Analysis
- max time kernel
147s - max time network
131s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/09/2026, 07:43
Behavioral task
behavioral1
Sample
2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
- Size 8.1MB
- Sample260916-jker7avvez
- SHA256 4ec4ef333bdb9d8cb8125c79aa2132718c2cbc8ea547b4d0efd68f708c4c032f
- MD5 fe11b5a4af67487748c682314911cea4
- SHA1 3beb73173b2692e1b427733d53666ef93ef6b027
- SHA512 69fe76a615e97a471b74b1d4d1b34d79f4b6a46538c3965b4aea614562ccea5287f4a1108dd6b59f407f23c7efd537187f76535966691cb315d21aa3764ca40d
- SSDEEP 196608:pWvSDzaxztQVmQo++0M7UjE+3/wL6N82QpqkV:8KVs9mMs3/wLb/AkV
- TLSH T11586E003FC9564A9C5E9F23089B583927B71B858473123D72F64AABB2E777C41E78390
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: Gofing
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
- Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation. 8 IoCs
resource yara_rule behavioral2/files/0x000300000001b222-4.dat family_gofing behavioral2/files/0x000300000001a4e2-5583.dat family_gofing behavioral2/files/0x000300000001a519-5597.dat family_gofing behavioral2/files/0x000300000001a4e2-5609.dat family_gofing behavioral2/files/0x000300000001a4e2-5611.dat family_gofing behavioral2/files/0x000300000001a4e2-5608.dat family_gofing behavioral2/files/0x000300000001a4e2-5607.dat family_gofing behavioral2/files/0x000300000001a4e2-5606.dat family_gofing - Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
- Executes dropped EXE 1 IoCs
pid Process 1940 Process not Found - Loads dropped DLL 24 IoCs
pid Process 1940 Process not Found 1940 Process not Found 1940 Process not Found 1940 Process not Found 1940 Process not Found 1940 Process not Found 1940 Process not Found 1940 Process not Found 1940 Process not Found 1940 Process not Found 1940 Process not Found 1940 Process not Found 1940 Process not Found 1940 Process not Found 1940 Process not Found 1940 Process not Found 1940 Process not Found 1940 Process not Found 1940 Process not Found 1940 Process not Found 1940 Process not Found 1940 Process not Found 1940 Process not Found 1940 Process not Found - Drops desktop.ini file(s) 14 IoCs
description ioc Process File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\$Recycle.Bin\S-1-5-21-1404337215-1550464601-2805570857-1000\desktop.ini 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\desktop.ini 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\desktop.ini 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\centered.dotx 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Stationery\1033\NOTEBOOK.JPG 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STRTEDGE\THMBNAIL.PNG 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Inquire.dll 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\vlc.mo 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\uk-ua\ui-strings.js 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationUI.resources.dll 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\Info.png 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\OFFSYMSB.TTF 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.Selectors.dll 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WindowsFormsIntegration.dll 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ReachFramework.dll 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Internet Explorer\it-IT\ieinstal.exe.mui 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\delegatedWebFeatures.sccd 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Windows Media Player\it-IT\wmpnssui.dll.mui 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense2019_eula.txt 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-TW\msipc.dll.mui 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\RECALL.DLL 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationUI.resources.dll 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_sortedby_selected_18.svg 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\uk-ua\ui-strings.js 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Locales\km.pak 