Analysis
- max time kernel
148s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260630-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/07/2026, 11:20
Behavioral task
behavioral1
Sample
2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe
Resource
win11ltsc2024-20260630-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe
- Size 1.8MB
- Sample260703-nfenvaf16y
- SHA256 2fc0c4c52d50877bde3412991c6afec83d8befb6f2e02ee2f5c55785f0181ac7
- MD5 160aa732fa32770d3e8427b7317a26af
- SHA1 a98475be59bcc4460455c98436ebf817d6f8a323
- SHA512 bfa51f0fdc6efffbff1065bf7254fc30c6debd415b7a4debe96e8d0d17a848b67fcd105b45566002a0dc8bffe730c25bdc867cce07cd34f3a468ca8cd495ea5c
- SSDEEP 24576:j6pQPxQ2JyP2r5mJV91xM7RpbwgIvQ7NxqbB:jCqm2Jpr0nNM7DuQ7NxKB
- TLSH T151851802BCEA14FBC67CF27445966B213672346583336B871E8546AA5A36FE47F3E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- UPX dump on OEP (original entry point) 2 IoCs
resource yara_rule behavioral2/files/0x000200000001b2c2-5.dat UPX behavioral2/memory/2836-12053-0x0000000000400000-0x00000000005BD000-memory.dmp UPX - Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe -
resource yara_rule behavioral2/memory/2836-0-0x0000000000400000-0x00000000005BD000-memory.dmp upx behavioral2/files/0x000200000001b2c2-5.dat upx behavioral2/memory/2836-1479-0x0000000000400000-0x00000000005BD000-memory.dmp upx behavioral2/memory/2836-12053-0x0000000000400000-0x00000000005BD000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\BSSYM7.TTF 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CAPSULES\CAPSULES.ELM 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File created C:\Program Files\Windows Defender\uk-UA\ProtectionManagement_Uninstall.mfl.exe 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\Configuration\card_expiration_terms_dict.txt.exe 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Conversion.v3.5.dll 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libdtv_plugin.dll.exe 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_mosaic_bridge_plugin.dll 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\sr.pak 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME.txt 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ul-oob.xrm-ms 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-timezone-l1-1-0.dll.exe 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libpsychedelic_plugin.dll.exe 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File created C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui.exe 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Grace-ul-oob.xrm-ms 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntryR_PrepidBypass-ppd.xrm-ms.exe 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f4\FA000000005 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\RECALL.DLL 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\SENDTO.DLL.exe 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\api-ms-win-crt-private-l1-1-0.dll 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Top Shadow.eftx.exe 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ul-phn.xrm-ms.exe 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ul-oob.xrm-ms.exe 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ppd.xrm-ms.exe 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ul-phn.xrm-ms.exe 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\TellMeOutlook.nrr 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\mecontrol.png 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\SHELLNEW\EXCEL12.XLSX.exe 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.exe 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\af_MASCULINE.pak 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-pl.xrm-ms 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ul-oob.xrm-ms 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\SLINTL.DLL.exe 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\Office.en-us\PSS10R.CHM 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\FPLACE.DLL 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_file_plugin.dll.exe 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\hr_FEMININE.pak.exe 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-2-0.dll 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11wrapper.md.exe 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md.exe 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.excelmui.msi.16.en-us.xml 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-oob.xrm-ms 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-ul-oob.xrm-ms 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll.exe 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\tzmappings 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-ppd.xrm-ms 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-pl.xrm-ms.exe 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-pl.xrm-ms 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019DemoR_BypassTrial180-ul-oob.xrm-ms.exe 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MEDIA\BREEZE.WAV 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-pl.xrm-ms.exe 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\ExcelFloatieTextModel.bin.exe 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\mip_core.dll.exe 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\msvcp120.dll.exe 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-crt-math-l1-1-0.dll.exe 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\PlatformCapabilities\CommonCapabilities.json.exe 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\db2v0801.xsl.exe 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-runtime-l1-1-0.dll 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyDrop32x32.gif 2026-07-03_160aa732fa32770d3e8427b7317a26af_snatch.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip32.dll
- Size 1.8MB
- SHA256 0c4f47f2e27f0e21a3952a07cafabad9b1d7ae0ff7b81ab1f057790f5dcdb60d
- MD5 f94bdaab1b29ab2c02b26fed95b98aeb
- SHA1 d8d323b30ebdf92ebf54930c435de8bfa2096e3b
- SHA512 4c74bccc79112368ebbc4e9d23041fbe5cb7e451b42d59a62108a6256eaa79dbeeb67f57fce6102a7d3423adc49dc08b358530f0a29e10260deac9c003bb14bd
- SSDEEP 24576:j6pQPxQ2JyP2r5mJV91xM7RpbwgIvQ7Nxqbk:jCqm2Jpr0nNM7DuQ7NxKk
- TLSH T1F8851802BCEA14FBC67CF27445966B213672346583336B871E8546AA5A36FE47F3E310
- MD5 SHA1 SHA512 SSDEEP TLSH