Analysis
- max time kernel
150s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/09/2026, 00:50
Behavioral task
behavioral1
Sample
2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
- Size 18.5MB
- Sample260913-a7bvdada29
- SHA256 ef9df902aec8bd9b9b3ddbc4ae96f80c38b14fea5ce721b6fb7c5e256eaa0249
- MD5 60ee71b7715ec882bcb8ac4aaa487f80
- SHA1 01be1fa171696754d10d93a00dc589196639119b
- SHA512 a638b88636821e02187c7d5003c34e47a86c378d24fd1e78683a9eb2d14d93d93b9b5920bd3261e3a69325a82fd8f5d5b0ef0c38a46ec677d0c51e82773ecbf8
- SSDEEP 393216:8KVTsjc1O4psYw5u8S7LNh6TNfFgPp2tRpX4BJOGk1FLMKBsh:85cUYbNhgup2XpX4CTbDsh
- TLSH T167171203FC9564A9C5E9F230C9B9839276717858473123D72F64AABB2A73BC41F78394
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Family: Gofing
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
- Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation. 2 IoCs
resource yara_rule behavioral2/files/0x000300000001b2b3-4.dat family_gofing behavioral2/files/0x0003000000019f3a-5713.dat family_gofing - Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
- Executes dropped EXE 1 IoCs
pid Process 1368 Process not Found - Loads dropped DLL 35 IoCs
pid Process 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found 1368 Process not Found - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 14 IoCs
description ioc Process File created C:\Program Files (x86)\desktop.ini 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\desktop.ini 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\$Recycle.Bin\S-1-5-21-560646293-820748483-2532804640-1000\desktop.ini 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-pl.xrm-ms 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\YAHOO.COM.PH.XML 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\In.ps1 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-util-l1-1-0.dll 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationUI.resources.dll 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\WindowsFormsIntegration.resources.dll 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileAcrobatCard_Dark.pdf 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\AddressBook2x.png 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\ResiliencyLinks\VisualElements\Logo.png.DATA 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\ResiliencyLinks\v8_context_snapshot.bin.DATA 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-pl.xrm-ms 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Grace-ppd.xrm-ms 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftEdge.Stable_139.0.3405.125_neutral__8wekyb3d8bbwe\Logo.png 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\ShouldNotMatch.snippets.ps1xml 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\cstm_brand_preview2x.png 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\resources.pak 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Linq.Resources.dll 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-180.png 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\PresentationCore.resources.dll 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ca-es\ui-strings.js 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\uk-ua\ui-strings.js 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\images\file_icons.png 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\cstm_brand_preview2x.png 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\CourierStd-Bold.otf 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\OSFPROXY.DLL 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Locales\vi.pak 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe.sig 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationClient.resources.dll 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Web.Entity.Design.Resources.dll 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\tmcachemgr_xl.dll 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Windows Media Player\Network Sharing\MediaReceiverRegistrar.xml 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\turnOnNotificationInAcrobat.gif 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-gb\ui-strings.js 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\rtscom.dll 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Common Files\System\msadc\de-DE\msdaremr.dll.mui 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\msedgeupdateres_ru.dll 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_Grace-ppd.xrm-ms 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\XLMACRO.CHM 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL102.XML 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Windows Defender\es-ES\MpEvMsg.dll.mui 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Windows Media Player\it-IT\wmpnetwk.exe.mui 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Simple\Simple.Tests.ps1 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\tr-tr\ui-strings.js 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Common Files\microsoft shared\ink\kk-KZ\tipresx.dll.mui 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\rsod\proof.en-us.msi.16.en-us.tree.dat 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\STSCOPY.DLL 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Mozilla Firefox\defaults\pref\channel-prefs.js 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.EventBasedAsync.dll 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Forms.Design.resources.dll 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.Design.resources.dll 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\System.Windows.Forms.resources.dll 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-string-l1-1-0.dll 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-80.png 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxbgt.dll 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Windows Media Player\ja-JP\setup_wm.exe.mui 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.8_8.2310.30001.0_x64__8wekyb3d8bbwe\AppxSignature.p7x 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\ReachFramework.resources.dll 2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-12_60ee71b7715ec882bcb8ac4aaa487f80_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:4288
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.dll
- Size 5.9MB
- SHA256 32f14b91686f5d3343d088b45144310ff0cccf96c54b90c2f7f7d2b488cfb7cb
- MD5 d922e49bc9b1a546db6668f11e608e20
- SHA1 1cae517c3cb423ed2cf6efa9ad8a906708c815c0
- SHA512 6f59f23713c35838e2c4946b47bbbe2c893b73697109e4754dde84c04f1cbeeb22c12fcf9daca0ccfef37ab6ff63758a1ebd5a86ed9c6470252aae0922e3799b
- SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/VrNp11qINb+s/:pWvSDzaxztQVdP/
- TLSH T11456CF03FC9564A9C6EAF231857682A23A317854133173D72B26AB7B5E777C81F78360
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 5.8MB
- SHA256 6a4019287e1ee84415b7ef0b62259073754dfbbb76858d2fd17f3ca725499262
- MD5 27d7aec263f35cab574f7457e292195f
- SHA1 ab5c1a44bb72fff2298823a95fecbcc9767218ee
- SHA512 e09628c3085e4f85bfc8b370a09e380c849c67a90b23a0a1b9a27d208451001461eec61fad1c287ecf8d4446e75a219ac9e9f790066230ef15edf58d83e1f443
- SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/VwAusXa/FVT:pWvSDzaxztQVwAuas
- TLSH T10756BE03FC9230A8C6D8F17189A5527176337CA8637123D3AB64FABB5A767D44E78B40
- MD5 SHA1 SHA512 SSDEEP TLSH