b90368e81a2ed92cbd1e6c00ba68c9cd8397d6171b64311f97ead387af1f0664

Analysis

max time kernel
148s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_a87f1e246a7a34e562bf56824bb569a6_glassworm_snatch.exe
Size 4.4MB
Sample260715-e3n2csbw7k
SHA256 b90368e81a2ed92cbd1e6c00ba68c9cd8397d6171b64311f97ead387af1f0664
MD5 a87f1e246a7a34e562bf56824bb569a6
SHA1 7e5704095742d3ff8b783e2672715e8584d4cd86
SHA512 87648e6071e9b25373cb7c3bd6d2ec0c99d8fd661b646a64136eb0872e48970b992a38e29eff1d41e3962a9f4035d743c1cb61e4072915438f3913b3c5678cd7
SSDEEP 49152:/+0j/hGgr3v/gj0Gks3oRHqAuObRggi6DnbKUMuQG8qHhUSh89n6O7X7O5RjfhWh:/+sM4HA4ikYOHhUv7XK5yH
TLSH
T14B26AF07AC9408E9C4AEA3318DB256567B75BC490B3223EB2F50BA783FB2BD05D75714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery spyware stealer

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/memory/1868-0-0x000002455C430000-0x000002455C544000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 4924	1868	2026-07-15_a87f1e246a7a34e562bf56824bb569a6_glassworm_snatch.exe	89
PID 1868 wrote to memory of 4924	1868	2026-07-15_a87f1e246a7a34e562bf56824bb569a6_glassworm_snatch.exe	89
PID 4924 wrote to memory of 1724	4924	chrome.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-15_a87f1e246a7a34e562bf56824bb569a6_glassworm_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_a87f1e246a7a34e562bf56824bb569a6_glassworm_snatch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --no-sandbox --disable-gpu --disable-gpu-compositing --disable-software-rasterizer --disable-dev-shm-usage --disable-logging --log-level=3 --silent-debugger-extension-api --disable-background-networking --disable-client-side-phishing-detection --disable-default-apps --disable-extensions --disable-sync --disable-translate --metrics-recording-only --no-first-run --safebrowsing-disable-auto-update --disable-crash-reporter --disable-breakpad --disable-background-timer-throttling --disable-backgrounding-occluded-windows --disable-renderer-backgrounding --disable-component-update --disable-domain-reliability --disable-infobars --disable-notifications --disable-password-manager-reauthentication --disable-plugins --disable-popup-blocking --disable-print-preview --disable-prompt-on-repost --disable-session-crashed-bubble --window-position=0,0 --window-size=1,1 --force-device-scale-factor=1 --profile-directory="Default" --block-new-web-contents --run-all-compositor-stages-before-draw --disable-features=ChromeWhatsNewUI,TranslateUI,MediaRouter,OptimizationHints,AutofillServerCommunication,NotificationCenter,PrivacySandboxSettings4
  2⤵
  - Enumerates system info in registry
  - Suspicious use of WriteProcessMemory
  PID:4924
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4924240723406 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4924240723406\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome4924240723406 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x1bc,0x1c0,0x1c4,0x108,0x1c8,0x7ffbd619c728,0x7ffbd619c734,0x7ffbd619c740
    3⤵
    PID:1724

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4124

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

injector_log.txt

Path C:\temp\injector_log.txt
Size 405B
SHA256 74af9b45824a0482168c9c6b540ec219f2987444a177cc223d0cfbf2379c7811
MD5 839ca2cf43f9383f2b1db01fad443cee
SHA1 34506a65720259fdb9e1880f8ca48cd36ef0d8f7
SHA512 8ad92fe49d10ed01007a27fa20679cfe657cb4b3d54872d857c2eeeccfe59d6756225403a759f1f105da7e4fbc8f9505d35874e15ca94d401d507830bb9972e9
TLSH
T1AAE0120AACCA31D8B9585098EC8C5DE12CE1118C6F18EAFE324D921EF3023532F85940
MD5 SHA1 SHA512 TLSH

Submit Download

injector_log.txt

Path C:\temp\injector_log.txt
Size 1KB
SHA256 9123b7b2ee365338f3923eb58376ef7874e1c3a9623d16f09155981c540659e1
MD5 c53bf308d63ed4aa02ed133c58f2646c
SHA1 8edef2927271faa49d619c1f422759f13b378624
SHA512 039cf7d112ff15c9c831935c5e4e29bc11a545a25fb8b468b4f19719c34105a725fd72aaf63f7e8d5911a64cb164de0b0b2d07e9792cf581a59c6c50180e8e6f
TLSH
T1C8115109ACC63294BAE960D8EC8819D23CE5129C6F1CABFE754D815E77023533FC1A44
MD5 SHA1 SHA512 TLSH

Submit Download

payload_key_log.txt

Path C:\temp\payload_key_log.txt
Size 1KB
SHA256 4e95a5be83cf6b5cda134aecc01df6a4ed8be8494320236870496367f5a83cf6
MD5 1b392b0b8d2ad84d8646df6d6baec4c9
SHA1 8ee44b1d6cf69be8a6d44f7cf70ec300133d778a
SHA512 2395660ece2fdf89a6d13ff70b3c791ce7182b0b38e27d2d6dbd50cc198cd5470ed61cde51374c16d4c635eb28b13e043bfa24392df7fbf86fd136d54a4d885a
TLSH
T1EE31060AACC532DDFA5D10CA988C5DF27971058C6F19EAFE330E523EB3013962F95561
MD5 SHA1 SHA512 TLSH

Submit Download

payload_key_log.txt

Path C:\temp\payload_key_log.txt
Size 2KB
SHA256 d93deb700beddae7416a71a9a86c5e587b349a5ca89609d9d4bc0f3c15c7bea9
MD5 2a8d0140795f5ab66fbce1e3f182865c
SHA1 7f7e6665d48b327c56ba70286f25c4df6a61becd
SHA512 cbfe71ed256a996130a4057aa76b94ef53ccb5949d7f56855790b6d91634a0c4d73c8abd5460d2cfe0ef6ab2845805af09cfae7721624ca6505e88b020ae72e3
TLSH
T10851581AACC5369DFE9D20CA984C5DF27971019C6F58AAFE370E813E73023972F91911
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1868-18-0x000002455C430000-0x000002455C544000-memory.dmp

Download

memory/1868-7-0x000002455C430000-0x000002455C544000-memory.dmp

Download

memory/1868-17-0x000002455C430000-0x000002455C544000-memory.dmp

Download

memory/1868-15-0x000002455C430000-0x000002455C544000-memory.dmp

Download

memory/1868-14-0x000002455C430000-0x000002455C544000-memory.dmp

Download

memory/1868-19-0x000002455C430000-0x000002455C544000-memory.dmp

Download

memory/1868-16-0x000002455C430000-0x000002455C544000-memory.dmp

Download

memory/1868-0-0x000002455C430000-0x000002455C544000-memory.dmp

Download

memory/1868-13-0x000002455C430000-0x000002455C544000-memory.dmp

Download

memory/1868-11-0x000002455C430000-0x000002455C544000-memory.dmp

Download

memory/1868-10-0x000002455C430000-0x000002455C544000-memory.dmp

Download

memory/1868-9-0x000002455C430000-0x000002455C544000-memory.dmp

Download

memory/1868-8-0x000002455C430000-0x000002455C544000-memory.dmp

Download

memory/1868-12-0x000002455C430000-0x000002455C544000-memory.dmp

Download

memory/1868-6-0x000002455C430000-0x000002455C544000-memory.dmp

Download

memory/1868-80-0x0000000180000000-0x0000000180043000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads