4577e638e12ae12ba33a3af91e282a2b29454cff521f3538d79b8266c343e453

Analysis

max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/07/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_a3c9852e04dc7978a502ba87d399e6bb_glassworm_snatch.exe
Size 4.4MB
Sample260715-e4tm8sbw9k
SHA256 4577e638e12ae12ba33a3af91e282a2b29454cff521f3538d79b8266c343e453
MD5 a3c9852e04dc7978a502ba87d399e6bb
SHA1 8d29ed8d0ac65494b1ead49498efb0e2b012e5c3
SHA512 44629e2c1b4407a2271b0e35c13a67ae0d481ed2ea465301f22b851c6e6acc08b5e1a4340b14abafadf17a2fb7e67a2acc48b29fe7563a3edb947865b09a6ca6
SSDEEP 49152:a+0j/hGgr3v/gj0Gks3oRHqAuObOgFy6DttlrT7CowmFABDOmhcXBaR7OwaQRgha:a+sM4HA2yMtlrjra8BaRKwZRvH
TLSH
T18226AF07AC9504E9C4AEA3318DB256967B74BC490B3223EB2F50BA783FB2BD05D75714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery spyware stealer

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral1/memory/532-0-0x0000027CE67A0000-0x0000027CE68B4000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4544	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5052	chrome.exe
5052	chrome.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5052	chrome.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 532 wrote to memory of 5052	532	2026-07-15_a3c9852e04dc7978a502ba87d399e6bb_glassworm_snatch.exe	89
PID 532 wrote to memory of 5052	532	2026-07-15_a3c9852e04dc7978a502ba87d399e6bb_glassworm_snatch.exe	89
PID 5052 wrote to memory of 1856	5052	chrome.exe	90
PID 5052 wrote to memory of 2640	5052	chrome.exe	93
PID 5052 wrote to memory of 4544	5052	chrome.exe	94
PID 5052 wrote to memory of 4520	5052	chrome.exe	95
PID 5052 wrote to memory of 2740	5052	chrome.exe	96
PID 5052 wrote to memory of 3492	5052	chrome.exe	97
PID 5052 wrote to memory of 4380	5052	chrome.exe	98
PID 5052 wrote to memory of 4352	5052	chrome.exe	99
PID 5052 wrote to memory of 2308	5052	chrome.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-07-15_a3c9852e04dc7978a502ba87d399e6bb_glassworm_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_a3c9852e04dc7978a502ba87d399e6bb_glassworm_snatch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --no-sandbox --disable-gpu --disable-gpu-compositing --disable-software-rasterizer --disable-dev-shm-usage --disable-logging --log-level=3 --silent-debugger-extension-api --disable-background-networking --disable-client-side-phishing-detection --disable-default-apps --disable-extensions --disable-sync --disable-translate --metrics-recording-only --no-first-run --safebrowsing-disable-auto-update --disable-crash-reporter --disable-breakpad --disable-background-timer-throttling --disable-backgrounding-occluded-windows --disable-renderer-backgrounding --disable-component-update --disable-domain-reliability --disable-infobars --disable-notifications --disable-password-manager-reauthentication --disable-plugins --disable-popup-blocking --disable-print-preview --disable-prompt-on-repost --disable-session-crashed-bubble --window-position=0,0 --window-size=1,1 --force-device-scale-factor=1 --profile-directory="Default" --block-new-web-contents --run-all-compositor-stages-before-draw --disable-features=ChromeWhatsNewUI,TranslateUI,MediaRouter,OptimizationHints,AutofillServerCommunication,NotificationCenter,PrivacySandboxSettings4
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5052
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5052240649406 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5052240649406\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5052240649406 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffaf803c728,0x7ffaf803c734,0x7ffaf803c740
    3⤵
    PID:1856
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --disable-breakpad --headless=new --run-all-compositor-stages-before-draw --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5052240649406" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAQAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --field-trial-handle=1956,i,2159612677235419221,11162796728696321971,262144 --disable-features=AutofillServerCommunication,ChromeWhatsNewUI,MediaRouter,NotificationCenter,OptimizationHints,PaintHolding,PrivacySandboxSettings4,TranslateUI --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=1952 /prefetch:2
    3⤵
    PID:2640
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5052240649406" --force-high-res-timeticks=disabled --field-trial-handle=1956,i,2159612677235419221,11162796728696321971,262144 --disable-features=AutofillServerCommunication,ChromeWhatsNewUI,MediaRouter,NotificationCenter,OptimizationHints,PaintHolding,PrivacySandboxSettings4,TranslateUI --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2004 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4544
