b90368e81a2ed92cbd1e6c00ba68c9cd8397d6171b64311f97ead387af1f0664

Analysis

max time kernel
148s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/07/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_a87f1e246a7a34e562bf56824bb569a6_glassworm_snatch.exe
Size 4.4MB
Sample260715-e3n2csbw7k
SHA256 b90368e81a2ed92cbd1e6c00ba68c9cd8397d6171b64311f97ead387af1f0664
MD5 a87f1e246a7a34e562bf56824bb569a6
SHA1 7e5704095742d3ff8b783e2672715e8584d4cd86
SHA512 87648e6071e9b25373cb7c3bd6d2ec0c99d8fd661b646a64136eb0872e48970b992a38e29eff1d41e3962a9f4035d743c1cb61e4072915438f3913b3c5678cd7
SSDEEP 49152:/+0j/hGgr3v/gj0Gks3oRHqAuObRggi6DnbKUMuQG8qHhUSh89n6O7X7O5RjfhWh:/+sM4HA4ikYOHhUv7XK5yH
TLSH
T14B26AF07AC9408E9C4AEA3318DB256567B75BC490B3223EB2F50BA783FB2BD05D75714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery spyware stealer

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral1/memory/3576-0-0x0000024D70EB0000-0x0000024D70FC4000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3360	chrome.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3404	chrome.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3576 wrote to memory of 3404	3576	2026-07-15_a87f1e246a7a34e562bf56824bb569a6_glassworm_snatch.exe	88
PID 3576 wrote to memory of 3404	3576	2026-07-15_a87f1e246a7a34e562bf56824bb569a6_glassworm_snatch.exe	88
PID 3404 wrote to memory of 2596	3404	chrome.exe	89
PID 3404 wrote to memory of 3628	3404	chrome.exe	92
PID 3404 wrote to memory of 3360	3404	chrome.exe	93
PID 3404 wrote to memory of 1748	3404	chrome.exe	94
PID 3404 wrote to memory of 3276	3404	chrome.exe	95
PID 3404 wrote to memory of 4976	3404	chrome.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-07-15_a87f1e246a7a34e562bf56824bb569a6_glassworm_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_a87f1e246a7a34e562bf56824bb569a6_glassworm_snatch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --no-sandbox --disable-gpu --disable-gpu-compositing --disable-software-rasterizer --disable-dev-shm-usage --disable-logging --log-level=3 --silent-debugger-extension-api --disable-background-networking --disable-client-side-phishing-detection --disable-default-apps --disable-extensions --disable-sync --disable-translate --metrics-recording-only --no-first-run --safebrowsing-disable-auto-update --disable-crash-reporter --disable-breakpad --disable-background-timer-throttling --disable-backgrounding-occluded-windows --disable-renderer-backgrounding --disable-component-update --disable-domain-reliability --disable-infobars --disable-notifications --disable-password-manager-reauthentication --disable-plugins --disable-popup-blocking --disable-print-preview --disable-prompt-on-repost --disable-session-crashed-bubble --window-position=0,0 --window-size=1,1 --force-device-scale-factor=1 --profile-directory="Default" --block-new-web-contents --run-all-compositor-stages-before-draw --disable-features=ChromeWhatsNewUI,TranslateUI,MediaRouter,OptimizationHints,AutofillServerCommunication,NotificationCenter,PrivacySandboxSettings4
  2⤵
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3404
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3404240696953 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3404240696953\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3404240696953 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff08e5c728,0x7fff08e5c734,0x7fff08e5c740
    3⤵
    PID:2596
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --disable-breakpad --headless=new --run-all-compositor-stages-before-draw --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3404240696953" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAQAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --field-trial-handle=1952,i,18162620997930032075,9194907726017922442,262144 --disable-features=AutofillServerCommunication,ChromeWhatsNewUI,MediaRouter,NotificationCenter,OptimizationHints,PaintHolding,PrivacySandboxSettings4,TranslateUI --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=1948 /prefetch:2
    3⤵
    PID:3628
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3404240696953" --force-high-res-timeticks=disabled --field-trial-handle=1952,i,18162620997930032075,9194907726017922442,262144 --disable-features=AutofillServerCommunication,ChromeWhatsNewUI,MediaRouter,NotificationCenter,OptimizationHints,PaintHolding,PrivacySandboxSettings4,TranslateUI --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2084 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3360
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3404240696953" --force-high-res-timeticks=disabled --field-trial-handle=1952,i,18162620997930032075,9194907726017922442,262144 --disable-features=AutofillServerCommunication,ChromeWhatsNewUI,MediaRouter,NotificationCenter,OptimizationHints,PaintHolding,PrivacySandboxSettings4,TranslateUI --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2176 /prefetch:8
    3⤵
    PID:1748
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3404240696953" --disable-print-preview --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-background-timer-throttling --disable-breakpad --disable-notifications --force-device-scale-factor=1 --run-all-compositor-stages-before-draw --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1952,i,18162620997930032075,9194907726017922442,262144 --disable-features=AutofillServerCommunication,ChromeWhatsNewUI,MediaRouter,NotificationCenter,OptimizationHints,PaintHolding,PrivacySandboxSettings4,TranslateUI --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2924 /prefetch:1
    3⤵
    PID:3276
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3404240696953" --disable-print-preview --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-background-timer-throttling --disable-breakpad --disable-notifications --force-device-scale-factor=1 --run-all-compositor-stages-before-draw --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1952,i,18162620997930032075,9194907726017922442,262144 --disable-features=AutofillServerCommunication,ChromeWhatsNewUI,MediaRouter,NotificationCenter,OptimizationHints,PaintHolding,PrivacySandboxSettings4,TranslateUI --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2928 /prefetch:1
    3⤵
    PID:4976