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Trust Protection Lists\Mu\LICENSE 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Java\jdk-1.8\jre\README.txt 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\BOMB.WAV 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\selector.js 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\cs-cz\ui-strings.js 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\file_info2x.png 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\ResiliencyLinks\Locales\ga.pak.DATA 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-phn.xrm-ms 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Xml.Linq.dll 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Controls.Ribbon.resources.dll 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.Primitives.resources.dll 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\WindowsFormsIntegration.resources.dll 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ja-jp\ui-strings.js 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RADIAL\RADIAL.ELM 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libspudec_plugin.dll 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\dark\example_icons.png 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\check-mark-1x.png 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\inline-error-1x.png 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Windows Media Player\en-US\wmlaunch.exe.mui 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\7-Zip\Lang\an.txt 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-heap-l1-1-0.dll 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\OMSMAIN.DLL 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\tmapi_xl.dll 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\stdole.dll 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_output\libdrawable_plugin.dll 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\eula.ini 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main-cef-mac.css 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\FUNCRES.XLAM 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\FPSRVUTL.DLL 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\Assets\UnknownErrorIllustration.theme-dark.png 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ko-kr\ui-strings.js 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ja-jp\ui-strings.js 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Common Files\System\ado\es-ES\msader15.dll.mui 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Java\jre-1.8\bin\server\jvm.dll 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-phn.xrm-ms 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OutlookLogo.scale-180.png 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\ACADEMIC.ONE 2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-16_fe11b5a4af67487748c682314911cea4_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:3652
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.dll
- Size 5.9MB
- SHA256 1630c11a362c7e40c5a7164d35f874f7f4123e42c466f5a23c9bf092d2680302
- MD5 9b64ac37a962a424c7274b353f21c2fd
- SHA1 593899a769f4da4e8d8fccf47bdc7d71336a0247
- SHA512 f50ec6544fa9079bb0e21baffd4abde11f163a091d506555f7d61f317c245bca08f5749a8aaa17870e7c4da3c3618382b31f12a2caf5c92d6eedc60558484773
- SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/Vd9Bu4/pqQJ6:pWvSDzaxztQVn8NQ0
- TLSH T18256BF03BC9424A8C5E9F631C97993A17A71B854473123EB2F60A7776AB37C45F783A0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL
- Size 4.4MB
- SHA256 044933314a3a0183ed9dd1a3a26144b9f4509bb5b447282eb85ebfde1fc0cbad
- MD5 3ba45c4dbd9083fc882a73c9f8e059fe
- SHA1 cc09037ad5c814e2dc2b7a4620af66fe00b675b6
- SHA512 9129e55889d6c82e494c359046968228622a5f2dea7aca494a175f97c46086098ab0f842df3dc0f92b50535b9d32374a9059c7f8e706bfa36c6f63662a4b93bf
- SSDEEP 49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q4d:ieF+iIAEl1JPz212IhzL+Bzz3dw/VM6
- TLSH T121269D03FC9464A9C5EAF231897993627A317849473123D32B64A7BF2E777C41EB9390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 5.8MB