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5052240649406" --force-high-res-timeticks=disabled --field-trial-handle=1956,i,2159612677235419221,11162796728696321971,262144 --disable-features=AutofillServerCommunication,ChromeWhatsNewUI,MediaRouter,NotificationCenter,OptimizationHints,PaintHolding,PrivacySandboxSettings4,TranslateUI --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2284 /prefetch:8
    3⤵
    PID:4520
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5052240649406" --disable-print-preview --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-background-timer-throttling --disable-breakpad --disable-notifications --force-device-scale-factor=1 --run-all-compositor-stages-before-draw --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1956,i,2159612677235419221,11162796728696321971,262144 --disable-features=AutofillServerCommunication,ChromeWhatsNewUI,MediaRouter,NotificationCenter,OptimizationHints,PaintHolding,PrivacySandboxSettings4,TranslateUI --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2952 /prefetch:1
    3⤵
    PID:2740
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5052240649406" --disable-print-preview --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-background-timer-throttling --disable-breakpad --disable-notifications --force-device-scale-factor=1 --run-all-compositor-stages-before-draw --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1956,i,2159612677235419221,11162796728696321971,262144 --disable-features=AutofillServerCommunication,ChromeWhatsNewUI,MediaRouter,NotificationCenter,OptimizationHints,PaintHolding,PrivacySandboxSettings4,TranslateUI --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2972 /prefetch:1
    3⤵
    PID:3492
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5052240649406" --disable-print-preview --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-background-timer-throttling --disable-breakpad --disable-notifications --force-device-scale-factor=1 --run-all-compositor-stages-before-draw --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1956,i,2159612677235419221,11162796728696321971,262144 --disable-features=AutofillServerCommunication,ChromeWhatsNewUI,MediaRouter,NotificationCenter,OptimizationHints,PaintHolding,PrivacySandboxSettings4,TranslateUI --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3144 /prefetch:1
    3⤵
    PID:4380
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5052240649406" --extension-process --disable-print-preview --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-background-timer-throttling --disable-breakpad --disable-notifications --force-device-scale-factor=1 --run-all-compositor-stages-before-draw --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1956,i,2159612677235419221,11162796728696321971,262144 --disable-features=AutofillServerCommunication,ChromeWhatsNewUI,MediaRouter,NotificationCenter,OptimizationHints,PaintHolding,PrivacySandboxSettings4,TranslateUI --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3208 /prefetch:2
    3⤵
    PID:4352
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5052240649406" --extension-process --disable-print-preview --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-background-timer-throttling --disable-breakpad --disable-notifications --force-device-scale-factor=1 --run-all-compositor-stages-before-draw --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1956,i,2159612677235419221,11162796728696321971,262144 --disable-features=AutofillServerCommunication,ChromeWhatsNewUI,MediaRouter,NotificationCenter,OptimizationHints,PaintHolding,PrivacySandboxSettings4,TranslateUI --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3300 /prefetch:2
    3⤵
    PID:2308

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4736

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2bd4f1fe-3a54-40f9-8c0b-9c69ef9a7918.tmp

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5052240649406\Default\Network\2bd4f1fe-3a54-40f9-8c0b-9c69ef9a7918.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5052240649406\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5052240649406\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

injector_log.txt

Path C:\temp\injector_log.txt
Size 1KB
SHA256 10e8a1fe1c238c0b41d58a4978e84f3e57659196506ff421f267f65b6b2d4186
MD5 7a0d2032cd645ddcafb4c8bf7bf0954e
SHA1 bb45ca061e7e00c1fac1eff8a1971f3b67c8221f
SHA512 48613f79c1b2ba0184926a9b2e00c9ba3e47801bcc97c9879069b1552c1cf0dd734770f9365763ddd8d839b76c79fe782247cbae7250e338acb950c67da30fc5
TLSH
T1B71160095EC466A6FBDC60DDA88E19C298B0939C6F18CABE755D815E73023532F81940
MD5 SHA1 SHA512 TLSH

