Analysis
- max time kernel
137s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/09/2026, 03:26
Behavioral task
behavioral1
Sample
2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
- Size 15.1MB
- Sample260916-dy98csszbt
- SHA256 7884a73a4bbe1dbc76995f927c73c889d1810b89176b8940a4a5ea39f39f7728
- MD5 bba928603bc2f96db92217b140efa1e7
- SHA1 e25a997d855d27b02e61aca8b7b0127179011cb8
- SHA512 e583f47c3de4cb9e50155fe1c4d9bd31f0080f3f207c2aba1be87ee8de9dce12cec324e4eec94a9ecca88dd7384c4260695e02d8923810e492284afc23f88a30
- SSDEEP 393216:8KVCjwvMs71hAW7qx7lHHGYD+/oozN0N8DK:8jshJhl6nD+/oasuK
- TLSH T1D9F61203FC9564B9C5E9F23089B583927B71B858473123D72F64AABB2A737C45E78390
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: Gofing
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
- Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation. 13 IoCs
resource yara_rule behavioral2/files/0x000300000001b227-4.dat family_gofing behavioral2/files/0x000300000001a512-5592.dat family_gofing behavioral2/files/0x000300000001a04a-5603.dat family_gofing behavioral2/files/0x000300000001a04a-5601.dat family_gofing behavioral2/files/0x000300000001a04a-5613.dat family_gofing behavioral2/files/0x000300000001a04a-5619.dat family_gofing behavioral2/files/0x000300000001a04a-5609.dat family_gofing behavioral2/files/0x000300000001a04a-5633.dat family_gofing behavioral2/files/0x000300000001a04a-5639.dat family_gofing behavioral2/files/0x000300000001a04a-5645.dat family_gofing behavioral2/files/0x000300000001a04a-5643.dat family_gofing behavioral2/files/0x000300000001a04a-5651.dat family_gofing behavioral2/files/0x000300000001a04a-5638.dat family_gofing - Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
- Executes dropped EXE 1 IoCs
pid Process 5296 Process not Found - Loads dropped DLL 23 IoCs
pid Process 5296 Process not Found 5296 Process not Found 5296 Process not Found 5296 Process not Found 5296 Process not Found 5296 Process not Found 5296 Process not Found 5296 Process not Found 5296 Process not Found 5296 Process not Found 5296 Process not Found 5296 Process not Found 5296 Process not Found 5296 Process not Found 5296 Process not Found 5296 Process not Found 5296 Process not Found 5296 Process not Found 5296 Process not Found 5296 Process not Found 5296 Process not Found 5296 Process not Found 5296 Process not Found - Drops desktop.ini file(s) 14 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\desktop.ini 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\desktop.ini 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\$Recycle.Bin\S-1-5-21-53044966-3830981193-2402648431-1000\desktop.ini 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\msoutilstat.etw.man 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUEPRNT\BLUEPRNT.INF 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_chromecast_plugin.dll 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\ui-strings.js 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\cs-cz\ui-strings.js 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Locales\fi.pak 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\msedgeupdateres_mr.dll 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\7-Zip\Lang\pt.txt 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Java\jre-1.8\lib\resources.jar 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART9.BDR 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\DOC.CFG 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\plugin.js 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Common Files\microsoft shared\ink\id-ID\tipresx.dll.mui 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-ul-oob.xrm-ms 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\WelcomeCardRdr-2x.png 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\core_icons.png 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OutlookLogoSmall.scale-140.png 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Resources\1033\msmdsrv.rll 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\contrast-black\WindowsSecurityAppList.scale-100_contrast-black.png 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\da-dk\ui-strings.js 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\vlc.mo 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\mscorrc.dll 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\uk-UA\TipRes.dll.mui 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\VisualElements\SmallLogoDev.png.DATA 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\tipresx.dll.mui 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.SapBwProvider.dll 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Mozilla Firefox\precomplete 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations.png 