Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/11/2026, 22:45
Behavioral task
behavioral1
Sample
2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe
- Size 1.8MB
- Sample261104-2pexvsvydv
- SHA256 04644ad0cd5138717faba34b11eb4400131f097f03e81105d35bb8955eb892db
- MD5 4045ecd445244339ccfd1fdd05ba316c
- SHA1 33e1ad529428f463f384a92a968b688b05c5812d
- SHA512 5be7e97671c83b0e770149279b728fb34491998a8f0e069d675923a65794fe6587e9f5f8924db8113910d1c55e44e1eb19cbb8f12abc95dd7b068e9dd464a14d
- SSDEEP 24576:t6pQPxQ2JyP2r5mJV91xM7RpbwgIve7Nxqw:tCqm2Jpr0nNM7Due7Nxd
- TLSH T162851802BCEA14FBC27CF27445966B213672346583336B871E8546AA5A76FE47F3E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- UPX dump on OEP (original entry point) 5 IoCs
resource yara_rule behavioral1/memory/2324-0-0x0000000000400000-0x00000000005BB000-memory.dmp UPX behavioral1/files/0x00090000000243c6-4.dat UPX behavioral1/memory/2324-1241-0x0000000000400000-0x00000000005BB000-memory.dmp UPX behavioral1/memory/2324-14317-0x0000000000400000-0x00000000005BB000-memory.dmp UPX behavioral1/files/0x000100000002219a-14318.dat UPX - Executes dropped EXE 1 IoCs
pid Process 3296 Process not Found - Loads dropped DLL 2 IoCs
pid Process 3296 Process not Found 3296 Process not Found - Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File created C:\Program Files\desktop.ini 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe -
resource yara_rule behavioral1/memory/2324-0-0x0000000000400000-0x00000000005BB000-memory.dmp upx behavioral1/files/0x00090000000243c6-4.dat upx behavioral1/memory/2324-1241-0x0000000000400000-0x00000000005BB000-memory.dmp upx behavioral1/memory/2324-14317-0x0000000000400000-0x00000000005BB000-memory.dmp upx behavioral1/files/0x000100000002219a-14318.dat upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\AppIcon.targetsize-16_contrast-white.png.exe 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.Design.resources.dll 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul-oob.xrm-ms.exe 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL022.XML 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\vpaid.html 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\x86\msheif_store.dll.exe 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Security.Cryptography.Algorithms.dll.exe 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File created C:\Program Files\7-Zip\Lang\be.txt.exe 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\winsdkfb\Images\fb_blank_profile_portrait.png 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\release 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\AppCore\Location\Shifter\Relicensing Statement.txt 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\manifest.xml.exe 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\GetHelpOffline2.png 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Lighting\Light\Silhouette.png.exe 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebProxy.dll 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\SmallTile.scale-150.png 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-48_altform-unplated.png.exe 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-200_8wekyb3d8bbwe\Win10\MicrosoftSolitaireMedTile.scale-200.jpg 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml.exe 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Lumia.MagicEdit\ControlStyles.xbf 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md.exe 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ppd.xrm-ms.exe 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ul-phn.xrm-ms.exe 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-pl.xrm-ms 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailBadge.scale-100.png 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140_1.dll.exe 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\SystemX86\mfc140enu.dll.exe 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.scale-100.png.exe 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\SlowMotionEditor\UserControls\SuperSlowMotionCheckbox.xbf 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-40_altform-unplated_contrast-white.png 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File created C:\Program Files\Common Files\System\msadc\msadce.dll 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreBadgeLogo.scale-100.png 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\2876_24x24x32.png.exe 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-100_8wekyb3d8bbwe\resources.pri 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-pl.xrm-ms.exe 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Lighting\Dark\Studio.png 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeMediumTile.scale-400.png.exe 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\US_export_policy.jar 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Outlook.scale-125.png 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-libraryloader-l1-1-0.dll 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ul-phn.xrm-ms 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-pl.xrm-ms.exe 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-80.png.exe 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\liblibass_plugin.dll 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.ViewModel.dll 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-36_contrast-white.png.exe 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeMediumTile.scale-200.png.exe 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\fr.pak 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File created C:\Program Files\Java\jdk-1.8\bin\vcruntime140.dll.exe 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libprefetch_plugin.dll 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailWideTile.scale-400.png 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\bg4.jpg 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebSockets.Client.dll.exe 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\MSTAG.TLB 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File created C:\Program Files\VideoLAN\VLC\lua\meta\reader\filename.luac.exe 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-white\LargeTile.scale-125.png.exe 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-40.png 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Advanced-Light.scale-125.png.exe 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.FileSystem.AccessControl.dll.exe 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\cmm\LINEAR_RGB.pf 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ppd.xrm-ms 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DBGHELP.DLL.exe 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\AppxManifest.xml.exe 2026-11-03_4045ecd445244339ccfd1fdd05ba316c_snatch.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip.dll.exe
- Size 1.8MB
- SHA256 6db636d9fdc411d7cd4da4bea3664c143fbea8b55ccc257549eadd2f7eb23acf
- MD5 bb3f9ccea052b9edca650efbd7d07b1d
- SHA1 e3a6e42a376d70e809c6ada938eaa0c32c3adf22
- SHA512 bfb54623983e1c9fafdfa72b0d0452b7597b9869fd2d53b7db49be39ce07f5ce32aedc9dcf8f702a96fa499655e18e9982849211eb6a88259872cc14f8003e8f
- SSDEEP 24576:t6pQPxQ2JyP2r5mJV91xM7RpbwgIve7Nxq9:tCqm2Jpr0nNM7Due7NxA
- TLSH T17D851802BCEA14FBC27CF27445966B213672346583336B871E8546AA5A76FE47F3E310
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msoshext.dll
- Size 1.8MB
- SHA256 c778b48711b52f7e3abfd5bec0c43601d6a2ab57782cd726a2abceda54cf90b7
- MD5 934b667c047b3d959da3bc1f85a7940e
- SHA1 6de8bf0ecbf86e001e26916ae5aed62404227723
- SHA512 592ea3d8d8cb129669470991885c3e040286ca18f1f21e10cfea5fc999a7c3b4e20efc4b35e894d3d88e0359ddce4abf99e9c77ec51a7ae27a562e1917e0fc8d
- SSDEEP 24576:t6pQPxQ2JyP2r5mJV91xM7RpbwgIve7Nxqw:tCqm2Jpr0nNM7Due7NxR
- TLSH T123851802BCEA14FBC27CF27445966B213672346583336B871E8546AA5A76FE47F3E310
- MD5 SHA1 SHA512 SSDEEP TLSH