Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/11/2026, 18:33
Behavioral task
behavioral1
Sample
2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe
- Size 15.4MB
- Sample261104-w7behatxcy
- SHA256 3411286726d45e80aed7b25d5a9a093faf43a711d4870c1ece25b1e9ddd674d0
- MD5 6565d09b1684041a02d49b09d0d6ab35
- SHA1 0b1976a4dffe171ce72d91e70f85b8a0e8704ce0
- SHA512 7600198efe192395a1322165ecd358a1a15b94df302bcc945254738008f3ec6cae9d7eb3fe5adc6558d30317d61cdceddcc80cad058ab7384143bf9b0d951d4e
- SSDEEP 393216:L/kilMvKRLRBR4R+RlR8R9RbRYRuRPR6RSRXRtRARyRH:L/x0
- TLSH T1EBF6C02427EC8A6AD2EF977BE072051A0BF5E527711FEB4D9C8494FE2C4375588423A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables referencing virtualization MAC addresses 1 IoCs
resource yara_rule behavioral2/files/0x000200000001b2e1-6.dat INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb - UPX dump on OEP (original entry point) 13 IoCs
resource yara_rule behavioral2/memory/4756-0-0x0000000000400000-0x00000000009C1000-memory.dmp UPX behavioral2/memory/4756-1-0x0000000000400000-0x00000000009C1000-memory.dmp UPX behavioral2/files/0x000200000001b2e1-6.dat UPX behavioral2/memory/4756-312-0x0000000000400000-0x00000000009C1000-memory.dmp UPX behavioral2/memory/4756-669-0x0000000000400000-0x00000000009C1000-memory.dmp UPX behavioral2/memory/4756-1009-0x0000000000400000-0x00000000009C1000-memory.dmp UPX behavioral2/memory/4756-1266-0x0000000000400000-0x00000000009C1000-memory.dmp UPX behavioral2/memory/4756-1333-0x0000000000400000-0x00000000009C1000-memory.dmp UPX behavioral2/memory/4756-1359-0x0000000000400000-0x00000000009C1000-memory.dmp UPX behavioral2/memory/4756-1403-0x0000000000400000-0x00000000009C1000-memory.dmp UPX behavioral2/memory/4756-1457-0x0000000000400000-0x00000000009C1000-memory.dmp UPX behavioral2/memory/4756-1538-0x0000000000400000-0x00000000009C1000-memory.dmp UPX behavioral2/memory/4756-1550-0x0000000000400000-0x00000000009C1000-memory.dmp UPX - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VAb = "c:\\Windows\\System32\\VAb.exe" 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MoHAM = "c:\\Windows\\System32\\MoHAM.exe" 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VJpxK = "c:\\Windows\\System32\\VJpxK.exe" 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe - Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created \??\c:\Windows\System32\MoHAM.exe 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File created \??\c:\Windows\System32\VJpxK.exe 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File created \??\c:\Windows\System32\VAb.exe 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe -
resource yara_rule behavioral2/memory/4756-0-0x0000000000400000-0x00000000009C1000-memory.dmp upx behavioral2/memory/4756-1-0x0000000000400000-0x00000000009C1000-memory.dmp upx behavioral2/files/0x000200000001b2e1-6.dat upx behavioral2/memory/4756-312-0x0000000000400000-0x00000000009C1000-memory.dmp upx behavioral2/memory/4756-669-0x0000000000400000-0x00000000009C1000-memory.dmp upx behavioral2/memory/4756-1009-0x0000000000400000-0x00000000009C1000-memory.dmp upx behavioral2/memory/4756-1266-0x0000000000400000-0x00000000009C1000-memory.dmp upx behavioral2/memory/4756-1333-0x0000000000400000-0x00000000009C1000-memory.dmp upx behavioral2/memory/4756-1359-0x0000000000400000-0x00000000009C1000-memory.dmp upx behavioral2/memory/4756-1403-0x0000000000400000-0x00000000009C1000-memory.dmp upx behavioral2/memory/4756-1457-0x0000000000400000-0x00000000009C1000-memory.dmp upx behavioral2/memory/4756-1538-0x0000000000400000-0x00000000009C1000-memory.dmp upx behavioral2/memory/4756-1550-0x0000000000400000-0x00000000009C1000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansRegular.ttf.exe 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic.xml.exe 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_M365_eula.txt.exe 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL087.XML.exe 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\api-ms-win-crt-private-l1-1-0.dll.exe 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Utilities.v3.5.resources.dll 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File created C:\Program Files\Java\jre-1.8\bin\prism_d3d.dll.exe 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-ul-oob.xrm-ms.exe 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-ppd.xrm-ms 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ul-oob.xrm-ms.exe 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\REPORTL.ICO 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\Microsoft.Office.PolicyTips.dll.exe 