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ppd.xrm-ms 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.OData.NetFX35.dll 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationTypes.resources.dll 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\acrobat_pdf.svg 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\example_icons2x.png 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sk-sk\ui-strings.js 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART1.BDR 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\APPT.CFG 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Windows Media Player\uk-UA\setup_wm.exe.mui 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationClient.resources.dll 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\System.Windows.Forms.Design.resources.dll 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Locales\nb.pak 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Locales\de.pak 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-pl.xrm-ms 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ul-oob.xrm-ms 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_company.png 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLENDS\BLENDS.INF 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Csi.dll 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\WindowsSecuritySplashScreen.scale-150.png 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\uk-UA\MSFT_PackageManagement.strings.psd1 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-180.png 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libgradient_plugin.dll 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\hscroll-thumb.png 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_100_percent.pak 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-ul-oob.xrm-ms 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\CONVERT\1033\OLR.SAM 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Portal\PortalConnectCore.dll 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\VideoLAN\VLC\lua\meta\reader\filename.luac 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\PresentationNative_cor3.dll 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\oneauth.dll 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-phn.xrm-ms 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\rsod\proof.en-us.msi.16.en-us.boot.tree.dat 2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-16_bba928603bc2f96db92217b140efa1e7_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:1824
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.dll
- Size 5.9MB
- SHA256 624d2f17e0d317c339ced5b919a9ea11f6efbe1c5196c9bd8a1c5115f979673c
- MD5 3fac821dec92df9c2b26c2966781a3d7
- SHA1 389af62efb67dd7fcabc17543aa3ecebfd9ec4b4
- SHA512 b70e82dd24d3bafc9d7357abeda24c0be07fb38a006434ae125d5e1774dd3e349170e4843a5ab6be6c2ccfab84387529d22966eaa97ef3df9fcf1de77fcd63da
- SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/VPhw56WRfcW3:pWvSDzaxztQVPUX
- TLSH T12C56AD03FC9124A9C6E9E2318A7587127A71B8654730A7DB2F75A6BB2E737D01E7C340
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL
- Size 4.4MB
- SHA256 7784343be7dc86482515d9f77fd251cc95d00ddca49b3c447ab8f652070fdf18
- MD5 ac89e4c15ab95aedf560e5628a390e2d
- SHA1 67797127d78a8cddfe05a07ccc6977584f8e0a3a
- SHA512 413b8d8a2c7d3349cd2a31cebc337ef1d9c778febc8458e18a0609099adff7ebc6d985d0c26a99f88bbb292203a5bb7243cf931ac076111ad4be0bb69f85378c
- SSDEEP 49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q4r:ieF+iIAEl1JPz212IhzL+Bzz3dw/VWYr
- TLSH T1D0269D03FCD565A8C5E9F231897593527B70B848433163D32B65AABB2EB37C45EB8390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 5.8MB
- SHA256 cb45e30aa670c8a3f2ced032224ebad8ed8e818166cca770ee05f8319ee283d3
- MD5 c329fe8e4942002acbd7a75b9287874f
- SHA1 51e8769553a6b39b5d5accfd09ab78cc68d1a160
- SHA512 a75ba9bf4957fe400183b08cc900df493bedd73780ed30ba62bce51f92c16a18c28dd3a427b3b5d63b0f2c154a6c9f28115b0d9bf512a7ac99be05d77ff97d54
- SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/VudCsYhMTT3MB6u:pWvSDzaxztQVbhM/3MB6u
- TLSH T14F56AF13F85950AAD6E9F231CA6347527A76B894433163D73B24BEB72A727C01EBC350
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 5.4MB
- SHA256 d89673e488f2fdcfd211685397718091184a017a197892ec1c1a8097db8096be
- MD5 d212091b723bf6eb529bcf5b74fb6c75
- SHA1 ed04976e0da5b362769eb111d97e48fc03f10df3
- SHA512 371a74f9bc3dc8e2896e5b1985b857af83e30b36ff5f3c5d432777c558d3945f27e504af17d39e9591b278c1999779ea62de1da78ed688a8f49dc33805b61a29
- SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/VudCsYhMTT3MB6E:pWvSDzaxztQVbhM/3MB6E
- TLSH T17A46BF03F89954A9C6E9F231C96787527A727858473123D73B64BABB2A737C01EBC350
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 5.1MB
