Analysis
- max time kernel
149s - max time network
134s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/09/2026, 22:41
Behavioral task
behavioral1
Sample
2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe
- Size 11.1MB
- Sample260922-2l4f2sha85
- SHA256 dc12ee4dcc89ab2d0fa2e0ae6644544f753ec46240244d6410bab240bc8900f2
- MD5 08a238a3183c96972f7da1d357695739
- SHA1 0559920ee4e53269dd90b0863714bb90f3edc35c
- SHA512 a0ec6409541f4b13e37bb36aee4283bfa2088c32c4a8e0863b15f36a689c5928ab11b9006cf007f0c91a71f6053c05e8cc06b9c6762352b6f605c559e4c6685a
- SSDEEP 196608:k4JE6Tki//Nk/vnuhRBhRHhRkhRqhRDhRAhRrhRRhREhRahR9hR4:L/kilMvKRLRBR4R+RlR8R9RbRYRuRPR4
- TLSH T161C6D02427EC8A6AD2EF977BE072051A0BF5E127711FEB4D9C8494FE2D4375588423A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables referencing virtualization MAC addresses 1 IoCs
resource yara_rule behavioral1/files/0x0007000000024545-8.dat INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb - UPX dump on OEP (original entry point) 14 IoCs
resource yara_rule behavioral1/memory/4124-0-0x0000000000400000-0x00000000009C1000-memory.dmp UPX behavioral1/memory/4124-2-0x0000000000400000-0x00000000009C1000-memory.dmp UPX behavioral1/files/0x0007000000024545-8.dat UPX behavioral1/memory/4124-396-0x0000000000400000-0x00000000009C1000-memory.dmp UPX behavioral1/memory/4124-914-0x0000000000400000-0x00000000009C1000-memory.dmp UPX behavioral1/memory/4124-1477-0x0000000000400000-0x00000000009C1000-memory.dmp UPX behavioral1/memory/4124-1874-0x0000000000400000-0x00000000009C1000-memory.dmp UPX behavioral1/memory/4124-1944-0x0000000000400000-0x00000000009C1000-memory.dmp UPX behavioral1/memory/4124-2096-0x0000000000400000-0x00000000009C1000-memory.dmp UPX behavioral1/memory/4124-2144-0x0000000000400000-0x00000000009C1000-memory.dmp UPX behavioral1/memory/4124-2145-0x0000000000400000-0x00000000009C1000-memory.dmp UPX behavioral1/memory/4124-2146-0x0000000000400000-0x00000000009C1000-memory.dmp UPX behavioral1/memory/4124-2147-0x0000000000400000-0x00000000009C1000-memory.dmp UPX behavioral1/memory/4124-2189-0x0000000000400000-0x00000000009C1000-memory.dmp UPX - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mpZQ = "c:\\Windows\\System32\\mpZQ.exe" 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sfBGbX = "c:\\Windows\\System32\\sfBGbX.exe" 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CGph = "c:\\Windows\\System32\\CGph.exe" 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe - Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Program Files\desktop.ini 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created \??\c:\Windows\System32\mpZQ.exe 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File created \??\c:\Windows\System32\sfBGbX.exe 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File created \??\c:\Windows\System32\CGph.exe 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe -
resource yara_rule behavioral1/memory/4124-0-0x0000000000400000-0x00000000009C1000-memory.dmp upx behavioral1/memory/4124-2-0x0000000000400000-0x00000000009C1000-memory.dmp upx behavioral1/files/0x0007000000024545-8.dat upx behavioral1/memory/4124-396-0x0000000000400000-0x00000000009C1000-memory.dmp upx behavioral1/memory/4124-914-0x0000000000400000-0x00000000009C1000-memory.dmp upx behavioral1/memory/4124-1477-0x0000000000400000-0x00000000009C1000-memory.dmp upx behavioral1/memory/4124-1874-0x0000000000400000-0x00000000009C1000-memory.dmp upx behavioral1/memory/4124-1944-0x0000000000400000-0x00000000009C1000-memory.dmp upx behavioral1/memory/4124-2096-0x0000000000400000-0x00000000009C1000-memory.dmp upx behavioral1/memory/4124-2144-0x0000000000400000-0x00000000009C1000-memory.dmp upx behavioral1/memory/4124-2145-0x0000000000400000-0x00000000009C1000-memory.dmp upx behavioral1/memory/4124-2146-0x0000000000400000-0x00000000009C1000-memory.dmp upx behavioral1/memory/4124-2147-0x0000000000400000-0x00000000009C1000-memory.dmp upx behavioral1/memory/4124-2189-0x0000000000400000-0x00000000009C1000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\PeopleSmallTile.scale-100.png.exe 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\SlowMotionEditor\UserControls\SlowMotionController.xbf.exe 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Date.targetsize-24_contrast-black.png 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\System.Windows.Forms.Primitives.resources.dll 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ppd.xrm-ms 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL108.XML 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2Fluent.png.exe 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STRTEDGE\THMBNAIL.PNG 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\System\msvcr100.dll.exe 