- SHA256 38e876c94a4ac374ceb01493493c1b9c18ec0a62836dd4d96142b45d63e8bec6
- MD5 8e40111c4bd0a32ed5aee6ca297ccbde
- SHA1 cf9da27d79c7f1e96e33edc400cb6e2d86398151
- SHA512 f671d1cafd16c68a2f14f5962efe91c5bf2936a89857370c3d8748f1dbc38781dfa163d10ad4d5b35dd39f14a3ba3b6084eb28f30bd1582a1bfefb6c152b0188
- SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/Vj4JLiTmWP+sfmPYg6S/SkfKxDZMrE64:pWvSDzaxztQV2iTdfmPYg6sSkfKxDqwB
- TLSH T1A556BF03F89460E9C1E9F2728575926236317C5C433263E72B63A7B7AA3E3D41E79348
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 2.3MB
- SHA256 f1be19823fcb7a131aa949e9761f491a7b1995aa0fffd7dbc65663879b703639
- MD5 93cd5723af6bcdf6f41e6b0b72da9476
- SHA1 c55b6837677d36db3535a7e8fe8ac5e44add16f4
- SHA512 225952f2d09fcd55bd123fab07c07fd683ef8dc93e96d165f0c6573dcc05701503da93d3b36fa4cbdb32a770e52ce4e7716e34c004f11ccff0357640d078b6a9
- SSDEEP 49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi912:ieF+iIAEl1JPz212
- TLSH T14DB53A43FC9150B9D4ADE231CA659292BA717898073023D33F60EBBB2B76BD45E78354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 2.2MB
- SHA256 dd24d34a4a24128ee647e1a1098fe33595d79cfbc4949208e34920d234091002
- MD5 cdbb3c6e77b41ee2dc53bb3622c2bb72
- SHA1 20ddb6352fbebd9bdf324cddc669858a72ac39ad
- SHA512 caf723fae7ef1ab60450299ff95dd613516306706df6070eaa29ec84ddf8f43d62078c17aea3c3e0a7585f4f4c70fa81a2d2501238373a8feaf10d3e71435465
- SSDEEP 49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdiy:ieF+iIAEl1JPzD
- TLSH T14AA52A47BC9550B8C0AEE231CA659293BA617898073023D33F60BBFB1B76BD45E78354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 2.4MB
- SHA256 d30248dd26f9535e85951cdb7f88689143a7782f2444e310b210cedfa7cc531f
- MD5 00851723438261858bc99f44c4049a8a
- SHA1 b842b5a074c3005342e991b53278a43444bf01c0
- SHA512 e2d0aec0cfc1e88bc4e2f910bac856bc36c5b5c92e5a798aa9e011926572bc61fb2564f11e2bf7907db7f42adaf5cfec045d9eb6afa8c05dfbb7753dd48b98d1
- SSDEEP 49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi91h:ieF+iIAEl1JPz21h
- TLSH T199C54A43BC9150B9D0AEF231CA658392BA717898473123D33B60EBBB1B76BD45E78354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 2.2MB
- SHA256 42503105300479e0c84d4928463c14735b93e63f49f992a9d6387269d5a2bc53
- MD5 73cc3fb01ee8c305be995416d1424d15
- SHA1 98f209f1d0819bf786fb036aa14c26b3b39c597d
- SHA512 7f9ebd348f6f0dc63eaa58f55386a2a46f17567397107a707200135f5602cdf31ee795029a1c038640225a9f184d879115cdb0c01e09f33538dcd5621a5e6650
- SSDEEP 49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi91n:ieF+iIAEl1JPz21n
- TLSH T194B53A07FC9550B9D0AAE231CA659292BA317898073423D33F60FBFA1B76BD45E78354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 2.1MB
- SHA256 29050c5668a7b56a0d6dd14120bf672a2c6628f6c5478a8f18699f2eb0769bcf
- MD5 2f56e3224e742ef687ae66050fc465ab
- SHA1 85d87d755fcc9b64180ebf0df478703da845acc0
- SHA512 ce1521da049df6272cfa5f836d1f17685baefee7c4926cf25724d466fbcfbfcf1a1d134440e85996c80408d0e09fc09f1472e86088b623173568cd147e199fa7
- SSDEEP 49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAP+:ieF+iIAEl1JP+
- TLSH T14DA51947FC9540B8D0AEE231CA6592937A6178980B3423D33F60BBBB1B76BD45E78354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 1.6MB
- SHA256 702140ea33c21d42010cd470d1948328dc752a56d0f05470e32c34dda29f805f
- MD5 35ea6273669c29c91809980b6f25650e
- SHA1 87afcf3694d16d8e2dbfb4ce08707244465bb04d
- SHA512 4913d6af4f7b496cdc2b1763a4bfebe7f881525ae534f0ce0bead4d2ad7122680ae90c4b0d34185e2c58b3ec23e4fc0834f5abefe37b0ab2a5ba6ec616e4a89a
- SSDEEP 49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u2:ieF+iIAEl1JU
- TLSH T150750957B89540ECC0AEE174C6659213BA613C98073433D36FA0BBF61B76BE46A7C364
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 1.6MB
- SHA256 e9a7627420fff107e33635218e913853c7ededdc89af4c78db3b01aa5640a74b
- MD5 84a18936062d0eece34b68568da1a310
- SHA1 4c40f6d69643b2b187aa3afe3183660e9e495bd8
- SHA512 67cfa47d76b1faa45f62d0e20189d76dc51a8ab7878f64ec0feb6cabca6c89d78016da545acb91b68ac622b836e7325ba79846a0bd841600fa18bde7a0c84c0f
