Analysis
- max time kernel
148s - max time network
111s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/07/2026, 03:40
Behavioral task
behavioral1
Sample
2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe
- Size 1.8MB
- Sample260717-d775csav6m
- SHA256 9108784c98bfad85207c4f8edab574e91ff067d8fe9edb487add37f483a737e9
- MD5 fea1d592d3095ee69d658b45e34ac6b8
- SHA1 71fd5f1848dbac333feb12c07c90d60bae7485d9
- SHA512 7a639db0d52bbc7396759199194c09ee8e3c2864b146fcdbecadd0f2ed9225cb4a190bfd0b9cacc8d127fd49025f9e0f877506de25d9de1033c2125965a40165
- SSDEEP 24576:j6pQPxQ2JyP2r5mJV91xM7RpbwgIvQ7NxqbM:jCqm2Jpr0nNM7DuQ7NxKM
- TLSH T108851802BCEA14FBC67CF27445966B213672346583336B871E8546AA5A36FE47F3E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- UPX dump on OEP (original entry point) 2 IoCs
resource yara_rule behavioral2/files/0x000200000001b221-5.dat UPX behavioral2/memory/3200-12037-0x0000000000400000-0x00000000005BD000-memory.dmp UPX - Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe -
resource yara_rule behavioral2/memory/3200-0-0x0000000000400000-0x00000000005BD000-memory.dmp upx behavioral2/files/0x000200000001b221-5.dat upx behavioral2/memory/3200-1339-0x0000000000400000-0x00000000005BD000-memory.dmp upx behavioral2/memory/3200-12037-0x0000000000400000-0x00000000005BD000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\System\ado\msador15.dll 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe.exe 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_pt_BR.properties.exe 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-environment-l1-1-0.dll.exe 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-pl.xrm-ms 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-pl.xrm-ms 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-ppd.xrm-ms.exe 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File created C:\Program Files\7-Zip\Lang\lv.txt.exe 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll.exe 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-pl.xrm-ms.exe 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-pl.xrm-ms.exe 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Document.dll 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\APPTL.ICO 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-ppd.xrm-ms 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\AppvIsvSubsystems64.dll.exe 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-180.png 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-time-l1-1-0.dll 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CONCRETE\CONCRETE.ELM.exe 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PAPYRUS\PAPYRUS.INF 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.Speech.resources.dll.exe 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Entity.Resources.dll 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\librist_plugin.dll 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ru.pak 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntimeR_PrepidBypass-ppd.xrm-ms 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ul-oob.xrm-ms 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordcnvpxy.cnv.exe 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACEODATASERVICE.DLL 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msvcp120.dll.exe 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.Design.dll.exe 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libaraw_plugin.dll.exe 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\HeaderPatterns.xml.exe 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LAYERS\THMBNAIL.PNG.exe 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\ONBttnIE.dll.exe 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libblend_plugin.dll.exe 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul-oob.xrm-ms 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-pl.xrm-ms.exe 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File created C:\Program Files\7-Zip\Lang\sw.txt.exe 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-pl.xrm-ms.exe 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ul-oob.xrm-ms 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\ja\msipc.dll.mui 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\QUAD\THMBNAIL.PNG 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Infragistics2.Win.Misc.v8.1.dll 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File created C:\Program Files\7-Zip\Lang\de.txt.exe 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\PrivacySandboxAttestationsPreloaded\manifest.json 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProDemoR_BypassTrial180-ppd.xrm-ms.exe 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ul.xrm-ms 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN010.XML 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Stationery\1033\PAWPRINT.HTM 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-core-processthreads-l1-1-1.dll.exe 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Microsoft.Office.Interop.Excel.dll.exe 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml.exe 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\OutlookLogo.contrast-white_scale-180.png 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-180.png 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LEVEL\LEVEL.ELM.exe 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_fdf5ce_1x400.png 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File created C:\Program Files\VideoLAN\VLC\lua\http\requests\vlm_cmd.xml.exe 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File created C:\Program Files\Windows Defender\de-DE\shellext.dll.mui.exe 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-profile-l1-1-0.dll 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\System.Web.Mvc.dll.exe 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\MICROSOFT.DATA.RECOMMENDATION.COMMON.DLL 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL081.XML.exe 2026-07-17_fea1d592d3095ee69d658b45e34ac6b8_snatch.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip32.dll
- Size 1.8MB
- SHA256 14d9c4de987bcde2885de1a452d065c562625d80bea9f3f14a5476b44806fc3e
- MD5 581c3a6c1b17155e150f35a6f9c54bb0
- SHA1 63240193846e45757b1f7b6159a6ea374008e09a
- SHA512 65f7d4294a7a38e2f3957d8388b824cd291a49fe4e01599cec6dc95b313c542217411caec6c4dc8d339bf6cb931b6db8f88d1627e41f808d20f299b1d53fa3f8
- SSDEEP 24576:j6pQPxQ2JyP2r5mJV91xM7RpbwgIvQ7NxqbN:jCqm2Jpr0nNM7DuQ7NxKN
- TLSH T158851802BCEA14FBC67CF27445966B213672346583336B871E8546AA5A36FE47F3E310
- MD5 SHA1 SHA512 SSDEEP TLSH