Analysis
- max time kernel
140s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
13/09/2026, 04:17
Behavioral task
behavioral1
Sample
2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
- Size 4.1MB
- Sample260913-ewb38afa33
- SHA256 63470f1405ee248f319d43ad20677b062fcf5d256b65810f4bad7a353c112ea2
- MD5 2dc26f6714472ec946e9dfb54f07498e
- SHA1 0d3341617a4672c4943cb854de8ff5a391bd2f14
- SHA512 ce8e35027a76ce48981d4c549bd7dfa1b4f0cfed5122e369a13256629161d159b307c3530b8c85facf3c4f865afff4b5e2b4e54edcf8b03911199a80c0722e76
- SSDEEP 49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q4N:ieF+iIAEl1JPz212IhzL+Bzz3dw/Vj
- TLSH T106169D03FC9564A9C5E9F23089B583927B71B858473123D72F64ABBB2A777C41E78390
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: Gofing
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
- Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation. 13 IoCs
resource yara_rule behavioral1/files/0x0003000000022b7d-4.dat family_gofing behavioral1/files/0x00020000000218dc-5569.dat family_gofing behavioral1/files/0x00020000000218dc-5597.dat family_gofing behavioral1/files/0x00020000000218dc-5596.dat family_gofing behavioral1/files/0x00020000000218dc-5595.dat family_gofing behavioral1/files/0x00020000000218dc-5594.dat family_gofing behavioral1/files/0x00020000000218dc-5593.dat family_gofing behavioral1/files/0x00020000000218dc-5592.dat family_gofing behavioral1/files/0x00020000000218dc-5642.dat family_gofing behavioral1/files/0x00020000000218dc-5641.dat family_gofing behavioral1/files/0x00020000000218dc-5640.dat family_gofing behavioral1/files/0x00020000000218dc-5639.dat family_gofing behavioral1/files/0x00020000000218dc-5638.dat family_gofing - Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
- Drops desktop.ini file(s) 4 IoCs
description ioc Process File created C:\$Recycle.Bin\S-1-5-21-681733028-2344970462-962213935-1000\desktop.ini 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\desktop.ini 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\desktop.ini 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\msedgeupdateres_gd.dll 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\ShapeCollector.exe.mui 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\OSFINTL.DLL 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libudp_plugin.dll 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-96_contrast-black.png 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\UIAutomationProvider.resources.dll 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-pl.xrm-ms 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-pl.xrm-ms 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\SHARING.CFG 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\rsod\powerpointmui.msi.16.en-us.boot.tree.dat 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Scientific.targetsize-32_contrast-black.png 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-96_altform-unplated_contrast-white.png 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxBadge.scale-400.png 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookAccount.scale-100.png 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\nl-nl\ui-strings.js 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Common Files\System\ado\msado60.tlb 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\msedgeupdateres_bn-IN.dll 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-24_altform-unplated.png 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Trust Protection Lists\Sigma\Analytics 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Net.Resources.dll 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\SplashScreen.scale-200.png 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteAppList.targetsize-32.png 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-30_contrast-white.png 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\FacebookLoginButton.xbf 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\models\en-US.Calendar.ot 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\WindowsFormsIntegration.resources.dll 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\kk.pak.DATA 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.18101.0_x86__8wekyb3d8bbwe\resources.pri 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\S-1-5-21-681733028-2344970462-962213935-1000-MergedResources-0.pri 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreAppList.targetsize-24.png 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\en-US\oledb32r.dll.mui 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Locales\sr-Cyrl-BA.pak 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\ca.pak 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicelegant.dotx 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr8es.dub 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\SwipeTeachingCalloutImage.layoutdir-LTR.gif 