- SSDEEP 49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4uo:ieF+iIAEl1J2
- TLSH T19F75F857A89510ECC0AEE170C629A213B9613C99073437D36FA077F61B76FE86A7C364
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 1.4MB
- SHA256 763839f5019b46a438522e19ccf4aeabb0f4373b46ec26455df22bc30e6fed53
- MD5 3002b80c96bcf8bce912e2599fb99365
- SHA1 e83e7221e83fe9d3740f4f35471eeb12865d8bbf
- SHA512 246c02c2423d744070006be57b30821d05b4047fa4d857c065cdf0104adafbb31ded8828400b2b7a5387534d6ff4bb346ba75643ef9aca7479e9934d9fab7945
- SSDEEP 24576:ieKneLwfzO9rb/TrvO90dL3BmAFd4A64nsfJJkEq9s8li/FeUsGNP1JrSF7bh:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJ
- TLSH T1F2650957A8A510FCC0EEE174C629A223B9613499073437D36FA057F21B76FE86A7C364
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 1.5MB
- SHA256 90cee48e0f3866f2e4a490f9223bdc765c756d212f9fc97fab63842703a667aa
- MD5 f555ea645da9076d759d979e30be307e
- SHA1 760124f47bf1a719c38650f3b294cc63ba71314a
- SHA512 a7f60cb98275bb6d71dc6ba11d3c13ed5658b29c1359a054c70be6266f0c20f4f18a366ac3f64fef2c0287703be34295f8811311b20662efa157776d1b07ca27
- SSDEEP 24576:ieKneLwfzO9rb/TrvO90dL3BmAFd4A64nsfJJkEq9s8li/FeUsGNP1JrSF7bhi:ieutLO9rb/TrvO90dL3BmAFd4A64nsf3
- TLSH T13175E857A89510ECC0AEE170C629A613B9613C99073437D36FA077F21B76FE86A7C364
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 1.2MB
- SHA256 ee41a310a3bd0c0dc6f2a11e8ea4f5454102376c9ff46291d6012014f0702dd8
- MD5 bad75f202ed22f93f4ed2aec4d29b557
- SHA1 82f5e69dda164a58e6bcc1621b58ab82d3b9b103
- SHA512 2712d29f8fb32758a665b20757059c4a210cf30e1f3aca50250b8773a3ca858c967a224c589e43929b99818fbd51dac2cc2ea83b5e648b544b527dd1c90eca00
- SSDEEP 24576:ieKneLwfzO9rb/TrvO90dL3BmAFd4A64nsfJJkEq9s8li/FeUsGNP1JrSa:ieutLO9rb/TrvO90dL3BmAFd4A64nsfn
- TLSH T19E550857ECA510F8C0EED174C629A213B9613099073837D76FA187F11B66FE86ABC364
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 1.2MB
- SHA256 f8083eb00afe643c9993920bc6ffbff48560e79cdbdf00403845b13782daccc2
- MD5 98d4e196d7b293bbb627e2f2f84f227f
- SHA1 e59dd21470e63e9325596f7b1486a9dd1b222998
- SHA512 e3ae6ba9a02398b82aed887e75061559fa09acaebe3fe50ebc7fea47879af53d9371f064c380d0c3b47c645a63e533406bb566b1633ccb5341ee05dc8503d899
- SSDEEP 24576:ieKneLwfzO9rb/TrvO90dL3BmAFd4A64nsfJJkEq9s8li/FeUsGNP1Jrs:ieutLO9rb/TrvO90dL3BmAFd4A64nsf6
- TLSH T1B845F857E8A510F8C0EED174C62AA213BD613499073437D36FA187F11B66FE86ABC364
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 768KB
- SHA256 320eeb429b8fee8821effc51dc08797fc740e585b1f6ba9c99fe01a66c01b14d
- MD5 07f628905df89da056938535d3d4f7e4
- SHA1 2d39907638ffd6b1c4a03efca280bd17d5a5ad66
- SHA512 05001cdfaf2ca83a39ef0cdef45abf3100572bec459d4bddb5d941f3a192cb94652416e70d98039892a4df6c75ef3ffabec3a8cac5ada24331ac0f55ece6f866
- SSDEEP 12288:V74uC0zm4exteeGwfzO9rb/TrvO90dL3BmAFd4A64nsfJJkIGWvvMZ:ieKneLwfzO9rb/TrvO90dL3BmAFd4A6U
- TLSH T14DF4F857A8A910F8C1FED170C629A217BA713099073437D37FA146F11B66FE86A7C368
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 704KB
- SHA256 3eed61d7e686960cacf393879c2bbe9a1dfe4ddfcec2402481e74417c62732a7
- MD5 394f394d10a030356dea3183beb2ec96
- SHA1 fc45dee64b1a42f204d74733497c2563ea4a969f
- SHA512 750e9e5839c3ccc9ff7c906a9885493e12e9b9264c3b87dcad6d846d86aee332a472c448ac5ebd338ba4ba6b5f3b0ebd49e4f2ef6fa970510b2a418bd5c9cfdf
- SSDEEP 12288:V74uC0zm4exteeGwfzO9rb/TrvO90dL3BmAFd4A64nsfJJkIGWvvo:ieKneLwfzO9rb/TrvO90dL3BmAFd4A6K
- TLSH T1AFE4E897A8A910F8C1FED170C62AA117B9713099073437D37FA146F11B66FE86A7C368
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 832KB
- SHA256 2782f27e32d46c487f85bbbae195f099feb4e8afd8d831b7046229da8814b786
- MD5 66b190c8c9329a84a0d710425774b88a
- SHA1 9221dd4823a439df7c47f7738f0056c17e02c8bd
- SHA512 d19469ef6392e90a225b92e59f081698d25c73fa3c3aecd41b3b97820d7bb98f9856f6dc60c436daad97092d543bf953db0e0cf895f5327285ce4cd04e8d1773
- SSDEEP 24576:ieKneLwfzO9rb/TrvO90dL3BmAFd4A64nsfJJkEqS:ieutLO9rb/TrvO90dL3BmAFd4A64nsfj
- TLSH T1BA05F757A8A510F8C1FED174C629A213BA713099073437E37FA146F11B66FE86A7C368
- MD5 SHA1 SHA512 SSDEEP TLSH