Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/09/2026, 15:49
Behavioral task
behavioral1
Sample
2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
- Size 4.1MB
- Sample260916-s9naasw14j
- SHA256 ea61a8001aba236c8672dcb1452178d6df84c9ae28d1d3c19a403ac34e53d5ed
- MD5 eb1dd7e27ca9acbdf092563034015c49
- SHA1 4e4bf2c0b1f911fc03f412e49046ec1bf15c38d6
- SHA512 cf1b06ca55d5ecf3a396ff4a92556a96368d5084f7df8c50510e3753920dc4ec82ecb38ae312b7a7d289137dc60932c46218826aff8e8b2f4dbb2476daf32a58
- SSDEEP 49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q4n:ieF+iIAEl1JPz212IhzL+Bzz3dw/Vd
- TLSH T128169D03FC9564A9C5E9F23089B583927B71B858473123D72F64ABBB2A777C41E78390
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: Gofing
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
- Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation. 3 IoCs
resource yara_rule behavioral2/files/0x000500000001b226-4.dat family_gofing behavioral2/files/0x000300000001a04a-5657.dat family_gofing behavioral2/files/0x000300000001a512-5714.dat family_gofing - Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
- Executes dropped EXE 1 IoCs
pid Process 2876 Process not Found - Loads dropped DLL 56 IoCs
pid Process 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found 2876 Process not Found - Drops desktop.ini file(s) 14 IoCs
description ioc Process File created C:\Program Files (x86)\desktop.ini 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\$Recycle.Bin\S-1-5-21-53044966-3830981193-2402648431-1000\desktop.ini 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\desktop.ini 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ppd.xrm-ms 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.dll 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-ae\ui-strings.js 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Web.Entity.Design.Resources.dll 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\Office16\SLERROR.XML 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ul-oob.xrm-ms 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\CNFNOT.CFG 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-180.png 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Windows Media Player\uk-UA\wmlaunch.exe.mui 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_delete_18.svg 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\7-Zip\Lang\fur.txt 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\lcms.md 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Consolas-Verdana.xml 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SyncFusion.Compression.Base.dll 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libsimple_channel_mixer_plugin.dll 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_filterselected-dark-hover_32.svg 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\plugin.js 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\eu-es\ui-strings.js 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ppd.xrm-ms 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.config 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\MMSS.ICO 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationTypes.resources.dll 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\fr-fr\ui-strings.js 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\variant.js 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\msedgeupdateres_cs.dll 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\psuser_64.dll 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.js 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\concrt140.dll 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Windows Media Player\fr-FR\wmplayer.exe.mui 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Primitives.dll 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\it-it\ui-strings.js 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\plugin.js 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Locales\fil.pak 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Organic.thmx 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ul-phn.xrm-ms 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN054.XML 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-core-synch-l1-2-0.dll 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.8_8.2310.30001.0_x64__8wekyb3d8bbwe\AppxSignature.p7x 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.DataContractSerialization.dll 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationClientSideProviders.resources.dll 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-ppd.xrm-ms 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-crt-heap-l1-1-0.dll 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\VideoLAN\VLC\plugins\text_renderer\libsapi_plugin.dll 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\zh-tw\ui-strings.js 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_proxy\stable.identity_helper.exe.manifest 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-pl.xrm-ms 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\libinteger_mixer_plugin.dll 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.IO.Packaging.dll 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Common Files\System\msadc\msadce.dll 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-oob.xrm-ms 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\IPML.ICO 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\rsod\dcfmui.msi.16.en-us.boot.tree.dat 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\MSOIDRES.DLL 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\vlc.mo 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-pl.xrm-ms 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHLEX.DAT 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV\MSCONV97.DLL 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\vlc.mo 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\vlc.mo 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Threading.Thread.dll 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig 2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-16_eb1dd7e27ca9acbdf092563034015c49_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:4120
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.dll
- Size 5.9MB
- SHA256 fe8e6acdc2631792667da7ddcd5896366dd8e3bd322855cd25c9a00a8773e740
- MD5 4bb3a3dd43620e186f4b544ff2e29524
- SHA1 7922fa13fc23bbb2456eb8cc663b84cf2624f667
- SHA512 71eab376e5f2bddc0a01377973e63fd3e24458fc1ef6411c528ad41ef9dd2a66e679b429dff657664d36ac538014df365b55b507e65f5f7fce74d88cccd4378b
- SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/VcTaHOcRLgSb+9nWO9:pWvSDzaxztQV39bcWO9
- TLSH T1EF56CF03FCA420E8C5E9F230847A93527A757884473173D72B64AABB2AB77D44E7E750
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL
- Size 4.4MB
- SHA256 b7594db0102fbe83f4487942b4f49ad95fdf1ebc14e7456e722e31e762f69cad
- MD5 ab56f0715b22f98ccf938d6af7294756
- SHA1 80fa38b1aa1c13425402be6654a8db3928e1c18b
- SHA512 7dd58714931e3d5e6a9badf7f74a99ff4165110322f0ac765d9aa4c8d0a7100ef16ce4a06910227ecdfddf0fbd8575b6880f400e102a2e5517f5c111c09fa692
- SSDEEP 49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q4K:ieF+iIAEl1JPz212IhzL+Bzz3dw/V6p
- TLSH T1AD26AD03FCD561AAC5E9F231897582527B717858033123E36B64A6BF2A777C42FB8394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 5.8MB
- SHA256 dd8bbbada51efaf2ad6fa04fb82e6a270ec8ad0398dc6a7e26dc31a0c3158cc1
- MD5 944f78ac900a4514fa8dcb9e773ff7c3
- SHA1 217dea8543c52defc257173b5bcb5e29a52a4b52
- SHA512 ce918c407a6975e8d42e267eea7c23098901a323524c412bf8d50e236001814e2e90b904688100ee7676602b5685eaccc4981fab90ad51da9346d36e2a754f7b
- SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/Vu7WFFX9aIyin1:pWvSDzaxztQVF9DNn1
- TLSH T18156C003FC9558A9E6E4E2B49DB48242FEB078550B3117C32B62A77B3B767D48E38741
- MD5 SHA1 SHA512 SSDEEP TLSH