Analysis
- max time kernel
148s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/09/2026, 11:30
Behavioral task
behavioral1
Sample
2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe
- Size 11.1MB
- Sample260922-nmemesdb69
- SHA256 024417ad0ba7f7765fb1520a75bf8a1ed4a7b1e524e62f7b99876dcfd0ae47f7
- MD5 94b799e1b3ae1e6cfb610e12e197503f
- SHA1 de7f3dd5435475694f2c5c00f4b696a47660d85a
- SHA512 d2581ab48e1e82d27e6c06f52cd3dcd3e510378dab67e9406a633bffdceea644d539dc9d34e86b7345627d09c12208162cd0ac71c43ff61e85b41d9979429f7d
- SSDEEP 196608:k4JE6Tki//Nk/vnuhRBhRHhRkhRqhRDhRAhRrhRRhREhRahR9hRh:L/kilMvKRLRBR4R+RlR8R9RbRYRuRPRh
- TLSH T147C6D02427EC8A6AD2EF977BE072051A0BF5E127711FEB4D9C8494FE2D4375588423A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables referencing virtualization MAC addresses 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001c4b9-7.dat INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb - UPX dump on OEP (original entry point) 12 IoCs
resource yara_rule behavioral2/memory/4152-0-0x0000000000400000-0x00000000009C1000-memory.dmp UPX behavioral2/memory/4152-1-0x0000000000400000-0x00000000009C1000-memory.dmp UPX behavioral2/files/0x000d00000001c4b9-7.dat UPX behavioral2/memory/4152-444-0x0000000000400000-0x00000000009C1000-memory.dmp UPX behavioral2/memory/4152-912-0x0000000000400000-0x00000000009C1000-memory.dmp UPX behavioral2/memory/4152-1432-0x0000000000400000-0x00000000009C1000-memory.dmp UPX behavioral2/memory/4152-1787-0x0000000000400000-0x00000000009C1000-memory.dmp UPX behavioral2/memory/4152-1928-0x0000000000400000-0x00000000009C1000-memory.dmp UPX behavioral2/memory/4152-1979-0x0000000000400000-0x00000000009C1000-memory.dmp UPX behavioral2/memory/4152-2080-0x0000000000400000-0x00000000009C1000-memory.dmp UPX behavioral2/memory/4152-2185-0x0000000000400000-0x00000000009C1000-memory.dmp UPX behavioral2/memory/4152-2192-0x0000000000400000-0x00000000009C1000-memory.dmp UPX - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\E = "c:\\Windows\\System32\\E.exe" 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gE = "c:\\Windows\\System32\\gE.exe" 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GbMaQpg = "c:\\Windows\\System32\\GbMaQpg.exe" 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe - Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created \??\c:\Windows\System32\E.exe 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File created \??\c:\Windows\System32\gE.exe 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File created \??\c:\Windows\System32\GbMaQpg.exe 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe -
resource yara_rule behavioral2/memory/4152-0-0x0000000000400000-0x00000000009C1000-memory.dmp upx behavioral2/memory/4152-1-0x0000000000400000-0x00000000009C1000-memory.dmp upx behavioral2/files/0x000d00000001c4b9-7.dat upx behavioral2/memory/4152-444-0x0000000000400000-0x00000000009C1000-memory.dmp upx behavioral2/memory/4152-912-0x0000000000400000-0x00000000009C1000-memory.dmp upx behavioral2/memory/4152-1432-0x0000000000400000-0x00000000009C1000-memory.dmp upx behavioral2/memory/4152-1787-0x0000000000400000-0x00000000009C1000-memory.dmp upx behavioral2/memory/4152-1928-0x0000000000400000-0x00000000009C1000-memory.dmp upx behavioral2/memory/4152-1979-0x0000000000400000-0x00000000009C1000-memory.dmp upx behavioral2/memory/4152-2080-0x0000000000400000-0x00000000009C1000-memory.dmp upx behavioral2/memory/4152-2185-0x0000000000400000-0x00000000009C1000-memory.dmp upx behavioral2/memory/4152-2192-0x0000000000400000-0x00000000009C1000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\VisualElements\LogoCanary.png 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\nashorn.jar.exe 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md.exe 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File created C:\Program Files\Java\jre-1.8\lib\management\management.properties.exe 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-ppd.xrm-ms.exe 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-pl.xrm-ms 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUTL.OLB.exe 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\librawvid_plugin.dll 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\hr_FEMININE.pak.exe 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md.exe 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-pl.xrm-ms.exe 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\YAHOO.IE.XML 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN086.XML 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ppd.xrm-ms.exe 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\SIST02.XSL 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECLIPSE\ECLIPSE.ELM 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\SystemX86\vccorlib140.dll.exe 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_pt_BR.properties 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\deploy\[email protected] 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\security\policy\limited\local_policy.jar 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\ZeroByteFile 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\fil_MASCULINE.pak.exe 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\tr_NEUTER.pak.exe 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-pl.xrm-ms.exe 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-pl.xrm-ms 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-80.png 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\excel.x-none.msi.16.x-none.boot.tree.dat 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACEEXCH.DLL 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\api-ms-win-crt-math-l1-1-0.dll 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ppd.xrm-ms.exe 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-pl.xrm-ms.exe 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ppd.xrm-ms 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-oob.xrm-ms.exe 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\NVBELL.NET.XML.exe 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File created C:\Program Files\Mozilla Firefox\mozavutil.dll.exe 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WindowsFormsIntegration.dll.exe 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libimem_plugin.dll.exe 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\splashscreen.dll.exe 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngcc.md.exe 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ul-phn.xrm-ms 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CONVERT\DELIMWIN.FAE 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\CONVERT\DELIMWIN.FAE.exe 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\libssl-1_1-x64.dll.exe 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OutlookServicing.DLL 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\fi.pak 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ppd.xrm-ms 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ppd.xrm-ms 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSVCP140_APP.DLL 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\ACADEMIC.ONE.exe 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\libflaschen_plugin.dll 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LEVEL\PREVIEW.GIF.exe 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Infragistics2.Win.UltraWinTree.v11.1.dll.exe 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libt140_plugin.dll 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\tr_MASCULINE.pak 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.VisualBasic.Targets.exe 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-ppd.xrm-ms 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\INTLDATE.DLL 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\mscss7wre_en.dub 2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-21_94b799e1b3ae1e6cfb610e12e197503f_glassworm_snatch.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
PID:4152
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip.dll.exe
- Size 11.8MB
- SHA256 c44d2ac178834ed6ca961f2dd595fa1e31b7101424a54ca39002120c9103172a
- MD5 58e021aea4233e3e08a27f15bc812437
- SHA1 2aeb197f3ae516c1565a7c1f33858c17391a90ec
- SHA512 d2a48dc1cbc39df681f7ad70bcf4db64bf262cb4e4dc7cac872f307645851d0b7c331f07e443994cfb45de8f31a183ab3b0abe80f832d7832b75b9679b3a0748
- SSDEEP 196608:k4JE6Tki//Nk/vnuhRBhRHhRkhRqhRDhRAhRrhRRhREhRahR9hRihRP:L/kilMvKRLRBR4R+RlR8R9RbRYRuRPRu
- TLSH T19FC6D02427EC8A6AD2EF977BE072051A0BF5E127711FEB4D9C8494FE2D4375588423A3
- MD5 SHA1 SHA512 SSDEEP TLSH