Analysis
- max time kernel
149s - max time network
93s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
04/05/2026, 09:37
Behavioral task
behavioral1
Sample
2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
150 seconds
General
- Target 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe
- Size 1.8MB
- Sample260504-llyb2abs8k
- SHA256 3b15ea7458a61a8e73b068c816d359a168b13caaa8613d63ecc2f5ae18e5ebeb
- MD5 53664d0fb933035d6841e96b8f159a71
- SHA1 0358cd2059e310d5de1202b466360a3465b4436e
- SHA512 985bf747f7277aa8d96a2a229a5db23a30976485ac67e564fd1539bc867ab040dc8863908b71738beb69bb508567833618beb94b2a01d526a6d45cfc51953823
- SSDEEP 24576:H6pQPxQ2JyP2r5mJV91xM7RpbwgIvQ7NxqU:HCqm2Jpr0nNM7DuQ7NxB
- TLSH T1B5851802BCEA14FBC27CF27445966B213672346583336B871E8546AA5A76FE47F3E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureUPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral2/memory/5008-0-0x0000000000400000-0x00000000005BB000-memory.dmp UPX behavioral2/files/0x000200000002a1a9-5.dat UPX behavioral2/memory/5008-1798-0x0000000000400000-0x00000000005BB000-memory.dmp UPX behavioral2/memory/5008-14367-0x0000000000400000-0x00000000005BB000-memory.dmp UPX - Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\desktop.ini 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe -
resource yara_rule behavioral2/memory/5008-0-0x0000000000400000-0x00000000005BB000-memory.dmp upx behavioral2/files/0x000200000002a1a9-5.dat upx behavioral2/memory/5008-1798-0x0000000000400000-0x00000000005BB000-memory.dmp upx behavioral2/memory/5008-14367-0x0000000000400000-0x00000000005BB000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-commonjs\IRenderComponent.js.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.Extensions.dll 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\System.Windows.Forms.resources.dll.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\Microsoft Office\root\rsod\onenote.x-none.msi.16.x-none.boot.tree.dat.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STUDIO\STUDIO.ELM 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\Assets\contrast-black\GetHelpStoreLogo.scale-200_contrast-black.png 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SnipSketchAppList.targetsize-36_altform-lightunplated.png 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-pl.xrm-ms 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\PresentationCore.resources.dll.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Images\PowerAutomateAppIcon.altform-unplated_targetsize-24.png 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-72_altform-unplated.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-36_altform-unplated.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-commonjs\test\setRenderSpy.js.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\Assets\TipsAppList.targetsize-16_contrast-white.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-30_altform-lightunplated_contrast-black.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-80_altform-lightunplated_contrast-white.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\Microsoft.Applications.Telemetry.Windows.dll.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Advanced-Light.scale-400.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Controls.Ribbon.resources.dll 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ppd.xrm-ms 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-140.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\bg\msipc.dll.mui 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Help\Hx.HxC.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\Assets\Store\SplashScreen.scale-200_contrast-white.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\Microsoft.Apps.Stubs.Handoff.dll.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\StoreLogo.scale-100_contrast-white.png 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WideTile.scale-400_contrast-white.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AlarmsAppList.scale-100_contrast-black.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Images\Square44x44Logo.targetsize-40_altform-unplated.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\en-gb\locimages\offsymk.ttf.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\HxA-Outlook.scale-400.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationUI.resources.dll 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\Assets\CameraAppList.targetsize-60.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Images\Square44x44Logo.targetsize-32.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\en-gb\xlsrvintl.dll 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Controls.Ribbon.resources.dll 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psm1 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\Common Files\System\ado\msado26.tlb 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\FA000000009.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-synch-l1-2-0.dll 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MINSBPROXY.DLL 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\NewsAppList.targetsize-40_contrast-white.png 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\iheart-radio.scale-200.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.Writer.dll.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ServiceProcess.dll 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT.HXS.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.AdHoc.Excel.Client.dll.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\Images\FileWord32x32.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-60.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\FeedbackHubAppList.targetsize-36_altform-lightunplated.png 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Formats.Asn1.dll 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ul-phn.xrm-ms.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ppd.xrm-ms 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\Assets\GetHelpAppList.targetsize-36.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\GenericMailMediumTile.scale-150.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-48_altform-lightunplated.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\contrast-white\NotepadSmallTile.scale-150.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\BeLessThan.Tests.ps1.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\WindowsBase.resources.dll 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ul-phn.xrm-ms 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProDemoR_BypassTrial180-ppd.xrm-ms 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOARIA.DLL.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\PaintAppList.scale-100.png 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\StoreMedTile.scale-100_altform-colorful_theme-light.png.exe 2026-05-04_53664d0fb933035d6841e96b8f159a71_snatch.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip32.dll
- Size 1.8MB
- SHA256 13d6880215d77e02364cda0218876d5c58b2507ca9bc4f2b5fde95fabd42ea19
- MD5 19ffb91687ac45f517e67cc0ce2dcf69
- SHA1 14ab7fec581f44c772cc8d98102e03e418a9bd69
- SHA512 3e6019753ccfaf0d2f8c3d4d4b5be054da564c4b7700ecf2242b1adf8183817bda32a454a78e9876b038e73fb8d9799b492fc637a7da8ce2132b4163038a145d
- SSDEEP 24576:H6pQPxQ2JyP2r5mJV91xM7RpbwgIvQ7NxqV:HCqm2Jpr0nNM7DuQ7Nxk
- TLSH T1EF851802BCEA14FBC27CF27445966B213672346583336B871E8546AA5A76FE47F3E310
- MD5 SHA1 SHA512 SSDEEP TLSH