Analysis
- max time kernel
142s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
12/09/2026, 09:26
Behavioral task
behavioral1
Sample
2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
- Size 14.5MB
- Sample260912-ld7whatare
- SHA256 f12d7b0872992dd6367e88e69ee63b48bbe8bf3d5eb35fa16ef79b8e1abfd977
- MD5 66bacf8a1959459f1b89c8cd98260b10
- SHA1 adcb1aa48c96c6fe9926a17c2da45265aefe83eb
- SHA512 118c8d94f24ffeba02e36b4ccceb6598cd48d1a75a3f37f99b9d0c984ac082c9494edafa9b5a605d2d78c240de96d871f2eab348f6a1e8066ba4dd25a74e00f1
- SSDEEP 393216:8KVB/gK+W0FtOWYFz3jY0dBiA7mTaX0qp:8yIKh0tOW4zPni9+kqp
- TLSH T1CBE61203FC9564A9C5E9F23089B593A27B717848473137D72B64AABB2E737C41E78390
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Family: Gofing
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
- Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation. 3 IoCs
resource yara_rule behavioral1/files/0x0003000000022be6-4.dat family_gofing behavioral1/files/0x0002000000021e33-5570.dat family_gofing behavioral1/files/0x00020000000219ac-5812.dat family_gofing - Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
- Loads dropped DLL 42 IoCs
pid Process 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found 3264 Process not Found - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops Chrome extension 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\manifest.json 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe - Drops desktop.ini file(s) 15 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Admin\3D Objects\desktop.ini 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\desktop.ini 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\desktop.ini 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\$Recycle.Bin\S-1-5-21-240542094-4193773837-3211495583-1000\desktop.ini 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\VideoLAN\VLC\plugins\codec\liblibmpeg2_plugin.dll 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SplashWideTile.scale-125_contrast-black.png 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBarTasks.dll 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\oneds.dll 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Locales\az.pak 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_COL.HXC 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\hive.xsl 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\PPSLAX.DLL 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Management.Instrumentation.Resources.dll 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\resources\strings\LocalizedStrings_tr.json 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-pl.xrm-ms 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\BuildInfo.xml 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.scale-200_contrast-black.png 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\createpdf.svg 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Common Files\System\msadc\adcjavas.inc 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_pt_BR.properties 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.dll 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\et\msipc.dll.mui 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\msvcp140.dll 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-64_contrast-black.png 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-64_altform-unplated_contrast-white.png 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Wide310x150\PaintWideTile.scale-125.png 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\SearchInstall.tiff 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\onboarding\contacts_variant2_v3.png 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.Tasks.winmd 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\AppIcon.scale-100_contrast-black.png 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore.dll 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\UIAutomationProvider.resources.dll 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\[email protected] 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\TestDrive.Tests.ps1 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreLogo.scale-125_contrast-white.png 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Diagnostics.StackTrace.dll 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationFramework.resources.dll 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hu-hu\ui-strings.js 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\da-dk\ui-strings.js 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Java\jre-1.8\lib\ext\nashorn.jar 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libdeinterlace_plugin.dll 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Lighting\Dark\Sunset.png 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square71x71Logo.scale-150.png 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Controls.Ribbon.resources.dll 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-ul-oob.xrm-ms 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Spatial.NetFX35.V7.dll 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\AppPackageLargeTile.scale-125_contrast-black.png 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.RichMedia.Ink.dll 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-40_altform-unplated_contrast-white.png 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\Logo.scale-100_contrast-white.png 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Design.resources.dll 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\JSByteCodeWin.bin 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\local_policy.jar 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\TrackedSend.aapp 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\de-de\ui-strings.js 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\dxil.dll 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL115.XML 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\FPSRVUTL.DLL 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\AppIcon.targetsize-96_contrast-black.png 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.IO.Packaging.dll 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\TextIntelligence.dll 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-72_altform-fullcolor.png 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\Scripts\Me\MeControl\offline\webviewBoot.min.js 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-256_altform-lightunplated.png 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\WindowsBase.resources.dll 2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-11_66bacf8a1959459f1b89c8cd98260b10_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe"1⤵
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:2640
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.dll
- Size 5.9MB
- SHA256 658d27f7ee7fe16facbae2cb352c49547325c4f43127974c4c2fe5d6a8d47eb0
- MD5 71b96c69ea3d0a486314c34c4e92d537
- SHA1 e1526f910042c3747bbc24d643f0b18ca6464443
- SHA512 841348099db8491603220bc87b9e7656c7f081eec1ec68466a2a9b6fb549dacc19d3fb3091c6fbb84bb3f66103d4d68275ba215a5f8cd71f7737265a9a7aeff8
- SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/VX9L0pdnM7BhEST46JGi:pWvSDzaxztQVX9KdnM7Bxwi
- TLSH T18056CF07FD9450A9D5E9F232C96883627B31B84807316BD72F60BA7B2AB77D41E78344
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL
- Size 4.4MB
- SHA256 4b2a7f2e5190b3df4405c9999932e354c0421a11626036232a0aae031ba44805
- MD5 62963619f31b19ddc240bc06cd9b79db
- SHA1 b8394e32cbe4f01cd205f914e280c8ea3358f718
- SHA512 46e26d8e30d6ff5fd1c5644cad50283c33b319e287a955cbd0e4f9d9a36dea4157023ec202484c677cd4cfd1a37206115d4d0101c4514bbca1aea2734f016197
- SSDEEP 49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q4O:ieF+iIAEl1JPz212IhzL+Bzz3dw/Vg
- TLSH T18626AD03FC9564B9C5EAF234897983527A317859473137D32B64AABB3A73BC41E78390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 5.8MB
- SHA256 05055d03bab7f207d4122bf5a7ad1d6ed2f7d55235d77351a1192f662495c7ee
- MD5 c8b87e6fdd62ffa6b3a4b8a84428fe0e
- SHA1 bf09074ba54bc9aeda78b06175c92fb59e59e038
- SHA512 e2f8d0ea3b8ea84b9f7c4c5fcb1ce237b0c846e2f33d62d65ff120f3dee5782ce29c07ac7961c720c5d415caa03500a1fdaa69d10f4cf44d6505bc1b173cd8ab
- SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/VjlbxE7zcXJfip1Ts:pWvSDzaxztQVjNx6zc56pRs
- TLSH T19456BF03B86514BBC6E5ED31896A9A527B3074994F3123E73BA49EB739737C20E78350
- MD5 SHA1 SHA512 SSDEEP TLSH