Analysis
- max time kernel
150s - max time network
116s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/09/2026, 12:37
Behavioral task
behavioral1
Sample
2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
- Size 4.1MB
- Sample260916-ptnpca1akb
- SHA256 645e127ccb68495869ef72d5582d23fdb92d3307eb2fcd7f166d6dcf6a0238c4
- MD5 52d94df15e84ff4010dc8003c6df557f
- SHA1 3c903427773d2909b64a9f25857f183800895a27
- SHA512 3a1122d3b2330700d6706d5b08ff16baf888497092a34ca517775e70e89cc9c26065ef062a6a3b4ed919cb5302bb48374e0ab8be253d809bbf2459d7e621e772
- SSDEEP 49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q4I:ieF+iIAEl1JPz212IhzL+Bzz3dw/Va
- TLSH T17D169D03FC9564A9C5E9F23089B583927B71B858473127D32F64ABBB2A777C41E78390
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Family: Gofing
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
- Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation. 3 IoCs
resource yara_rule behavioral2/files/0x000300000001b220-4.dat family_gofing behavioral2/files/0x000300000001a519-5710.dat family_gofing behavioral2/files/0x000300000001a4e2-5713.dat family_gofing - Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
- Executes dropped EXE 1 IoCs
pid Process 2932 Process not Found - Loads dropped DLL 23 IoCs
pid Process 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found 2932 Process not Found - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 22 IoCs
description ioc Process File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\desktop.ini 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\$Recycle.Bin\S-1-5-21-1404337215-1550464601-2805570857-1000\desktop.ini 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\desktop.ini 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-phn.xrm-ms 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-phn.xrm-ms 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vreg\officemui.msi.16.en-us.vreg.dat 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\VideoLAN\VLC\plugins\spu\libaudiobargraph_v_plugin.dll 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Input.Manipulations.dll 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\WindowsBase.resources.dll 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Java\jre-1.8\lib\security\java.policy 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ko\msipc.dll.mui 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_f6f6f6_1x400.png 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\VideoLAN\VLC\lua\playlist\cue.luac 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsFormsIntegration.resources.dll 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons_hiContrast_bow.png 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javafx_font.dll 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ul-phn.xrm-ms 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessDemoR_BypassTrial365-ul-oob.xrm-ms 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-pl.xrm-ms 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ppd.xrm-ms 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libdemux_chromecast_plugin.dll 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.ReaderWriter.dll 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationCore.resources.dll 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACEES.DLL 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WindowsSecurityAppList.scale-100_contrast-white.png 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\BeLike.ps1 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-utility-l1-1-0.dll 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationProvider.resources.dll 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\aic_file_icons_retina_thumb_new.png 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_share_18.svg 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-pl.xrm-ms 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\vlc.mo 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\PesterThrow.ps1 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PenImc_cor3.dll 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_signed_out.svg 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-ppd.xrm-ms 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_K_COL.HXK 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\ExcelInterProviderRanker.bin 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_75_ffe45c_1x100.png 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\java.exe 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\ResiliencyLinks\Locales\gu.pak.DATA 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Windows Media Player\WMPNSSUI.dll 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\et_FEMININE.pak 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\SCDREQL.ICO 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN086.XML 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\TextIntelligence.dll 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libattachment_plugin.dll 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Handles.dll 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Reflection.dll 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationProvider.resources.dll 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr3jp.dll 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\index.win32.bundle.map 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\back-arrow-default.svg 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\hscroll-thumb.png 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\bun.png 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\selector.js 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\close-2.svg 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-pl.xrm-ms 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\en\Common.PasswordManager.Resources.dll 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.FileSystem.Primitives.dll 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\ResiliencyLinks\Extensions\external_extensions.json.DATA 2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-16_52d94df15e84ff4010dc8003c6df557f_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:3112
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.dll
- Size 5.9MB
- SHA256 51926e7bf269fdaec772ada12766774aac7f4402eb0a6d4b6a6ccc8f5cceeddc
- MD5 970c911c5c59ddb6eac5831d220707bf
- SHA1 5bbdc50de1030dc9667e5ec69647108fcf6ed730
- SHA512 63cee09530bccc0d92a59ddd8394fe2ea54435ec0cc22b4b65024d4446e5f24517f4760e6cc8323149589c111d9cf198dfb1c8cfeea0d44e432568422dc10dec
- SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/VAna3my4K+lYDF8bxeC:pWvSDzaxztQVSa3my4HlIC
- TLSH T1C856BF07FCA524A8D5F9F231C5A58263BA707858473523D32B64AEBB2B737C40E3A355
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL
- Size 4.4MB
- SHA256 92857f2ba266c4587f341dcef3b22b0ba439819194a0d71745e430dcee091b5f
- MD5 ffa1d45d1a6571db75e0bb419a9f481a
- SHA1 3560f97a7c4b37816b4c62385024bca4d8e09240
- SHA512 d37863ec53b2049f70920d01560b9623887f1d4db771e3458ff50df848c75a4e3dcf255908ce2f5b7bfff08fc34886be84827d0c6ff73904facb6835f143b312
- SSDEEP 49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q4f:ieF+iIAEl1JPz212IhzL+Bzz3dw/VJ
- TLSH T1B0269D03FC9924A9C5E9F230897583927A717859473123E32B64EBBB2A737D41E7D390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 5.8MB
- SHA256 64c46bfbb36a1a4de1837cbad17faab0f4bd190ad2704d98605627e654722049
- MD5 4d36ca7ade43009ff7418bf6f43d1bc4
- SHA1 adde8def5824e978d47862ca057bdafc2713eba8
- SHA512 ca1789bc107479442b4b5c9890565c58f6ed88a9d0f91345200eb2b288e48d6a5a923606a9b4f0122a035400d2069904a3e7a79413ac69dc73827eb58c930233
- SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/VdofIrIrjj:pWvSDzaxztQVdNID
- TLSH T1BD56AE03B89021A9D5D9E231C97497923632F45507B123F36BB0A6BB2BF37D41EB8359
- MD5 SHA1 SHA512 SSDEEP TLSH