40.png 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationProvider.resources.dll 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\sspi_bridge.dll 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Windows Media Player\it-IT\wmpnssui.dll.mui 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\AppxSignature.p7x 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeLargeTile.scale-150.png 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libsamplerate_plugin.dll 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Http.dll 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_livehttp_plugin.dll 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libchorus_flanger_plugin.dll 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxSignature.p7x 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosLogoExtensions.targetsize-336.png 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_should.help.txt 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\de\msipc.dll.mui 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\resources.pri 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\Square150x150Logo.scale-150.png 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.Advertising.dll 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\resources.pri 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-white_targetsize-30.png 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\_Resources\3.rsrc 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-256_altform-unplated_contrast-black.png 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\css\main.css 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ja-jp\ui-strings.js 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\zh-tw\ui-strings.js 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ul-oob.xrm-ms 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionGroupSmallTile.scale-150.png 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-36.png 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\NPSPWRAP.DLL 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\es\System.DirectoryServices.resources.dll 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.WorkflowServices.resources\v4.0_4.0.0.0_it_31bf3856ad364e35\System.WorkflowServices.resources.dll 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationProvider.resources\v4.0_4.0.0.0_fr_31bf3856ad364e35\UIAutomationProvider.resources.dll 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\en-US\fthsvc.adml 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Cursors\aero_up_xl.cur 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\wfcvsc.inf 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ImmersiveControlPanel\pris\resources.es-ES.pri 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\es-ES\Taskbar.adml 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\ja-JP\DeviceGuard.adml 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\ja-JP\StorageSense.adml 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Logs\NetSetup\service.0.etl 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ES\System.Web.Mobile.resources.dll 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\App_LocalResources\WebAdminHelp_Internals.aspx.es.resx 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Workflow.ServiceCore.Resources\v4.0_3.0.0.0_es_31bf3856ad364e35\Microsoft.PowerShell.Workflow.ServiceCore.Resources.dll 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.SDCommon\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDCommon.dll 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Channels.resources\v4.0_4.0.0.0_es_31bf3856ad364e35\System.ServiceModel.Channels.resources.dll 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\AuditSettings.admx 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\es-ES\Windows.adml 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\00006109E70000000100000000F01FEC\16.0.12527\vcruntime140.dll_x64 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Abstractions.resources\v4.0_4.0.0.0_fr_31bf3856ad364e35\System.Web.Abstractions.resources.dll 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Prefetch\I4M6EG.EXE-1D0BA8AC.pf 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Speech\Engines\SR\en-US\am031033.am 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Speech_OneCore\Engines\TTS\en-US\enUS.Media.dat 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\msports.inf 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\tsusbhubfilter.inf 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Prefetch\MICROSOFTEDGEUPDATE.EXE-C4317749.pf 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Boot\EFI\hu-HU\memtest.efi.mui 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\usbport.PNF 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\1031\CvtResUI.dll 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state_perf.ini 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\v4.0_4.0.0.0_ja_b03f5f7f11d50a3a\Microsoft.Build.Engine.resources.dll 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.Http.resources\v4.0_4.0.0.0_fr_b03f5f7f11d50a3a\System.Net.Http.resources.dll 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\mdmgl003.inf 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\1036\cscompui.dll 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\ja\UIAutomationClientsideProviders.resources.dll 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\normnfkc.nlp 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\fr-FR\Kerberos.adml 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\SKB\LanguageModels\lm.es-both.dat 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Fonts\ntailu.ttf 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\Microsoft.VisualBasic.resources.dll 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\1033\cscompui.dll 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\SQL\es\SqlPersistenceProviderLogic.sql 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\NetFx40_IIS_schema_update.xml 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\fr\PresentationFramework.resources.dll 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Diagnostics.TextWriterTraceListener\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Diagnostics.TextWriterTraceListener.dll 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\WordWheel.admx 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\mgtdyn.inf 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\DefineErrorPage.aspx.ja.resx 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\wizardProviderInfo.ascx.ja.resx 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe.config 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.EnterpriseServices.resources\v4.0_4.0.0.0_it_b03f5f7f11d50a3a\System.EnterpriseServices.resources.dll 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\en-US\ControlPanelDisplay.adml 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\fr-FR\DiskDiagnostic.adml 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\sdiagschd.admx 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\INF\rtwlanu_oldIC.inf 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\es\Microsoft.Build.Utilities.v4.0.resources.dll 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fr\System.ServiceModel.Channels.resources.dll 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\PolicyDefinitions\en-US\TerminalServer.adml 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Speech_OneCore\Engines\TTS\fr-FR\NUSData\M1036Hortense.keyboard.unt 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Installer\SourceHash{90160000-008C-0409-1000-0000000FF1CE} 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\es\System.Xaml.resources.dll 2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2025-05-22_1e011d1d31cf08bb72f3f9f28c032ad3_cobalt-strike_frostygoop_ghostlocker_gofing_luca-stealer_sliver_snatch.exe"1⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Drops startup file
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4536
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip32.dll
- Size 4.2MB
- SHA256 0a69f118e7ef1d32fb98d213d252ed45ab595fa9713621c3dc20c943d05c576e
- MD5 7e6e9535e7927c0ac652b1b753225fca
- SHA1 24e1658dbc477888a135a2949af50411af65ef4a
- SHA512 818efef4fb2df695dfde1276b61d4f2e3027014afab36be560cb3713c935dae3826e39684c6f3301530a0694e7d673b6215dc13519f1b1b7bccb2edc5ae1d238
- SSDEEP 49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q4S:ieF+iIAEl1JPz212IhzL+Bzz3dw/V0
- MD5 SHA1 SHA512 SSDEEP