Analysis
- max time kernel
148s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/09/2026, 00:17
Behavioral task
behavioral1
Sample
2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe
- Size 9.6MB
- Sample260907-albbqadh45
- SHA256 94fa6c24073e2207427bb191a1d0d10c6077d45f8685b9086ea1fb34f7c20ea7
- MD5 7bfe9dd3a69ff8c5f26e51f489eaf382
- SHA1 c3e551273ec7fc6218cf61498c0080501c3bad1c
- SHA512 e640ffe3c55fe643e5fcbdb54d47be82cf872232a2ee0ff3008cc8c11ff7b56b00f8f1598c16240d941857f2e7f1906d0085e53ac2fc523364002758f653b80e
- SSDEEP 196608:k4JE6Tki//Nk/vnuhRBhRHhRkhRqhRDhRAhRrhRRhRVhRq:L/kilMvKRLRBR4R+RlR8R9RbRXRq
- TLSH T120A6D02427EC8A6AD2EF977BE072051A0BF5E527711FEB4D9C8494FE2C4375588423A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables referencing virtualization MAC addresses 1 IoCs
resource yara_rule behavioral2/files/0x0005000000016cd6-8.dat INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb - UPX dump on OEP (original entry point) 13 IoCs
resource yara_rule behavioral2/memory/1812-0-0x0000000000400000-0x00000000009C1000-memory.dmp UPX behavioral2/memory/1812-2-0x0000000000400000-0x00000000009C1000-memory.dmp UPX behavioral2/files/0x0005000000016cd6-8.dat UPX behavioral2/memory/1812-394-0x0000000000400000-0x00000000009C1000-memory.dmp UPX behavioral2/memory/1812-781-0x0000000000400000-0x00000000009C1000-memory.dmp UPX behavioral2/memory/1812-1272-0x0000000000400000-0x00000000009C1000-memory.dmp UPX behavioral2/memory/1812-1812-0x0000000000400000-0x00000000009C1000-memory.dmp UPX behavioral2/memory/1812-2056-0x0000000000400000-0x00000000009C1000-memory.dmp UPX behavioral2/memory/1812-2198-0x0000000000400000-0x00000000009C1000-memory.dmp UPX behavioral2/memory/1812-2270-0x0000000000400000-0x00000000009C1000-memory.dmp UPX behavioral2/memory/1812-2355-0x0000000000400000-0x00000000009C1000-memory.dmp UPX behavioral2/memory/1812-2473-0x0000000000400000-0x00000000009C1000-memory.dmp UPX behavioral2/memory/1812-2491-0x0000000000400000-0x00000000009C1000-memory.dmp UPX - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AuQJRwu = "c:\\Windows\\System32\\AuQJRwu.exe" 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cZClagMa = "c:\\Windows\\System32\\cZClagMa.exe" 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iiSTT = "c:\\Windows\\System32\\iiSTT.exe" 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe - Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created \??\c:\Windows\System32\AuQJRwu.exe 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File created \??\c:\Windows\System32\cZClagMa.exe 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File created \??\c:\Windows\System32\iiSTT.exe 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe -
resource yara_rule behavioral2/memory/1812-0-0x0000000000400000-0x00000000009C1000-memory.dmp upx behavioral2/memory/1812-2-0x0000000000400000-0x00000000009C1000-memory.dmp upx behavioral2/files/0x0005000000016cd6-8.dat upx behavioral2/memory/1812-394-0x0000000000400000-0x00000000009C1000-memory.dmp upx behavioral2/memory/1812-781-0x0000000000400000-0x00000000009C1000-memory.dmp upx behavioral2/memory/1812-1272-0x0000000000400000-0x00000000009C1000-memory.dmp upx behavioral2/memory/1812-1812-0x0000000000400000-0x00000000009C1000-memory.dmp upx behavioral2/memory/1812-2056-0x0000000000400000-0x00000000009C1000-memory.dmp upx behavioral2/memory/1812-2198-0x0000000000400000-0x00000000009C1000-memory.dmp upx behavioral2/memory/1812-2270-0x0000000000400000-0x00000000009C1000-memory.dmp upx behavioral2/memory/1812-2355-0x0000000000400000-0x00000000009C1000-memory.dmp upx behavioral2/memory/1812-2473-0x0000000000400000-0x00000000009C1000-memory.dmp upx behavioral2/memory/1812-2491-0x0000000000400000-0x00000000009C1000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ul-phn.xrm-ms.exe 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-pl.xrm-ms 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ul.xrm-ms 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\REMOTE.CFG.exe 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\OutlookLogo.contrast-white_scale-100.png 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7EN.LEX.exe 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ANTQUABI.TTF 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libftp_plugin.dll.exe 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-oob.xrm-ms 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\StoreLogo.png 