Analysis
- max time kernel
148s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/07/2026, 18:12
Behavioral task
behavioral1
Sample
2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe
- Size 1.8MB
- Sample260710-wtly3set3r
- SHA256 5771e74a9cd31bb4a0113f142cace15f5cf0dcde03a975d0021ccbde2c6fec13
- MD5 30e79544d17c9f84e5ba020395b2aa14
- SHA1 546852ef303a2853e2429906fe861e92ac304837
- SHA512 5c158bd33350d1d6a4bebf0a7ab4ca6bfea9c2a5ca150556562410e8386612d100962f9ed55a86d1604a2b49bc8144ec40881610bb60fd32cbdd4ffb4eacc102
- SSDEEP 24576:j6pQPxQ2JyP2r5mJV91xM7RpbwgIvQ7Nxqbv:jCqm2Jpr0nNM7DuQ7NxKv
- TLSH T165851802BCEA14FBC67CF27445966B213672346583336B871E8546AA5A36FE47F3E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- UPX dump on OEP (original entry point) 2 IoCs
resource yara_rule behavioral2/files/0x000400000001b2c6-5.dat UPX behavioral2/memory/1980-12071-0x0000000000400000-0x00000000005BD000-memory.dmp UPX - Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe -
resource yara_rule behavioral2/memory/1980-0-0x0000000000400000-0x00000000005BD000-memory.dmp upx behavioral2/files/0x000400000001b2c6-5.dat upx behavioral2/memory/1980-1154-0x0000000000400000-0x00000000005BD000-memory.dmp upx behavioral2/memory/1980-12071-0x0000000000400000-0x00000000005BD000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.Design.dll.exe 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File created C:\Program Files\UpdateSend.ini.exe 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File created C:\Program Files\Windows Defender\en-US\ProtectionManagement_Uninstall.mfl.exe 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.exe 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ul-oob.xrm-ms.exe 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ul.xrm-ms.exe 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CONVERT\1033\DELIMR.FAE 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sbicuin58_64.dll.exe 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL.exe 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CONCRETE\CONCRETE.ELM.exe 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ul-phn.xrm-ms 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_PrepidBypass-ul-oob.xrm-ms.exe 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Net.Resources.dll 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\da_MASCULINE.pak 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Windows.Presentation.resources.dll 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libudp_plugin.dll.exe 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File created C:\Program Files\7-Zip\Lang\hr.txt.exe 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ta_MASCULINE.pak 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-ppd.xrm-ms.exe 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-pl.xrm-ms.exe 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\DataStreamerLibrary.dll.config 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\PAPYRUS.TTF.exe 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vreg\proof.es-es.msi.16.es-es.vreg.dat 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_output\libdirect3d9_plugin.dll.exe 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\tabskb.dll.mui 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\colorimaging.md.exe 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-pl.xrm-ms 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\3082\MSO.ACL 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\System\MSMAPI\1033\MSMAPI32.DLL 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\librawdv_plugin.dll.exe 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui.exe 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ppd.xrm-ms.exe 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ppd.xrm-ms 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ul.xrm-ms.exe 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File created C:\Program Files\VideoLAN\VLC\locale\am_ET\LC_MESSAGES\vlc.mo.exe 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\msinfo32.exe.mui 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-filesystem-l1-1-0.dll 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\icu.md.exe 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL119.XML.exe 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File opened for modification C:\Program Files\7-Zip\Lang\va.txt 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File created C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll.exe 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.exe 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-pl.xrm-ms 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Grace-ppd.xrm-ms 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONBttnPPT.dll 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipTsf.dll.mui.exe 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ConsumerSub_Bypass30-ul-oob.xrm-ms 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ul-oob.xrm-ms 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\INFOML.ICO.exe 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\YAHOO.IE.XML 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.exe 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File created C:\Program Files\Internet Explorer\fr-FR\ieinstal.exe.mui 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe.exe 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalDemoR_BypassTrial180-ul-oob.xrm-ms 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-180.png 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\msfad.dll.exe 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Conversion.v3.5.resources.dll 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\jsse.jar 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\YAHOO.ES.XML.exe 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\JUICE___.TTF 2026-07-10_30e79544d17c9f84e5ba020395b2aa14_snatch.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip32.dll
- Size 1.8MB
- SHA256 d1ebb0d0ddb67c95694fe5ae1afbf022de4ea7ddf09cb11be44aa968b7b025d2
- MD5 492a455424374abd25bb95dd07da0df1
- SHA1 7e7c167bbcffc76bcfe9e5d50b27f07a367dfb38
- SHA512 10435a7a155d7fd339c1fb92acfdb8f9bed8077c8062295a380e49582a84e48d9001efa8ec4638f7f45013e86c2033579c54093df8a3785de1a2b9a429525913
- SSDEEP 24576:j6pQPxQ2JyP2r5mJV91xM7RpbwgIvQ7Nxqbm:jCqm2Jpr0nNM7DuQ7NxKm
- TLSH T14C851802BCEA14FBC67CF27445966B213672346583336B871E8546AA5A36FE47F3E310
- MD5 SHA1 SHA512 SSDEEP TLSH