Analysis
- max time kernel
148s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
04/05/2026, 09:37
Behavioral task
behavioral1
Sample
2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
150 seconds
General
- Target 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe
- Size 1.8MB
- Sample260504-llyb2abs8j
- SHA256 3b15ea7458a61a8e73b068c816d359a168b13caaa8613d63ecc2f5ae18e5ebeb
- MD5 53664d0fb933035d6841e96b8f159a71
- SHA1 0358cd2059e310d5de1202b466360a3465b4436e
- SHA512 985bf747f7277aa8d96a2a229a5db23a30976485ac67e564fd1539bc867ab040dc8863908b71738beb69bb508567833618beb94b2a01d526a6d45cfc51953823
- SSDEEP 24576:H6pQPxQ2JyP2r5mJV91xM7RpbwgIvQ7NxqU:HCqm2Jpr0nNM7DuQ7NxB
- TLSH T1B5851802BCEA14FBC27CF27445966B213672346583336B871E8546AA5A76FE47F3E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureUPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral2/memory/3892-0-0x0000000000400000-0x00000000005BB000-memory.dmp UPX behavioral2/files/0x000200000002a1c0-5.dat UPX behavioral2/memory/3892-2033-0x0000000000400000-0x00000000005BB000-memory.dmp UPX behavioral2/memory/3892-14375-0x0000000000400000-0x00000000005BB000-memory.dmp UPX - Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\desktop.ini 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe -
resource yara_rule behavioral2/memory/3892-0-0x0000000000400000-0x00000000005BB000-memory.dmp upx behavioral2/files/0x000200000002a1c0-5.dat upx behavioral2/memory/3892-2033-0x0000000000400000-0x00000000005BB000-memory.dmp upx behavioral2/memory/3892-14375-0x0000000000400000-0x00000000005BB000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\StoreLogo.scale-100.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-36_contrast-black.png 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Xaml.resources.dll.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUICellLayoutModel.bin.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\System\mfc140u.dll.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-60_contrast-black.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib\dom\setSSR.js 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Win10\MicrosoftSolitaireWideTile.scale-100.png 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\FeedbackHubMedTile.scale-200.png 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\HxA-GoogleCloudCacheMini.scale-125.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-64_altform-lightunplated.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\components\Dropdown\index.js.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-commonjs\ISize.js.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\Assets\TipsAppList.targetsize-96_altform-lightunplated.png 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Win10\contrast-white\MicrosoftSolitaireWideTile.scale-100_contrast-white.png 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Assets\CalculatorSplashScreen.scale-200_contrast-black.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\lib-commonjs\FluentTheme.js.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-commonjs\selection\Selection.types.js.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\NewsAppList.targetsize-64_altform-lightunplated.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-20_contrast-white.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2ssv.dll.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\System.Web.Mvc.dll.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\MICROSOFT.DATA.RECOMMENDATION.COMMON.DLL.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\CLICK.WAV.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WebMediaExtensions_1.0.40831.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\BadgeLogo.scale-125_contrast-white.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Resources\ro-ro\Resources.resw 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\LinkedInboxSmallTile.scale-400.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Web.Entity.Resources.dll 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\Assets\TipsAppList.targetsize-24_altform-unplated.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_x64__8wekyb3d8bbwe\Assets\Icons\StickyNotesAppList.targetsize-32_altform-unplated.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_12008.1001.1.0_x64__8wekyb3d8bbwe\Store.Purchase\Controls\Xbox360PurchaseControl.xaml 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-20_contrast-black.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-100_contrast-black.png 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-20_altform-unplated_contrast-white.png 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\PowerPivotExcelClientAddIn.dll 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\Microsoft Office\root\rsod\office32mui.msi.16.en-us.tree.dat.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Infragistics2.Shared.v11.1.dll 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\Assets\LargeTile.scale-125.png 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PaintAppList.targetsize-24_altform-lightunplated.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\Assets\SnipSketchAppList.targetsize-24_altform-lightunplated.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Diagnostics.TraceSource.dll 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\7-Zip\Lang\ba.txt.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\contrast-white\LargeTile.scale-150_contrast-white.png 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\lib-amd\motion\AnimationStyles.js 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ul-oob.xrm-ms 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\SnipSketchMedTile.scale-100.png 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Images\Square44x44Logo.targetsize-40_contrast-white.png 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\dotnet\dotnet.exe.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Xaml.resources.dll.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.UI.dll 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\Assets\contrast-black\GetHelpAppList.targetsize-16_altform-lightunplated_contrast-black.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\FeedbackHubLargeTile.scale-100.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\Assets\StoreLogo.scale-100.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\lib-commonjs\spacing\DefaultSpacing.js.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.FuzzyMatching.dll 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\zh-CN\PAD.Console.Host.resources.dll.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SnipSketchAppList.targetsize-60_altform-unplated.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-30_altform-unplated_contrast-black.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\HxA-Yahoo-Dark.scale-150.png 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-40_altform-unplated.png 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-16.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\BeLessThan.ps1.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip32.dll
- Size 1.8MB
- SHA256 13d6880215d77e02364cda0218876d5c58b2507ca9bc4f2b5fde95fabd42ea19
- MD5 19ffb91687ac45f517e67cc0ce2dcf69
- SHA1 14ab7fec581f44c772cc8d98102e03e418a9bd69
- SHA512 3e6019753ccfaf0d2f8c3d4d4b5be054da564c4b7700ecf2242b1adf8183817bda32a454a78e9876b038e73fb8d9799b492fc637a7da8ce2132b4163038a145d
- SSDEEP 24576:H6pQPxQ2JyP2r5mJV91xM7RpbwgIvQ7NxqV:HCqm2Jpr0nNM7DuQ7Nxk
- TLSH T1EF851802BCEA14FBC27CF27445966B213672346583336B871E8546AA5A76FE47F3E310
- MD5 SHA1 SHA512 SSDEEP TLSH