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_dummy_plugin.dll 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ppd.xrm-ms.exe 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OutlookLogoSmall.contrast-black_scale-140.png.exe 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msowerrelief.dll.exe 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.ServiceModel.Resources.dll 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\vlc.mo 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File created C:\Program Files\Windows Defender\fr-FR\MsMpRes.dll.mui 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\j2pcsc.dll 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-oob.xrm-ms 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Grace-ul-oob.xrm-ms.exe 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ppd.xrm-ms 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN010.XML 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\VBE7.DLL 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ul-oob.xrm-ms 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\api-ms-win-crt-math-l1-1-0.dll.exe 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ul-oob.xrm-ms 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-100.png.exe 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBCTRAC.DLL.exe 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File created C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\vlc.mo.exe 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File created C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\vlc.mo.exe 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-private-l1-1-0.dll 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\bci.dll 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Median.xml 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ppd.xrm-ms.exe 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-pl.xrm-ms.exe 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ppd.xrm-ms 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.exe 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RIPPLE\RIPPLE.ELM.exe 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File created C:\Program Files\7-Zip\Lang\nb.txt.exe 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-errorhandling-l1-1-0.dll.exe 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ul-oob.xrm-ms 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-pl.xrm-ms 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PPT_WHATSNEW.XML.exe 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.ReportDesign.Common.dll 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\Microsoft.Build.Conversion.v3.5.resources.dll 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\javafx\gstreamer.md 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OMRAUT.DLL 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Filters\offfiltx.dll.exe 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CONCRETE\CONCRETE.ELM.exe 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\kab\LC_MESSAGES\vlc.mo 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\mobile.css 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libblend_plugin.dll 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File opened for modification C:\Program Files\DismountSplit.bmp 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Marquee.xml.exe 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-pl.xrm-ms 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-pl.xrm-ms 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-pl.xrm-ms 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-phn.xrm-ms 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHLTS.DAT 2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-06_7bfe9dd3a69ff8c5f26e51f489eaf382_glassworm_snatch.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
PID:1812
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip.dll.exe
- Size 10.3MB
- SHA256 c2221740d76c922098b014e428e534da605b47dcec0d9bf3bca8e00e046e2d38
- MD5 e1ebedd6ea7e9d9915c566da354f8caf
- SHA1 1889b2a413869b3029027f44ee12bd540ea50d30
- SHA512 cd62e230d37b891eb480491ab9d89bd2367fd24a2ce4bcc0df9daa05da4ed87b20c251d1b1a1743a2f67e4eb2344b7a9cbaafd6ddffc8e53ac1922a785fe3672
- SSDEEP 196608:k4JE6Tki//Nk/vnuhRBhRHhRkhRqhRDhRAhRrhRRhRVhRnhRd:L/kilMvKRLRBR4R+RlR8R9RbRXRhRd
- TLSH T1FFB6D02427EC8A6AD2EF977BE072051A0BF5E527711FEB4D9C8494FE2C4375588423A3
- MD5 SHA1 SHA512 SSDEEP TLSH