- SHA256 427acb8f318a5e0886a6689bf45d7c358dc9ef837425c6237eb2d70a6c7c3b01
- MD5 6b65733170f46ad685b361c3886b1394
- SHA1 a4969d94f8e17b50efaa60b7dabbcaad11239bdc
- SHA512 c41e37230a0c3769c5ac95765cbc79115e8246496f0fcf8ff295725690941462b458c3ad29853c37e05f0398356920cd340314f1388a38d9b80c4031c6e6e9b3
- SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/VudCsYhMTT3MD:pWvSDzaxztQVbhM/3MD
- TLSH T13D36BE03FC9564A9C5E9F23089A583627B71B858473163D72F64ABBB2A737C41E7C390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 4.9MB
- SHA256 8193d43fabc978f9790cb76d337cb50be2cfd1c811f8073e6d82fbd2fefabcd6
- MD5 3a164bd84f70169769f21ef18de108cc
- SHA1 cafe087d65a68aeeb5f64251642d2aeb54c3359c
- SHA512 44fe89b62a257355cee54cdfcbadfc9d3554e4081f43d50e2689208ba39f598e328fcecfebeff415ea2ed25d86f83f728ddd031bf044d641d2ee5bf67898336b
- SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/VudCsYhMTT38:pWvSDzaxztQVbhM/38
- TLSH T10436AD03FC9564A9C5E9F23089B583627B71B858473163D72F64ABBB2A737C41E78390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 4.9MB
- SHA256 b233e36a38a36bd175a6954faadd6450af553b8236dbb159ea1759cbe7bdcdd0
- MD5 d5910bdd92b85669baef5d7d049a2fec
- SHA1 c290f7dfb2cb64fb5e2139ceddf5363ed021fbc0
- SHA512 f477f3065c03f04abba9cbe6b87b3d12b43eb70fc4522ec1d6c5ec213405a9211f393f4a259e1d3bbdd2bb1da0f3ed59cf04ba14fda69402707aabe442529c04
- SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/VudCsYhMTT32:pWvSDzaxztQVbhM/32
- TLSH T13136AD03FC9564A9C5E9F23089A583627B71B858473163D72F64ABBB2A737C41E7C390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 3.8MB
- SHA256 461dc0fdcdadb524451c35394b80919224095058373dc24b7babd5856bbae44f
- MD5 df3baf3940d470168d9dfdcc74ea695a
- SHA1 7186bcc5ad9588e74d42019c90f8f53623615ea9
- SHA512 8e62df2e255d4d7a1909a7dec856d75d2d95d8a7da7927c1864f5b35c9abe1a2371bce164d70098db0450dba1680a2d0b6bdcf232c9c8036078d07005e77cfee
- SSDEEP 49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q49:ieF+iIAEl1JPz212IhzL+Bzz3d+
- TLSH T12E068D43FC9150A9C0AEF2308A6593927B717899473123D32B60EBBB2F76BD45E78354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 3.8MB
- SHA256 b03bd1574a140c363e7704895bf97a973ca444a091dccad1a9d88798d6db0e0d
- MD5 a69a16b5e3d64ab07b3e8472e7bb1e35
- SHA1 35dbb39461242ee45056053a1decd092c4f93b52
- SHA512 d9cdd1de24e6af08dd6d2cd7d2a6dae8ce3516f392dd12a56f7c1541ca77ad3ee553d2afeed0a7304b75978e77ae0329f7ddb75d9b600a2fc2ee1ff8d5de7010
- SSDEEP 49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q4W:ieF+iIAEl1JPz212IhzL+Bzz3z
- TLSH T1BE068D43FC9150A9C0AEF2308A6593927B717899473123D32B60EBBB2F76BD45E78354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 3.8MB
- SHA256 19625ed496856b4e0ee228a8c391d88a460a9137892b33a4c0104045d4077fcb
- MD5 9394dc18a05f953b11c0b70c9e6d1aee
- SHA1 a4608e11b78c15c2ddc4082073e0be5f77ec28aa
- SHA512 6a8701f386fbb41aa353f0e6a71ba66221291ef0721e3082e6a8fc08f7fd521b009360ec99384cb61b593cadeff303855044d3eec951630dd48d2f02000f42c4
- SSDEEP 49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q4f:ieF+iIAEl1JPz212IhzL+B6
- TLSH T15F068D43FC9150A9C0AEF2308A6593927B717899473123D32B60EBBB2F76BD45E78354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 3.7MB
- SHA256 c52f45b30e725f61d19a116f3742f44f300d4ce4e6781298318175b44fe4adc6
- MD5 25fd629528967cb8a9c63113454b9c35
- SHA1 8402ed9660f6ccc51346b51966ed4d3d138ed1ba
- SHA512 1c2708f7e9cebc2fad23a2dbfd9afa9d20770f1c154071a5d0ee8a6e1288c7e6a17563cc2d59cab9233993dfa3b371d4526b0bf5e4173312b94f0b2fab84ceff
- SSDEEP 49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q4f:ieF+iIAEl1JPz212IhzL+Q
- TLSH T12A068C43FC9150B9C0AAF2308A6593927B717899473123D32B60EBBB2F76BD45E78354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 3.6MB
- SHA256 aff0468aff94e55f1b86e2921d8f61fa769218eb07bdf6288a2f69702728f3d3
- MD5 3f10698f543d43857124f094034fec4b
- SHA1 60f12f06ac300fb5dc9d0f076f392bf3a9908b7a
- SHA512 aa42c3d477f1b535a8c2450c03f12012da6a404fbe06d45b4615de9518a2627b0f96aa7107a5e90398aeee13570dad1e4bd47afaba45cd015e987e489ef4c909
- SSDEEP 49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q40:ieF+iIAEl1JPz212IhzL+
- TLSH T19D068C43FC9150B9C0AAF2308A6593927B717899473123D32B60EBBB2F76BD45E78354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 3.5MB
- SHA256 616d0ce54a2eb252356c947fb44c7e731678455c3956fec8729248972cd99f9e
- MD5 a6ffadb2f603a4f428d1a06c7ce06d09
- SHA1 ce7df80d8335660192c398ce797978576dcb1e9a
- SHA512 485589256ff2e28909d73b2ec42bd8a8d326489f21acba344de272532cd43a6f2aa2f2a22f0510b20a1a0e3dc8b363376659c11d45c1b5a6752ca51da7143416
- SSDEEP 49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q46:ieF+iIAEl1JPz212IhI
- TLSH T167067C43FC9150B9C0AAF2308A6593927B717899473123D32B60EBBB2F76BD45E78354
- MD5 SHA1 SHA512 SSDEEP TLSH