Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/05/2026, 09:37
Behavioral task
behavioral1
Sample
2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
150 seconds
General
- Target 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe
- Size 1.8MB
- Sample260504-llyb2abs8j
- SHA256 3b15ea7458a61a8e73b068c816d359a168b13caaa8613d63ecc2f5ae18e5ebeb
- MD5 53664d0fb933035d6841e96b8f159a71
- SHA1 0358cd2059e310d5de1202b466360a3465b4436e
- SHA512 985bf747f7277aa8d96a2a229a5db23a30976485ac67e564fd1539bc867ab040dc8863908b71738beb69bb508567833618beb94b2a01d526a6d45cfc51953823
- SSDEEP 24576:H6pQPxQ2JyP2r5mJV91xM7RpbwgIvQ7NxqU:HCqm2Jpr0nNM7DuQ7NxB
- TLSH T1B5851802BCEA14FBC27CF27445966B213672346583336B871E8546AA5A76FE47F3E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureUPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral1/memory/4684-0-0x0000000000400000-0x00000000005BB000-memory.dmp UPX behavioral1/files/0x000700000002452d-6.dat UPX behavioral1/memory/4684-1539-0x0000000000400000-0x00000000005BB000-memory.dmp UPX behavioral1/memory/4684-14371-0x0000000000400000-0x00000000005BB000-memory.dmp UPX - Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Program Files\desktop.ini 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe -
resource yara_rule behavioral1/memory/4684-0-0x0000000000400000-0x00000000005BB000-memory.dmp upx behavioral1/files/0x000700000002452d-6.dat upx behavioral1/memory/4684-1539-0x0000000000400000-0x00000000005BB000-memory.dmp upx behavioral1/memory/4684-14371-0x0000000000400000-0x00000000005BB000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightRegular.ttf.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ul-phn.xrm-ms 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\StoreLogo.scale-100.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_F_COL.HXK.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\cpprestsdk.dll 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Microsoft.Excel.Amo.dll 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\Windows Defender\es-ES\MpEvMsg.dll.mui.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\jscripts\winrthost.js.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c\Assets\Images\SkypeLargeTile.scale-100_contrast-white.png 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-16_altform-unplated_contrast-black.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.NETCore.App.deps.json.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\Microsoft Office\root\Integration\SPPRedist.msi.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionGroupSmallTile.scale-125.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\UIAutomationTypes.resources.dll.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Grace-ul-oob.xrm-ms 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\StoreLogo.scale-200.png 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\InsiderHubAppList.scale-100_contrast-black.png 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\offlineStrings.js 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionSmallTile.scale-200.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Date.targetsize-20_contrast-black.png 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-white\LargeTile.scale-100.png 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\chocolateyInstall.ps1.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\Mozilla Firefox\browser\VisualElements\PrivateBrowsing_150.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionLargeTile.scale-200.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\UtilitiesCpp.dll.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Voices\beeps\uncommon.lua 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ppd.xrm-ms.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libdca_plugin.dll.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-black\SmallTile.scale-125_contrast-black.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\SmallTile.scale-400.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-96_altform-unplated.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.ComponentModel.EventBasedAsync.dll.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SmallLogo.scale-200_contrast-black.png 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptyShare.scale-400.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\dcpr.dll 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\SlowMotionEditor\UserControls\VariableFrameRateVideoPlayer.xbf.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-72_altform-unplated.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\models\it-IT.PhoneNumber.model.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ppd.xrm-ms 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.DataSetExtensions.dll.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\vulkan-1.dll 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-ul-oob.xrm-ms.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreMedTile.scale-100.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\trace.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-utility-l1-1-0.dll.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-24.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\PartyChat.dll 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_NinjaCat.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-24.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-30_altform-unplated.png 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeMediumTile.scale-400.png 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\msvcp140.dll 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\api-ms-win-crt-environment-l1-1-0.dll 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\FREN\MSB1FREN.DLL.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationTypes.resources.dll.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\VideoLAN\VLC\lua\intf\dumpmeta.luac.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\ONBttnIELinkedNotes.dll.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_Dtmf_5.m4a.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailBadge.scale-200.png 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\System.Windows.Forms.Design.resources.dll 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\mscss7wre_es.dub 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip32.dll.exe
- Size 1.8MB
- SHA256 b497ea4082bff764418716c56122f9389b190ab00e4d274eac879cab9f8f59ce
- MD5 2b8c3004070c3197f444606713551118
- SHA1 27aa3109e8d160ddaf0edac8576a0d95f49740a0
- SHA512 efac34437b4f018b3945edff8fdca83fe9da5f9bd94aed777401b85a74af8085e46f43aefc2dca08e0ad90fdef2c0362cd1ac78bb0d4138c7616fe3089cb2d13
- SSDEEP 24576:H6pQPxQ2JyP2r5mJV91xM7RpbwgIvQ7NxqW:HCqm2Jpr0nNM7DuQ7Nx7
- TLSH T1E3851802BCEA14FBC27CF27445966B213672346583336B871E8546AA5A76FE47F3E310
- MD5 SHA1 SHA512 SSDEEP TLSH