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2440

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3404240696953\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3404240696953\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

injector_log.txt

Path C:\temp\injector_log.txt
Size 1KB
SHA256 d81f9687f70f7244464a9b8002890baeceea023597372bd5b8d9211ca3fb1807
MD5 2a718ab0ace8592c122bd21ac65352d4
SHA1 d212e8fbd6d30975c4b6417e4a395bc63113620e
SHA512 153d43b7c5f4a7a0705f5e488b1d54b7705d9384814cd81309e10d756f98c1d3578e91262e35007297c722b90539bbc0c3b5c5fdc0a7d8b58184ae7b666fb7e3
TLSH
T1D01163096CDA3294B9D9A0D8EC8859D17CD012996F28FBFE749DD16E77023532FC1940
MD5 SHA1 SHA512 TLSH

Submit Download

injector_log.txt

Path C:\temp\injector_log.txt
Size 405B
SHA256 aefa119bb9dde040fc2ace957f756abc5dd2ba9ce2413bac102339806bec2c36
MD5 143395d8991c3f8a3199930c3af764e8
SHA1 83212b448fe339c38001890d83ef079122f3201e
SHA512 7d1b2fcc16fd488c5120d7d3a86eede195777acfe607cb1276fb5e6c661326d09ba9de412bce062f1dc518dcbb651e470529331df7d41716fff5965404b223e8
TLSH
T11EE0120A6CCE3158B95AD098EC8C5DC0ACD113896F18FAFE31CDB11E63023530F85940
MD5 SHA1 SHA512 TLSH

Submit Download

payload_key_log.txt

Path C:\temp\payload_key_log.txt
Size 1KB
SHA256 850f038a3ca58c8c7d61314759af582eff2301f0c05917c37f287fe787037178
MD5 74ba52c4bdd62aed9d907868a80012a5
SHA1 36d11256e244c307e314d9093952d061e997f4d3
SHA512 c14a0dc8daa4614eae3c2a074fb60c6569ef094109f1d0d642abf608b9433dfa2b4ed8c322fe82b1b256a40b6e6a8760d41f82d33706769b3ce2716d2ea20012
TLSH
T10C31380A6CCD325DFE5E50CA9D8C5DE0B95107896F19F9FE328E603E220139A1F95961
MD5 SHA1 SHA512 TLSH

Submit Download

payload_key_log.txt

Path C:\temp\payload_key_log.txt
Size 2KB
SHA256 7310f3488b5efa90e3b2fc9cd76e649cfd712bcc24ff04e2bde21b021687f95e
MD5 ca3c5432e381df61dcb1c337680f0520
SHA1 9d638a3ed37e32a65d2e95f6e718bcebfbf33db5
SHA512 478c2cb9e7380e9a4d61abfe507f991ce8d228854b928e750ee84656a0fc1ec4f032d6da04d18ea4cadd5cf0b916179dca5fd281bb4721e2bfdd887018de41ed
TLSH
T149519B0E6CCA365DFE5E50CADC8C4DE1B85102896F58FAFE324EA13E32013A71F91921
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3576-16-0x0000024D70EB0000-0x0000024D70FC4000-memory.dmp

Download

memory/3576-12-0x0000024D70EB0000-0x0000024D70FC4000-memory.dmp

Download

memory/3576-17-0x0000024D70EB0000-0x0000024D70FC4000-memory.dmp

Download

memory/3576-0-0x0000024D70EB0000-0x0000024D70FC4000-memory.dmp

Download

memory/3576-14-0x0000024D70EB0000-0x0000024D70FC4000-memory.dmp

Download

memory/3576-13-0x0000024D70EB0000-0x0000024D70FC4000-memory.dmp

Download

memory/3576-10-0x0000024D70EB0000-0x0000024D70FC4000-memory.dmp

Download

memory/3576-18-0x0000024D70EB0000-0x0000024D70FC4000-memory.dmp

Download

memory/3576-11-0x0000024D70EB0000-0x0000024D70FC4000-memory.dmp

Download

memory/3576-7-0x0000024D70EB0000-0x0000024D70FC4000-memory.dmp

Download

memory/3576-15-0x0000024D70EB0000-0x0000024D70FC4000-memory.dmp

Download

memory/3576-6-0x0000024D70EB0000-0x0000024D70FC4000-memory.dmp

Download

memory/3576-19-0x0000024D70EB0000-0x0000024D70FC4000-memory.dmp

Download

memory/3576-9-0x0000024D70EB0000-0x0000024D70FC4000-memory.dmp

Download

memory/3576-8-0x0000024D70EB0000-0x0000024D70FC4000-memory.dmp

Download

memory/3576-105-0x0000000180000000-0x0000000180043000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads