Overview

overview

10

Static

static

10

2026-09-09...hi.exe

windows10-2004-x64

10

2026-09-09...hi.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    135s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/09/2026, 22:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-09_d7f50ce12fc00617586efdc15cd327af_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
  • Size 4.1MB
  • Sample260910-2v83wsxbpb
  • SHA256 49d61e7f4b4801bca35742e93137dbca2567002e64fc242343494064255bc035
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdiscoverygofingpersistenceprivilege_escalationransomwarespywarestealer

Malware Config

Signatures

  • Family: Gofing

    Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.

    ransomwaregofing
  • Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation. 3 IoCs
  • Renames multiple (57) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Creates a file in the Startup directory 1 TTPs 1 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 41 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops Chrome extension 1 IoCs
  • Drops desktop.ini file(s) 36 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-09_d7f50ce12fc00617586efdc15cd327af_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-09_d7f50ce12fc00617586efdc15cd327af_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe"
    1⤵
    • Creates a file in the Startup directory
    • Drops Chrome extension
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    PID:4460
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2812
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1972

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.dll
        • Path C:\Program Files\7-Zip\7z.dll
        • Size 5.9MB
        • SHA256 9cf85aaa56b760e78fd23cac4b077932be390a82237b9b96a499356d920f69bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VISSHE.DLL
        • Path C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL
        • Size 4.4MB
        • SHA256 b8ed0ea8b74b6d1366ef8e6ba630c5e925b8a48b90034538ae0006ea5f8a64b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoshext.dll
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
        • Size 5.8MB
        • SHA256 50371753d15d41b86c37e6b44b2030dff091d22dbac0116ca9c25254220ebbe3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        microsoft.windows[1].xml
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\76T98WBL\microsoft.windows[1].xml
        • Size 97B
        • SHA256 10310a1b913bd3cbdb76448804c3d0d5b931dc92ff6e9b148dcb7d5a56c6afca
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        95d9a2a97a42f02325559b453ba7f8fe839baa18.tbres
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\95d9a2a97a42f02325559b453ba7f8fe839baa18.tbres
        • Size 2KB
        • SHA256 c3e14e38dc1a61b4a23f8d5442b4e70b2f045f9c39f3c717c7d9ea2ac095c91b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        apps.csg
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{334f7465-928b-43bf-b54b-0db8a727a389}\apps.csg
        • Size 444B
        • SHA256 0b0af873ef116a51fc2a2329dc9102817ce923f32a989c7a6846b4329abd62cd
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        apps.schema
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{334f7465-928b-43bf-b54b-0db8a727a389}\apps.schema
        • Size 150B
        • SHA256 5af0fc2a0b5ccecdc04e54b3c60f28e3ff5c7d4e1809c6d7c8469f0567c090bb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        appsconversions.txt
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{334f7465-928b-43bf-b54b-0db8a727a389}\appsconversions.txt
        • Size 703KB
        • SHA256 9b4ed96958a8eb10ba97530bfee9393a322348f9fab5866fc180f22647150d21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppCache134335546589224903.txt
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134335546589224903.txt
        • Size 23KB
        • SHA256 749ac23469f8e722e97d910256c4f4b6c969b13b5a76ece030e3009af6c26653
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppCache134335546642033986.txt
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134335546642033986.txt
        • Size 11KB
        • SHA256 bfb05073526347cf4824f2e29c4a571985edb077366896411a04c2219c37b689
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IDX_CONTENT_TASKBARHEADLINES.json
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\IDX_CONTENT_TASKBARHEADLINES.json
        • Size 309KB
        • SHA256 29795fefc12606252fd5c137df4415c495ecbbcc23a18682795492f4f74c464f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CortanaUnifiedTileModelCache.dat
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat
        • Size 9KB
        • SHA256 3416bfdf8fb45796b1ee1b74d094a98d88c7afac7d21b3dd64e832add05b3ec0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1972-5928-0x000002A21DFB0000-0x000002A21DFD0000-memory.dmp
        Download

        memory/1972-5958-0x000002A21DF70000-0x000002A21DF90000-memory.dmp
        Download

        memory/1972-5959-0x000002A21E380000-0x000002A21E3A0000-memory.dmp
        Download

        memory/2812-5819-0x000001E7BF1A0000-0x000001E7BF1C0000-memory.dmp
        Download

        memory/2812-5818-0x000001E7BEE20000-0x000001E7BEE40000-memory.dmp
        Download

        memory/2812-5810-0x000001E7BEE60000-0x000001E7BEE80000-memory.dmp
        Download