Analysis
- max time kernel
148s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/09/2026, 19:58
Behavioral task
behavioral1
Sample
2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe
- Size 11.1MB
- Sample260922-ypsbeaec94
- SHA256 ffaa28bdc6cb6ea770eda3550b7b237d26041fe05b542118023c5ebbfab27a58
- MD5 6995a5a8d200e372e42dcba3f25850b6
- SHA1 c352f7d6dd38f66d14512453ca271a6864d1ca41
- SHA512 ade011e45e2cd95098e6b7df59cf9abb122113c80cc2e611d417f8a444c81980a763123ca4488b1a03c7046475b41d36e8afce00aa5ed293dfdc4a1aa89d406b
- SSDEEP 196608:k4JE6Tki//Nk/vnuhRBhRHhRkhRqhRDhRAhRrhRRhREhRahR9hRO:L/kilMvKRLRBR4R+RlR8R9RbRYRuRPRO
- TLSH T178C6D02427EC8A6AD2EF977BE072051A0BF5E127711FEB4D9C8494FE2D4375588423A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables referencing virtualization MAC addresses 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001c4b0-7.dat INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb - UPX dump on OEP (original entry point) 12 IoCs
resource yara_rule behavioral2/memory/4936-0-0x0000000000400000-0x00000000009C1000-memory.dmp UPX behavioral2/memory/4936-1-0x0000000000400000-0x00000000009C1000-memory.dmp UPX behavioral2/files/0x000d00000001c4b0-7.dat UPX behavioral2/memory/4936-388-0x0000000000400000-0x00000000009C1000-memory.dmp UPX behavioral2/memory/4936-832-0x0000000000400000-0x00000000009C1000-memory.dmp UPX behavioral2/memory/4936-1312-0x0000000000400000-0x00000000009C1000-memory.dmp UPX behavioral2/memory/4936-1761-0x0000000000400000-0x00000000009C1000-memory.dmp UPX behavioral2/memory/4936-1811-0x0000000000400000-0x00000000009C1000-memory.dmp UPX behavioral2/memory/4936-1929-0x0000000000400000-0x00000000009C1000-memory.dmp UPX behavioral2/memory/4936-2037-0x0000000000400000-0x00000000009C1000-memory.dmp UPX behavioral2/memory/4936-2167-0x0000000000400000-0x00000000009C1000-memory.dmp UPX behavioral2/memory/4936-2184-0x0000000000400000-0x00000000009C1000-memory.dmp UPX - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NH = "c:\\Windows\\System32\\NH.exe" 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\idWEK = "c:\\Windows\\System32\\idWEK.exe" 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nPJkpe = "c:\\Windows\\System32\\nPJkpe.exe" 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe - Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created \??\c:\Windows\System32\idWEK.exe 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File created \??\c:\Windows\System32\nPJkpe.exe 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File created \??\c:\Windows\System32\NH.exe 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe -
resource yara_rule behavioral2/memory/4936-0-0x0000000000400000-0x00000000009C1000-memory.dmp upx behavioral2/memory/4936-1-0x0000000000400000-0x00000000009C1000-memory.dmp upx behavioral2/files/0x000d00000001c4b0-7.dat upx behavioral2/memory/4936-388-0x0000000000400000-0x00000000009C1000-memory.dmp upx behavioral2/memory/4936-832-0x0000000000400000-0x00000000009C1000-memory.dmp upx behavioral2/memory/4936-1312-0x0000000000400000-0x00000000009C1000-memory.dmp upx behavioral2/memory/4936-1761-0x0000000000400000-0x00000000009C1000-memory.dmp upx behavioral2/memory/4936-1811-0x0000000000400000-0x00000000009C1000-memory.dmp upx behavioral2/memory/4936-1929-0x0000000000400000-0x00000000009C1000-memory.dmp upx behavioral2/memory/4936-2037-0x0000000000400000-0x00000000009C1000-memory.dmp upx behavioral2/memory/4936-2167-0x0000000000400000-0x00000000009C1000-memory.dmp upx behavioral2/memory/4936-2184-0x0000000000400000-0x00000000009C1000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Windows Defender\uk-UA\OfflineScannerShell.exe.mui 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft.NET\ADOMD.NET\130\Microsoft.AnalysisServices.AdomdClient.dll 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-pl.xrm-ms.exe 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ul-oob.xrm-ms 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-pl.xrm-ms 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCHARTCOMMON.DLL.exe 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\msolap_xl.dll.exe 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File created C:\Program Files\VideoLAN\VLC\NEWS.txt.exe 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\vlc.mo 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File opened for modification C:\Program Files\7-Zip\Lang\fr.txt 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\fil-PH\tipresx.dll.mui 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\lb-LU\tipresx.dll.mui 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul-oob.xrm-ms.exe 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ul-oob.xrm-ms.exe 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\SFMESSAGES.XML 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\mscss7cm_en.dub.exe 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoutilstat.etw.man 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\gl-ES\tipresx.dll.mui 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md.exe 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md.exe 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\APPT.CFG.exe 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-140.png 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Help\HxRuntime.HxS.exe 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LEVEL\PREVIEW.GIF 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\NETWORK\THMBNAIL.PNG.exe 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\sspi_bridge.dll 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ul-oob.xrm-ms 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\OutlookLogo.contrast-white_scale-180.png 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\MS.PNG 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EVRGREEN\THMBNAIL.PNG.exe 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.Client.resources.dll 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File created C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.exe 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ul-oob.xrm-ms.exe 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7FR.DLL.exe 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\TimelessReport.dotx 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\osmmui.msi.16.en-us.tree.dat 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\msql.xsl 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Web.Entity.Design.Resources.dll 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l2-1-0.dll.exe 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\fonts\LucidaSansRegular.ttf 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ul-oob.xrm-ms 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-pl.xrm-ms 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ul.xrm-ms 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Latn-RS\msipc.dll.mui.exe 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN114.XML.exe 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\extensions\VLSub.luac 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\jvmti.h 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkDrop32x32.gif.exe 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Grace-ul-oob.xrm-ms 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-180.png 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File created C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\vlc.mo.exe 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_228ef1_256x240.png 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File created C:\Program Files\Common Files\System\ado\msado26.tlb.exe 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\ta-IN\tipresx.dll.mui 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\fi.pak 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\LINEAR_RGB.pf.exe 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\ext\zipfs.jar 2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-22_6995a5a8d200e372e42dcba3f25850b6_ezcob_glassworm_snatch.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
PID:4936
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip.dll.exe
- Size 11.8MB
- SHA256 dcc03c12a7a851e73edd24a2bb4bc524e411ea3bc132feb29ca4bd532b8f5cb2
- MD5 aa389c26b90fb60330b6a1d9753909d7
- SHA1 fed295ad5dc3cb1a0af55d71080d10b2d1492cae
- SHA512 01ab676e243a81d23ceec0f015462371c470e34a2dc600fc6ed40d4ff1c46b2f9c69fc7f5ad8bd61aed1c3823a2834c3e580c310b30c1c8da264231c783bd3a5
- SSDEEP 196608:k4JE6Tki//Nk/vnuhRBhRHhRkhRqhRDhRAhRrhRRhREhRahR9hR7hRb:L/kilMvKRLRBR4R+RlR8R9RbRYRuRPRT
- TLSH T1A3C6D02427EC8A6AD2EF977BE072051A0BF5E127711FEB4D9C8494FE2D4375588423A3
- MD5 SHA1 SHA512 SSDEEP TLSH