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE.exe 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-flag-dark.png 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CONCRETE\CONCRETE.INF.exe 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.DataSetExtensions.Resources.dll.exe 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\README.txt 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File created C:\Program Files\VideoLAN\VLC\lua\intf\dummy.luac.exe 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libspudec_plugin.dll 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_cycle_plugin.dll 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_transcode_plugin.dll.exe 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ppd.xrm-ms 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\vlm.html 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_srt_plugin.dll.exe 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mlp_plugin.dll 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_output\libdirect3d11_plugin.dll.exe 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusDemoR_BypassTrial180-ppd.xrm-ms.exe 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART3.BDR.exe 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msvcr120.dll 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\en\SpreadsheetIQ.ExcelAddin.Resources.dll.exe 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File opened for modification C:\Program Files\PushShow.7z 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Net.Resources.dll.exe 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File created C:\Program Files\VideoLAN\VLC\lua\intf\luac.luac.exe 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File created C:\Program Files\Common Files\System\ado\msador28.tlb.exe 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\nl.pak.exe 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-1-0.dll.exe 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-phn.xrm-ms 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-pl.xrm-ms 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\FAXEXT.ECF.exe 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SyncFusion.Grid.Grouping.Base.dll.exe 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\IEAWSDC.DLL 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\sr-Cyrl-RS\tipresx.dll.mui 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\hi_MASCULINE.pak 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-math-l1-1-0.dll.exe 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ppd.xrm-ms.exe 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ppd.xrm-ms 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_F_COL.HXK 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-180.png.exe 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File created C:\Program Files\Mozilla Firefox\nssckbi.dll.exe 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File created C:\Program Files\ApproveRegister.cr2.exe 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\hu_MASCULINE.pak.exe 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-1-0.dll.exe 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\AppvIsvSubsystems64.dll 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File created C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\vlc.mo.exe 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ur.pak.exe 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll.exe 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File created C:\Program Files\Java\jre-1.8\bin\jfxwebkit.dll.exe 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\dom.md 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-pl.xrm-ms 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-ppd.xrm-ms.exe 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-03_6565d09b1684041a02d49b09d0d6ab35_glassworm_snatch.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
PID:4756
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip.dll
- Size 16.1MB
- SHA256 2fd17787c516da59fd88f25b15c38fa49bb826ec075dc2b8e60828dab17a5a51
- MD5 e66095976a2994fab608ac732d80b2f5
- SHA1 f949da405f647f2c3b47a34c41f969e0eec5f73f
- SHA512 4838a176ca1246642c51b4ddb10856dddb9f85d46773367fbe74c022556256db3c7bf4f7d6b9936646af5ac0cf6ca6f5a82765d3fa1093087dd0f55a9fe3e789
- SSDEEP 393216:L/kilMvKRLRBR4R+RlR8R9RbRYRuRPR6RSRXRtRARyR4RF:L/x3
- TLSH T1D207C02467EC8A6AD2EF977BE072051A0BF5E127711FEB4D9C8494FE2C4375588423A3
- MD5 SHA1 SHA512 SSDEEP TLSH