7099f2911a7da4241cec3a3bc1ceea459d305146b724fd63bcd92788005ba1d5

Analysis

max time kernel
148s
max time network
88s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 23:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_8cd9a71bc4558ae42a6dde1d3ddf3644_glassworm_snatch.exe
Size 4.4MB
Sample260714-3f5btsft8r
SHA256 7099f2911a7da4241cec3a3bc1ceea459d305146b724fd63bcd92788005ba1d5
MD5 8cd9a71bc4558ae42a6dde1d3ddf3644
SHA1 21716f2cfd893ee0cfafbd1aac8db7e3a4b17603
SHA512 07b2d420ab33c25a19d92d6ad6a7a1d76f12a05e41ffd5536267d8ba2908db5b8fd840468298100936a52fbb19788419a281cb589aaa21d393273d6057100a2e
SSDEEP 49152:NpHbpewWLnBQ7CASKTWUo4eA+bZVggi6D5RQe1turz6oTPPQ2n6O7X7OuZ9WHXXB:NpdrchtZiwRQe1Mr7T77XKu2H
TLSH
T19226AF07AC9504E9C4AEA3318DB256567B78BC490B3223EB2F50BA783FB2BD05D75714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery spyware stealer

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/memory/884-0-0x000001CC726A0000-0x000001CC727B5000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4312	chrome.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 884 wrote to memory of 5212	884	2026-07-14_8cd9a71bc4558ae42a6dde1d3ddf3644_glassworm_snatch.exe	88
PID 884 wrote to memory of 5212	884	2026-07-14_8cd9a71bc4558ae42a6dde1d3ddf3644_glassworm_snatch.exe	88
PID 5212 wrote to memory of 5116	5212	chrome.exe	89
PID 5212 wrote to memory of 3076	5212	chrome.exe	92
PID 5212 wrote to memory of 4312	5212	chrome.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-07-14_8cd9a71bc4558ae42a6dde1d3ddf3644_glassworm_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_8cd9a71bc4558ae42a6dde1d3ddf3644_glassworm_snatch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --no-sandbox --disable-gpu --disable-gpu-compositing --disable-software-rasterizer --disable-dev-shm-usage --disable-logging --log-level=3 --silent-debugger-extension-api --disable-background-networking --disable-client-side-phishing-detection --disable-default-apps --disable-extensions --disable-sync --disable-translate --metrics-recording-only --no-first-run --safebrowsing-disable-auto-update --disable-crash-reporter --disable-breakpad --disable-background-timer-throttling --disable-backgrounding-occluded-windows --disable-renderer-backgrounding --disable-component-update --disable-domain-reliability --disable-infobars --disable-notifications --disable-password-manager-reauthentication --disable-plugins --disable-popup-blocking --disable-print-preview --disable-prompt-on-repost --disable-session-crashed-bubble --window-position=0,0 --window-size=1,1 --force-device-scale-factor=1 --profile-directory="Default" --block-new-web-contents --run-all-compositor-stages-before-draw --disable-features=ChromeWhatsNewUI,TranslateUI,MediaRouter,OptimizationHints,AutofillServerCommunication,NotificationCenter,PrivacySandboxSettings4
  2⤵
  - Enumerates system info in registry
  - Suspicious use of WriteProcessMemory
  PID:5212
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5212240731109 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5212240731109\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5212240731109 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x1b4,0x1b8,0x1bc,0xe0,0x1c0,0x7fffc6b6c728,0x7fffc6b6c734,0x7fffc6b6c740
    3⤵
    PID:5116
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --disable-breakpad --headless=new --run-all-compositor-stages-before-draw --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5212240731109" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAQAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --field-trial-handle=1888,i,13358036617226224920,16634500341146336829,262144 --disable-features=AutofillServerCommunication,ChromeWhatsNewUI,MediaRouter,NotificationCenter,OptimizationHints,PaintHolding,PrivacySandboxSettings4,TranslateUI --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=1884 /prefetch:2
    3⤵
    PID:3076
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5212240731109" --force-high-res-timeticks=disabled --field-trial-handle=1888,i,13358036617226224920,16634500341146336829,262144 --disable-features=AutofillServerCommunication,ChromeWhatsNewUI,MediaRouter,NotificationCenter,OptimizationHints,PaintHolding,PrivacySandboxSettings4,TranslateUI --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=1964 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4312

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5668

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

injector_log.txt

Path C:\temp\injector_log.txt
Size 405B
SHA256 846fa54d5a09b9ffca6a149ff116935b4823a1f869f9026509dd42986af91a65
MD5 b85c42f354f52dc5fecd35f704bfb37c
SHA1 5c87ddc2831598ad5218dda69468279c0d22512b
SHA512 fbe497f91d55106089978ea53930c88cf43501ad3cb5995b4464cd33b675bbbce3a47b28ae1a0b20fee9c101f1696b72e805727a21d11e483b06d8768e15381a
TLSH
T178E0124A6CF8B158B9585098FE847DC00DD111896F9CEAFE314D911EEF0A35B8F05F60
MD5 SHA1 SHA512 TLSH

