Analysis
- max time kernel
150s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/10/2026, 18:38
Behavioral task
behavioral1
Sample
2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
- Size 4.1MB
- Sample261011-w9769avyf1
- SHA256 daec20de96edb74bfccee67edcdb150b451b6153a96252cff9f18e697062c66e
- MD5 26c55b8c313cab89a49fbe1dd4da3ef9
- SHA1 e1926d772d0f15f1ba54dfcd6ce6307e22586d66
- SHA512 e8e8212e6e904451c6916e6b854bf9f4ccac7b2be812bd32fb92219a6f88921ee58bc1ae50856d1ef8aa29404f504a4933422fb5c963570cd6f41d204bcae681
- SSDEEP 49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q4o:ieF+iIAEl1JPz212IhzL+Bzz3dw/VO
- TLSH T1B5169D03FC9564A9C5E9F23089B583927B71B858473123D72F64ABBB2A777C41E78390
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Family: Gofing
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
- Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation. 2 IoCs
resource yara_rule behavioral2/files/0x000300000001b281-3.dat family_gofing behavioral2/files/0x000300000001a831-5659.dat family_gofing - Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
- Executes dropped EXE 1 IoCs
pid Process 808 Process not Found - Loads dropped DLL 47 IoCs
pid Process 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 14 IoCs
description ioc Process File created C:\Program Files (x86)\desktop.ini 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\$Recycle.Bin\S-1-5-21-4280978039-528710165-233981602-1000\desktop.ini 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\desktop.ini 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\edge_feedback\camera_mf_trace.wprp 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\ResiliencyLinks\Locales\te.pak.DATA 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Windows Media Player\mpvis.DLL 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightItalic.ttf 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ppd.xrm-ms 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\es\msipc.dll.mui 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8EN.DLL 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\COMPASS\PREVIEW.GIF 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\PresentationUI.resources.dll 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Common Files\System\ado\msadox28.tlb 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\plugin.jar 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+NewSQLServerConnection.odc 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Mozilla Firefox\notificationserver.dll 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WindowsSecurityLargeTile.scale-400_contrast-white.png 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.CodeDom.dll 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\info.png 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8FR.LEX 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_ru_135x40.svg 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themeless\S_ThumbDownOutline_22_N.svg 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-180.png 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\ONBttnIE.dll 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffd27a_256x240.png 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ko-kr\AppStore_icon.svg 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-pl.xrm-ms 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-ul-oob.xrm-ms 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OutlookLogoSmall.contrast-black_scale-180.png 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Windows Defender\ja-JP\MpAsDesc.dll.mui 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Windows Photo Viewer\ImagingEngine.dll 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\Microsoft.VisualBasic.dll 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\de-de\ui-strings.js 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\es-es\ui-strings.js 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STRTEDGE\THMBNAIL.PNG 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libreal_plugin.dll 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\AccountProtectionJumpListLogo.png 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-gb\ui-strings.js 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Trust Protection Lists\Sigma\Advertising.DATA 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\139.0.3405.125.manifest 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-140.png 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\ROGERS.COM.XML 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\1033\VBEUIINTL.DLL 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\ucrtbase.dll 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.dll 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Light.pdf 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\en-US.pak.DATA 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_K_COL.HXK 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\NIRMALA.TTF 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Dynamic.Runtime.dll 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-debug-l1-1-0.dll 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\pl-pl\ui-strings.js 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Search.api 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\wdag.dll 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\WidevineCdm\manifest.json 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ppd.xrm-ms 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-pl.xrm-ms 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\Microsoft.Build.Engine.resources.dll 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.Sockets.dll 2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-10_26c55b8c313cab89a49fbe1dd4da3ef9_cobalt-strike_frostygoop_ghostlocker_glassworm_gofing_hi.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:244
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip32.dll
- Size 4.2MB
- SHA256 94d5451cf1d624dda30e7dbc8002fefdf81a37726851f882f7ef9a602b52e530
- MD5 be0bd08f1a1083397ad1ba5e9184ecf5
- SHA1 a7af2a7ada03566d3997bdf663889f23a8f19202
- SHA512 54f85d4f47aef91fb769d952a879d8b0610499e0627b294a5d0d7c51b73558cdd0db58a64e04a7e25dcc8c6e9856a05938427360c2b446e06cf25a453c99e8ab
- SSDEEP 49152:ieutLO9rb/TrvO90dL3BmAFd4A64nsfJJ2TIA5GNP1Jr4u/TgAPNdi9128qk1q4S:ieF+iIAEl1JPz212IhzL+Bzz3dw/VRW
- TLSH T13D169D03FC9564A9C5E9F23089B983927B717859473123D32F64ABBB2A777C41E78390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 5.8MB
- SHA256 9284106fb3d38086bc0581b8cac690f9f416a2c498d986ca623d00477cc83ad0
- MD5 3ba747dec88008d142c24485f67f0834
- SHA1 a7f6facd7f96311ac57229b988d348fb42d47b51
- SHA512 f95c875b4cd86f0404b80e01c5e2c8a8669ff7fd573a27b1a1df31f5107edcd30a153f6b8a6d448b023cc3a74dd931b53105112f509cba7d69852832af52466e
- SSDEEP 98304:ieF+iIAEl1JPz212IhzL+Bzz3dw/V5Eikk/41T6:pWvSDzaxztQVtkk4G
- TLSH T1EF56BF13BCD5A5A5D5E6F23189B447D17630B449AB3167CB2A20A77B3A73FC01EB8390
- MD5 SHA1 SHA512 SSDEEP TLSH