Analysis
- max time kernel
149s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/05/2026, 09:37
Behavioral task
behavioral1
Sample
2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
150 seconds
General
- Target 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe
- Size 1.8MB
- Sample260504-llyb2abs8k
- SHA256 3b15ea7458a61a8e73b068c816d359a168b13caaa8613d63ecc2f5ae18e5ebeb
- MD5 53664d0fb933035d6841e96b8f159a71
- SHA1 0358cd2059e310d5de1202b466360a3465b4436e
- SHA512 985bf747f7277aa8d96a2a229a5db23a30976485ac67e564fd1539bc867ab040dc8863908b71738beb69bb508567833618beb94b2a01d526a6d45cfc51953823
- SSDEEP 24576:H6pQPxQ2JyP2r5mJV91xM7RpbwgIvQ7NxqU:HCqm2Jpr0nNM7DuQ7NxB
- TLSH T1B5851802BCEA14FBC27CF27445966B213672346583336B871E8546AA5A76FE47F3E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureUPX dump on OEP (original entry point) 5 IoCs
resource yara_rule behavioral1/memory/4232-0-0x0000000000400000-0x00000000005BB000-memory.dmp UPX behavioral1/files/0x00020000000229ca-5.dat UPX behavioral1/memory/4232-1687-0x0000000000400000-0x00000000005BB000-memory.dmp UPX behavioral1/memory/4232-14371-0x0000000000400000-0x00000000005BB000-memory.dmp UPX behavioral1/files/0x0001000000021db4-14372.dat UPX - Executes dropped EXE 1 IoCs
pid Process 3224 Process not Found - Loads dropped DLL 3 IoCs
pid Process 3224 Process not Found 3224 Process not Found 3224 Process not Found - Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\desktop.ini 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe -
resource yara_rule behavioral1/memory/4232-0-0x0000000000400000-0x00000000005BB000-memory.dmp upx behavioral1/files/0x00020000000229ca-5.dat upx behavioral1/memory/4232-1687-0x0000000000400000-0x00000000005BB000-memory.dmp upx behavioral1/memory/4232-14371-0x0000000000400000-0x00000000005BB000-memory.dmp upx behavioral1/files/0x0001000000021db4-14372.dat upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-48_contrast-black.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Yahoo-Dark.scale-300.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-memory-l1-1-0.dll 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Microsoft.People.Relevance.QueryClient.winmd 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\ScreenSketchSquare150x150Logo.scale-100_contrast-black.png 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Advanced-Dark.scale-300.png 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\Simple\Example3A.Diagnostics.Tests.ps1.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Advanced-Dark.scale-250.png 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\Windows Media Player\es-ES\setup_wm.exe.mui.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-black\WideTile.scale-125.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-48_altform-lightunplated.png 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XmlDocument.dll.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\msvcr120.dll.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-64_altform-lightunplated.png 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_TW.properties 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\OFFRHD.DLL.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\resources\strings\LocalizedStrings_he.json.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\clrcompression.dll.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ul-phn.xrm-ms.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\MixedRealityPortalStoreLogo.scale-125.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-80_altform-lightunplated.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.scale-400.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\WindowsFormsIntegration.resources.dll.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_http_plugin.dll 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-80_contrast-white.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppCS\Assets\EmptyAlbumList.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-64_altform-unplated_contrast-white.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Yahoo-Dark.scale-125.png 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-ul-oob.xrm-ms 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Spatial.NetFX35.V7.dll.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Conversion.v3.5.dll 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\MixedRealityPortalAppList.scale-100_contrast-black.png 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Standard.targetsize-16_contrast-white.png 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-30_altform-unplated.png 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Images\BlankImage.png 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\Dismiss.scale-64.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\CalculatorStoreLogo.contrast-white_scale-100.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-256_altform-lightunplated.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-24.png 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\XLCALL32.DLL.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\control\libwin_msg_plugin.dll 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-125_contrast-black.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\WideTile.scale-125.png 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSmallTile.scale-200.png 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\AppIcon.targetsize-32_altform-lightunplated.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\import_google_contacts\googleImportError.png 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-72_altform-unplated.png 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.AnalysisServices.AdomdClientUI.dll.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\db2v0801.xsl.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\Windows Media Player\it-IT\wmpnetwk.exe.mui 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\WideTile.scale-100.png 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxAccountsSmallTile.scale-100.png 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.ComponentModel.TypeConverter.dll.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationClient.resources.dll 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\vpaid.js 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-20_contrast-black.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\shaded.dotx.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\FSTOCK.DLL.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\ReachFramework.resources.dll.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\RuntimeConfiguration.dll 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-40_altform-unplated_contrast-white.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip32.dll
- Size 1.8MB
- SHA256 13d6880215d77e02364cda0218876d5c58b2507ca9bc4f2b5fde95fabd42ea19
- MD5 19ffb91687ac45f517e67cc0ce2dcf69
- SHA1 14ab7fec581f44c772cc8d98102e03e418a9bd69
- SHA512 3e6019753ccfaf0d2f8c3d4d4b5be054da564c4b7700ecf2242b1adf8183817bda32a454a78e9876b038e73fb8d9799b492fc637a7da8ce2132b4163038a145d
- SSDEEP 24576:H6pQPxQ2JyP2r5mJV91xM7RpbwgIvQ7NxqV:HCqm2Jpr0nNM7DuQ7Nxk
- TLSH T1EF851802BCEA14FBC27CF27445966B213672346583336B871E8546AA5A76FE47F3E310
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 1.8MB
- SHA256 1dfaef6ddcbeffbef322fef0c32638927ddcdfdd3d053c44a582fa6ec7097f12
- MD5 acb9fa1e8ef85195ddae11d566b3ce9e
- SHA1 570a51902591f38c888b20c07c66c7735d16ab73
- SHA512 7fd13e1fc11fc23daad6fe7446aa1029ca3239e35a117a9b090d4d86b2d2335d5c4d79800f93c1325870aee292ebfe2eb9a6e09ef160e7eee739e9b796741f9d
- SSDEEP 24576:H6pQPxQ2JyP2r5mJV91xM7RpbwgIvQ7Nxq0:HCqm2Jpr0nNM7DuQ7Nxp
- TLSH T118851802BCEA14FBC27CF27445966B213672346583336B871E8546AA5A76FE47F3E310
- MD5 SHA1 SHA512 SSDEEP TLSH