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-72.png 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\mip_upe_sdk.dll.exe 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Mso40UIwin32client.dll.exe 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_fdf5ce_1x400.png.exe 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\VoiceRecorderSplashScreen.contrast-black_scale-125.png.exe 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-24_altform-unplated.png 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\powered-by-foursquare.png 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-ul-oob.xrm-ms 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PROOF\msgrammar8.dll 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageSplashScreen.scale-200_contrast-black.png.exe 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\LinkedInboxBadge.scale-200.png.exe 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingChromeHook.dll 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\bn_FEMININE.pak.exe 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\charsets.jar 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-core-processthreads-l1-1-1.dll.exe 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\OnlineMediaComponent.winmd.exe 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.Writer.dll 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\NOTE.CFG.exe 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe.exe 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\tinytile.targetsize-16_altform-unplated_contrast-black.png 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\AppxManifest.xml 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-32.png 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-pl.xrm-ms.exe 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Csi.dll 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_100_eeeeee_1x100.png.exe 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNewNoteWideTile.scale-150.png.exe 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.scale-125.png.exe 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxSmallTile.scale-200.png 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.Security.dll.exe 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\WindowsFormsIntegration.resources.dll.exe 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Violet.xml.exe 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionLargeTile.scale-100.png 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptySearch.scale-400.png 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\offsymb.ttf 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Net.Resources.dll.exe 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\mset7.dll 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libg711_plugin.dll 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubBadgeLogo.scale-100.png 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxMediumTile.scale-100.png 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.resources.dll 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\WindowsBase.resources.dll 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCONTROL.DLL 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-40_contrast-black.png 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\MicrosoftSolitaireAppList.targetsize-96_altform-lightunplated_devicefamily-colorfulunplated.png 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-48_altform-unplated.png 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-pl.xrm-ms 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ONGuide.onepkg 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File created C:\Program Files\Windows Media Player\it-IT\wmpnetwk.exe.mui.exe 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Tongue.png.exe 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreAppList.targetsize-256.png 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightDemiItalic.ttf 2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-22_08a238a3183c96972f7da1d357695739_glassworm_snatch.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
PID:4124
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip.dll.exe
- Size 11.8MB
- SHA256 b1412955f32ac8b218951486618ed469cac81dcc0c0849b217ab01df2210aaf3
- MD5 7fee1b0e8c42ba2ccd1be3fdc9bcb406
- SHA1 06b422700270eef00fde56c3e41f6cf9a2586f2d
- SHA512 ca0ce12bdab5e8d9375585fcb4a8986462fd520ac63d22a5f07ae9a0ece96a549cd7534a708f2819282d5765dbb0b7113764b2f19c92e36fa69d43b2e82f720c
- SSDEEP 196608:k4JE6Tki//Nk/vnuhRBhRHhRkhRqhRDhRAhRrhRRhREhRahR9hRphRE:L/kilMvKRLRBR4R+RlR8R9RbRYRuRPR6
- TLSH T1FDC6D02427EC8A6AD2EF977BE072051A0BF5E127711FEB4D9C8494FE2D4375588423A3
- MD5 SHA1 SHA512 SSDEEP TLSH