Submit Download

injector_log.txt

Path C:\temp\injector_log.txt
Size 405B
SHA256 749ae98c9814ad8982d2d4f7a1ce2e2599d46d853d269c87780d443e23ee869d
MD5 61570a4a01a4ed532d76917f33e53eaf
SHA1 77733f41503ad39658822cadbe1ab4e5a732b641
SHA512 c6ecd47eb45f868231bde3bc7c59367f54ff3fa9df95fa41b5b5eb9be64d362ea1a4972894926e97c17b4f92ca31cad3656b6a7be2557e715a6ded7106131694
TLSH
T130E0E505AEC831E9FB5C50959C8D59C18CF1534C6F18CABE324D921E73027532F85940
MD5 SHA1 SHA512 TLSH

Submit Download

payload_key_log.txt

Path C:\temp\payload_key_log.txt
Size 1KB
SHA256 71c37434aa263928a863e0908b026e06b174b0516485a38d46454d3020f143ac
MD5 0181fe17f9219863c2ab445a8e50d3a2
SHA1 ca7640e2822d1109e86e700c82cdecf563dde6dc
SHA512 6474db548c3ba464bd30a93f26f16a94252104772206e2cc620bc2376231edf43f8c77a477fba99f1fa0ced7821ef059dcb8c291cae72f05246bc1b18665c6cf
TLSH
T12831580AADD422AEFB5D10CB988E4DE16971878C6F18D9FE330E513E33017976F91561
MD5 SHA1 SHA512 TLSH

Submit Download

payload_key_log.txt

Path C:\temp\payload_key_log.txt
Size 2KB
SHA256 7d18b3e5769642f82b3668951607df744937bf70e8b1a2cfec497e26d4c501de
MD5 6c702456870518e3837d96aee2a5e29a
SHA1 188e053afcb68530d9865c7b36d15f370fdc65b7
SHA512 48f8d1d3784d93561a23fac02e1ecf54bfedfd79aed6b1357d99da85e4fd0952c9615465cceb749fed8777e5ee917d57e6b635b8aa6999c395711b22698f0e80
TLSH
T1B551560AADC422AAFF5D10DB984E1DD2A871838C6F18D9FE330E913E33017972F95921
MD5 SHA1 SHA512 TLSH

Submit Download

memory/532-15-0x0000027CE67A0000-0x0000027CE68B4000-memory.dmp

Download

memory/532-11-0x0000027CE67A0000-0x0000027CE68B4000-memory.dmp

Download

memory/532-19-0x0000027CE67A0000-0x0000027CE68B4000-memory.dmp

Download

memory/532-16-0x0000027CE67A0000-0x0000027CE68B4000-memory.dmp

Download

memory/532-0-0x0000027CE67A0000-0x0000027CE68B4000-memory.dmp

Download

memory/532-14-0x0000027CE67A0000-0x0000027CE68B4000-memory.dmp

Download

memory/532-12-0x0000027CE67A0000-0x0000027CE68B4000-memory.dmp

Download

memory/532-18-0x0000027CE67A0000-0x0000027CE68B4000-memory.dmp

Download

memory/532-9-0x0000027CE67A0000-0x0000027CE68B4000-memory.dmp

Download

memory/532-7-0x0000027CE67A0000-0x0000027CE68B4000-memory.dmp

Download

memory/532-13-0x0000027CE67A0000-0x0000027CE68B4000-memory.dmp

Download

memory/532-10-0x0000027CE67A0000-0x0000027CE68B4000-memory.dmp

Download

memory/532-8-0x0000027CE67A0000-0x0000027CE68B4000-memory.dmp

Download

memory/532-17-0x0000027CE67A0000-0x0000027CE68B4000-memory.dmp

Download

memory/532-6-0x0000027CE67A0000-0x0000027CE68B4000-memory.dmp

Download

memory/532-165-0x0000000180000000-0x0000000180043000-memory.dmp

Download