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationUI.resources.dll 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Java\jre-1.8\bin\instrument.dll 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationNative_cor3.dll 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\apple-touch-icon-72x72-precomposed.png 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_rgb_plugin.dll 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-200_8wekyb3d8bbwe\Win10\MicrosoftSolitaireSmallTile.scale-200.jpg 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\MicrosoftSolitaireAppList.targetsize-256_altform-unplated_contrast-white_devicefamily-colorfulunplated.png 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNotePageLargeTile.scale-125.png 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-60_altform-lightunplated.png 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationClientSideProviders.resources.dll 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_backarrow_default.svg 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\7-Zip\Lang\ne.txt 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.EventBasedAsync.dll 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.AccessControl.dll 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ru-ru\ui-strings.js 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\images\example_icons2x.png 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ul-oob.xrm-ms 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-black\MedTile.scale-125.png 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Cloud.png 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-black_targetsize-72.png 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-gb\locimages\offsymb.ttf 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\dev\app-api.js 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-ae\ui-strings.js 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\lv_NEUTER.pak 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Generic.xaml 2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-12_2dc26f6714472ec946e9dfb54f07498e_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:892
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.dll
- Size 5.9MB
- SHA256 480028acaa34a0bc20479ed154734c69d72e1cc0ff1028a6a81830bc2935035c
- MD5 bd12ddff479437607c62dd43cb1a50cf
- SHA1 af03e9827574e82ab04c39e8acdbb07e3a315eb6
- SHA512 b6b4434d58f3a15ecb78d15a3aa5b5e9c9e59c596f44b835711a126b3ea75c2f205db4f2f85e3bbea725ec924744d4ce7ba35db0b3103c6beca5bc9d9943a70f
- SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/VMpruqNRK2A:pWvSDzaxztQVMprvA
- TLSH T1C456CF07FCA514F9E5A9E234867497527A727445473023D32BA4BABF2EB37C85E38390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 5.8MB
- SHA256 201843a705c73580da1e5123bead381add0d0f690abbd87ef7c4c2a9bfc224c9
- MD5 484aaa2814166a685027696b98bc6987
- SHA1 3ee4e0ac2b78cfadd70afe6ef27a6ac4faff3b3e
- SHA512 c5241c210bed5bbadb515dfc79488e2bd22616a6a355e8e4c58079ea87c3e43e4cc5048825475d3189ec51241dd05092a0ec3a9e66d010c2b10da2df0312881c
- SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/VB/naYOglqqchjRqxi2:pWvSDzaxztQVBRldfl
- TLSH T10356BF13BC9522AAC6FDF271886586963A34B454033037F72F24AAB75A37FC81E78351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 3.4MB
- SHA256 09564c51417b47a5880e3fe50c8b46617f0ff944cbbb8c7fdfe414dbf2443c5e
- MD5 4d9125726862b6729bac40b0682b9876
- SHA1 81c458f2e241b507670ea666437569ff3c2b77a7
- SHA512 f132848e96a989835e1d4417880e501faa3a053fe0275c88892e972461112f338dbdcbfd2ff42eafde943f27c72cfaa7572b1422e62577d2d355203a83bf461e
- SSDEEP 49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q4g:ieF+iIAEl1JPz212Ihm
- TLSH T14FF57C43FC9150B9D0AAF2308A6583927B717899473123D32B60EBBB2F76BD45E78354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 4.1MB
- SHA256 e27e7d88ebda4e487d861dc3a2c470a5e6e8ba7c9de2549a7d6d91e22aadbe33
- MD5 11334596df6a6e816267ddc1b21715f4
- SHA1 46312e2faacdaaa7a4d6525399f9028552fee7c3
- SHA512 edbc6109044eafbd19448dd66d1c5eefdacd896a300c3bfc76a21cd69a5f36d3d2440f1e952e1e5b7fda927ab5df7db4b9a0b9e43950a5964985c73be9ef5ead
- SSDEEP 49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q4V:ieF+iIAEl1JPz212IhzL+Bzz3dw/Vf
- TLSH T17C169D03FC9564A9C5E9F23089B583927B71B858473127D32F64ABBB2A777C41E78390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 4.0MB
- SHA256 8a8379a04a557d179b9305e821ce52be2d58a2abaa0e214389444af75f680062
- MD5 f598cf5f5e7f87d09694482a5e7c193a
- SHA1 569478cc38b6600a96054a439705b4a955c245e2
- SHA512 8f0537af8fc538fcd51ee65ab28c0c63433a759ab5f4aaae929c8de51781bdd531ad6f6645ca43e26d9bfb358cea20d6e74cd04cafbfacdb7658afa25fc02054
- SSDEEP 49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q4n:ieF+iIAEl1JPz212IhzL+Bzz3dw/Vd
- TLSH T17C168D03FC9564A9C5E9F230897583A27A717858473127D32B64ABBB2E73BC41F79390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 4.1MB
- SHA256 a1b330cc00c66e93ad8dff4073a76c288cd3ccae426e976f8f618ee46f99f97d
- MD5 53c0a2f7f40a80756bcd17ce0d05e4e2
- SHA1 ef7ef331efdc8299000d64a2eccd2a2cd3d8494f
- SHA512 936591621a466c37b8f580a8d0ff513a862f4fea2696983b156778fb97b8e87ff5ce80046409d61fa487d1598c37113bcb2cda48561b3775ae9a0ea3ce9d5178
- SSDEEP 49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q43:ieF+iIAEl1JPz212IhzL+Bzz3dw/Vh
- TLSH T1AD169D03FC9564A9C5E9F230897583A27B717858473127D32B64ABBB2E77BC41E78390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 3.5MB
- SHA256 616d0ce54a2eb252356c947fb44c7e731678455c3956fec8729248972cd99f9e
- MD5 a6ffadb2f603a4f428d1a06c7ce06d09
- SHA1 ce7df80d8335660192c398ce797978576dcb1e9a
- SHA512 485589256ff2e28909d73b2ec42bd8a8d326489f21acba344de272532cd43a6f2aa2f2a22f0510b20a1a0e3dc8b363376659c11d45c1b5a6752ca51da7143416
- SSDEEP 49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q46:ieF+iIAEl1JPz212IhI
- TLSH T167067C43FC9150B9C0AAF2308A6593927B717899473123D32B60EBBB2F76BD45E78354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 3.8MB
- SHA256 461dc0fdcdadb524451c35394b80919224095058373dc24b7babd5856bbae44f
- MD5 df3baf3940d470168d9dfdcc74ea695a
- SHA1 7186bcc5ad9588e74d42019c90f8f53623615ea9
- SHA512 8e62df2e255d4d7a1909a7dec856d75d2d95d8a7da7927c1864f5b35c9abe1a2371bce164d70098db0450dba1680a2d0b6bdcf232c9c8036078d07005e77cfee
- SSDEEP 49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q49:ieF+iIAEl1JPz212IhzL+Bzz3d+
- TLSH T12E068D43FC9150A9C0AEF2308A6593927B717899473123D32B60EBBB2F76BD45E78354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 2.6MB
- SHA256 14c3668ceecbb55130eea10171642d8ad9ce3515cee2eb7f5a4cc34ca1be82f5
- MD5 7cf17259a448b6f4365f8faa629faf13
- SHA1 c84d3c640cee9084a9fedd9b2652163e7d321391
- SHA512 0b9c46a28c601fb1e66cdb6759bbbf33f827ccbbc24ec8033238fe4d48ea1443ecbff5d02c988bfd7cded0d61b898c048ffa4c9486541f8b6f51df101534a508
- SSDEEP 49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi912:ieF+iIAEl1JPz212
- TLSH T127C53A43FC9150B9D0AEF231CA658392BA717898473123D32B60EBBB1B76BD45E78354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 2.4MB
- SHA256 d30248dd26f9535e85951cdb7f88689143a7782f2444e310b210cedfa7cc531f
- MD5 00851723438261858bc99f44c4049a8a
- SHA1 b842b5a074c3005342e991b53278a43444bf01c0
- SHA512 e2d0aec0cfc1e88bc4e2f910bac856bc36c5b5c92e5a798aa9e011926572bc61fb2564f11e2bf7907db7f42adaf5cfec045d9eb6afa8c05dfbb7753dd48b98d1
- SSDEEP 49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi91h:ieF+iIAEl1JPz21h
- TLSH T199C54A43BC9150B9D0AEF231CA658392BA717898473123D33B60EBBB1B76BD45E78354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 2.6MB
- SHA256 0fa25dbf5e28c573a96b5ce8dadf3fa2e1c80fb013f366f4b36fbb9ed925b57c
- MD5 53681bbe39d2998207d40f2a7ac76635
- SHA1 0d23cb4441d92b05364ea73004a243d9b1806e5a
- SHA512 d3e19f8635d72efa4a114dc1dc30bb94b4883ff10f82aa45c2c00b5970a2a34603fbad31259ec39b48a9da15e04c94da18aba3825d1a97105e6ae05f34e5b3af
- SSDEEP 49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi912T:ieF+iIAEl1JPz212T
- TLSH T157C53A43FC9150B9D0AEF231CA658392BA717898473123D32B60EBBB1B76BD45E78354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 2.2MB
- SHA256 42503105300479e0c84d4928463c14735b93e63f49f992a9d6387269d5a2bc53
- MD5 73cc3fb01ee8c305be995416d1424d15
- SHA1 98f209f1d0819bf786fb036aa14c26b3b39c597d
- SHA512 7f9ebd348f6f0dc63eaa58f55386a2a46f17567397107a707200135f5602cdf31ee795029a1c038640225a9f184d879115cdb0c01e09f33538dcd5621a5e6650
- SSDEEP 49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi91n:ieF+iIAEl1JPz21n
- TLSH T194B53A07FC9550B9D0AAE231CA659292BA317898073423D33F60FBFA1B76BD45E78354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 2.3MB
- SHA256 f1be19823fcb7a131aa949e9761f491a7b1995aa0fffd7dbc65663879b703639
- MD5 93cd5723af6bcdf6f41e6b0b72da9476
- SHA1 c55b6837677d36db3535a7e8fe8ac5e44add16f4
- SHA512 225952f2d09fcd55bd123fab07c07fd683ef8dc93e96d165f0c6573dcc05701503da93d3b36fa4cbdb32a770e52ce4e7716e34c004f11ccff0357640d078b6a9
- SSDEEP 49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi912:ieF+iIAEl1JPz212
- TLSH T14DB53A43FC9150B9D4ADE231CA659292BA717898073023D33F60EBBB2B76BD45E78354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 1.4MB
- SHA256 763839f5019b46a438522e19ccf4aeabb0f4373b46ec26455df22bc30e6fed53
- MD5 3002b80c96bcf8bce912e2599fb99365
- SHA1 e83e7221e83fe9d3740f4f35471eeb12865d8bbf
- SHA512 246c02c2423d744070006be57b30821d05b4047fa4d857c065cdf0104adafbb31ded8828400b2b7a5387534d6ff4bb346ba75643ef9aca7479e9934d9fab7945
- SSDEEP 24576:ieKneLwfzO9rb/TrvO90dL3BmAFd4A64nsfJJkEq9s8li/FeUsGNP1JrSF7bh:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJ
- TLSH T1F2650957A8A510FCC0EEE174C629A223B9613499073437D36FA057F21B76FE86A7C364
- MD5 SHA1 SHA512 SSDEEP TLSH