Submit Download

injector_log.txt

Path C:\temp\injector_log.txt
Size 818B
SHA256 f41c1e7c6e7671f1be80f7d3f73f1fc67942c3a8aba84e9f0f645125c431e72f
MD5 94a509eaa559a49676a7a664780b4200
SHA1 a6b1d0cefc6238b4971bd50c9c79edf33a5d0c08
SHA512 908a77bd5c8c4929024d5213bd6a9a53d1dff15969fe9e7eafa74523159964f11dc61cae058ecc722f88d503ad5d77403ba77a98ef2bde3b433451d797085743
TLSH
T18401845A1CF5B244B99960C8FE947DC019C4118A6F8CEAFE744D915EBF4E2978F42F20
MD5 SHA1 SHA512 TLSH

Submit Download

injector_log.txt

Path C:\temp\injector_log.txt
Size 1KB
SHA256 7f6e6ff2cf028e9b76feb49e423be4e79be979f8547edccc4532de8f04755795
MD5 afd5937afef3248daaafda929f57b534
SHA1 1fca27ec5f4ae1664f1e53820874f622bf29c5f1
SHA512 088fb670b707d0ab4d51528b4d75a4ce50cc833b10e716a3f64e5683d38039ba29511d71bf7407e1bd846c4adf2a5e0d34e3edeb13d33214e32ffd5a1d8de655
TLSH
T16D1172492CF4B244BE9960D8FA8439C01980118A6F5CEAFE744D919EBE0A3575F42F20
MD5 SHA1 SHA512 TLSH

Submit Download

payload_key_log.txt

Path C:\temp\payload_key_log.txt
Size 537B
SHA256 eba3812a1e0dcd221a4bac50ccd156418709a6d31950d1530f90b7d4cfc0405b
MD5 0fb9176c8c9d0d6ce624abed730cf567
SHA1 eb9464ed99b245887b7c7012c4c9940c4deb97d9
SHA512 8da2718789eab010a838dd1f244f2698682704904cd1d10af8b7aa385f711b270532e6a8d2df6004deac67fa48eedf9ea7ec2a123bd403566f93428933ec3d2a
TLSH
T142F05E9D7CF07248FA9C10CAB68D29D41A50455A6F8CEAFD320A452FAE153CE8F10F31
MD5 SHA1 SHA512 TLSH

Submit Download

payload_key_log.txt

Path C:\temp\payload_key_log.txt
Size 1KB
SHA256 c1f8d966e870689b03f7f7353b29ca368f10ccb730ebd41395dfa5d80d532f38
MD5 8d85de8826743f82f5f1437161b136dd
SHA1 f6139a413b22b0ba20ec442a12718faa1e6cc939
SHA512 af7e9fabeaa9e89fdf1ef43a6f81a52a0dd7fec6bcbbbbb0c43b7e8a5bf66e28a8967be7c0147c7822f897d9d9f92c4cc1dd3f094bbb66f9241bafbb72d82bb7
TLSH
T19A31688A68F4B25DFA4D10CABA4C6DD01A5105456F9CE9FE320E503EAD0939E9F11F31
MD5 SHA1 SHA512 TLSH

Submit Download

payload_key_log.txt

Path C:\temp\payload_key_log.txt
Size 2KB
SHA256 2a0854c5f981bd86a9f9498451ab353bc029fb216ee936dfc6b9a322e256b669
MD5 86c9e414a4141e5df24ec9ed2f806e33
SHA1 75c26bb83812701a01ee0c366597c3b4e1fa77e0
SHA512 4b05097088aa40af7df58faeb934bfb869718e38b0977a539cee880ea151f4f551887481580f56f2db3b055c58baf105213cda386af576f49488d36c4b041ab8
TLSH
T1E951589A6CF4B258FE5D10C6BA8C6DD02A5101896F9CE9FE710A503E6E0939F9F11F31
MD5 SHA1 SHA512 TLSH

Submit Download

memory/884-19-0x000001CC726A0000-0x000001CC727B5000-memory.dmp

Download

memory/884-10-0x000001CC726A0000-0x000001CC727B5000-memory.dmp

Download

memory/884-14-0x000001CC726A0000-0x000001CC727B5000-memory.dmp

Download

memory/884-13-0x000001CC726A0000-0x000001CC727B5000-memory.dmp

Download

memory/884-9-0x000001CC726A0000-0x000001CC727B5000-memory.dmp

Download

memory/884-8-0x000001CC726A0000-0x000001CC727B5000-memory.dmp

Download

memory/884-7-0x000001CC726A0000-0x000001CC727B5000-memory.dmp

Download

memory/884-15-0x000001CC726A0000-0x000001CC727B5000-memory.dmp

Download

memory/884-17-0x000001CC726A0000-0x000001CC727B5000-memory.dmp

Download

memory/884-18-0x000001CC726A0000-0x000001CC727B5000-memory.dmp

Download

memory/884-0-0x000001CC726A0000-0x000001CC727B5000-memory.dmp

Download

memory/884-16-0x000001CC726A0000-0x000001CC727B5000-memory.dmp

Download

memory/884-12-0x000001CC726A0000-0x000001CC727B5000-memory.dmp

Download

memory/884-11-0x000001CC726A0000-0x000001CC727B5000-memory.dmp

Download

memory/884-6-0x000001CC726A0000-0x000001CC727B5000-memory.dmp

Download

memory/884-88-0x0000000180000000-0x0000000180043000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads