Overview

overview

10

Static

static

10

2026-04-15...hi.exe

windows10-2004-x64

10

2026-04-15...hi.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    139s
  • max time network
    131s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    15/04/2026, 08:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
  • Size 4.1MB
  • Sample260415-krdddah12k
  • SHA256 83a389f9f1475110c7aa6e240208f693c52c2c71777eaa1bccd77fd8df76a9a5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdiscoverygofingransomwarespywarestealer

Malware Config

Signatures

  • Family: Gofing

    Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.

    ransomwaregofing
  • Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation. 3 IoCs
  • Renames multiple (52) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Loads dropped DLL 48 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops Chrome extension 1 IoCs
  • Drops desktop.ini file(s) 25 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Modifies registry class 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-15_5cf8d0f3043f9d685b7ce602410ff233_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe"
    1⤵
    • Drops Chrome extension
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    PID:648
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1304
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2364

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.dll
        • Path C:\Program Files\7-Zip\7z.dll
        • Size 5.9MB
        • SHA256 c6fdc8f97626dbcb13f870809cd38f5ec99ad71c142509295726b4dff25d5119
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VISSHE.DLL
        • Path C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL
        • Size 4.4MB
        • SHA256 5b738dbf5aeb73081fa182553df9d1c4b903d9a16378395d42c7edc5f2b15e12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 5.8MB
        • SHA256 0fd8dc7d1b6f5987d0dd51625cad68120cacb3c8f7d70b722ef089ff9db84abc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        microsoft.windows[1].xml
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\EYNXNMMH\microsoft.windows[1].xml
        • Size 96B
        • SHA256 172f728143f8e7ed07112d3eb6aa8880c04abd2fc1dd6c0239f965184e31ae98
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        95d9a2a97a42f02325559b453ba7f8fe839baa18.tbres
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\95d9a2a97a42f02325559b453ba7f8fe839baa18.tbres
        • Size 2KB
        • SHA256 e6fa5f44b67c0e57e01152265487011147806203c081f0c49fd69d16d6ed0bee
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        0.0.filtertrie.intermediate.txt
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{963ee20f-208b-4009-a291-ae615abd9005}\0.0.filtertrie.intermediate.txt
        • Size 11KB
        • SHA256 d25eaf9cff9e30595f05c0e3de3d0b8f02e7052f83af0d2e40aa34dc143702ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        0.1.filtertrie.intermediate.txt
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{963ee20f-208b-4009-a291-ae615abd9005}\0.1.filtertrie.intermediate.txt
        • Size 5B
        • SHA256 8e1e6a3d56796a245d0c7b0849548932fee803bbdb03f6e289495830e017f14c
        • MD5 SHA1 SHA512
        Submit Download

        0.2.filtertrie.intermediate.txt
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{963ee20f-208b-4009-a291-ae615abd9005}\0.2.filtertrie.intermediate.txt
        • Size 5B
        • SHA256 d65b6a3bf11a27a1ced1f7e98082246e40cf01289fd47fe4a5ed46c221f2f73f
        • MD5 SHA1 SHA512
        Submit Download

        Apps.ft
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{963ee20f-208b-4009-a291-ae615abd9005}\Apps.ft
        • Size 15KB
        • SHA256 78971440bf58ffbc8f341a9ac724e135b007afdad3350721aa4e8a6dc879e30b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppCache134207167236812125.txt
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134207167236812125.txt
        • Size 21KB
        • SHA256 94651b1d299c549761d197509c53ac939d3bf19dc4e0894a344e6e475046375e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppCache134207167351537279.txt
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134207167351537279.txt
        • Size 8KB
        • SHA256 7c0783c9369636a570277c5211687639384076f8a28715b5a9867021a66bb9be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CortanaUnifiedTileModelCache.dat
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat
        • Size 6KB
        • SHA256 50a0e4d1ba08f10bd2abfcc42265a6a0b568e49b3cf3ea7d8ec98a6a094c2923
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CortanaUnifiedTileModelCache.dat
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat
        • Size 7KB
        • SHA256 873eb5bd67c6c0ba5ea98467f19b7523ae4fb456c844134d8b8079881c84a2b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1304-5833-0x0000029666630000-0x000002966663C000-memory.dmp
        Download

        memory/2364-5907-0x0000021935DB0000-0x0000021935DD0000-memory.dmp
        Download

        memory/2364-5923-0x0000021935D70000-0x0000021935D90000-memory.dmp
        Download

        memory/2364-5941-0x0000021936100000-0x0000021936120000-memory.dmp
        Download

        memory/2364-6131-0x00000211305F0000-0x00000211305FC000-memory.dmp
        Download