beb5e6e110a6aa0e219393ad1917e8bd1e3a228e2c8d5660b8e9fbbfe678edd1

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/11/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
Size 7.7MB
Sample261110-vtl4eahb83
SHA256 beb5e6e110a6aa0e219393ad1917e8bd1e3a228e2c8d5660b8e9fbbfe678edd1
MD5 68b7cb79d31d8f5aa608213df5225f01
SHA1 3ed4fc70927d93829a66ddd0259ce900393b716c
SHA512 c6112074e1060a5265f55c83477b2b1e471a817af5c3a149b049b49e31fc51cfcbededa3da2df1f4cbfb343713fcb0ad025c58db07defd1579d15c5369634840
SSDEEP 196608:k4JE6Tki//Nk/vnuhRBhRnhRchRihRbhRYhRs:L/kilMvKRLRhRARGRtRkRs
TLSH
T14286E02527EC8A6AD2EF937EE072051A0BF5E527721FEB4D9C8494FD2C4375588423A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence upx

Malware Config

Signatures

Custom signature

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
behavioral1/files/0x0002000000022b7b-6.dat	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Custom signature

UPX dump on OEP (original entry point) 16 IoCs

resource	yara_rule
behavioral1/memory/4668-0-0x0000000000400000-0x00000000009C1000-memory.dmp	UPX
behavioral1/memory/4668-1-0x0000000000400000-0x00000000009C1000-memory.dmp	UPX
behavioral1/files/0x0002000000022b7b-6.dat	UPX
behavioral1/memory/4668-451-0x0000000000400000-0x00000000009C1000-memory.dmp	UPX
behavioral1/memory/4668-1006-0x0000000000400000-0x00000000009C1000-memory.dmp	UPX
behavioral1/memory/4668-1761-0x0000000000400000-0x00000000009C1000-memory.dmp	UPX
behavioral1/memory/4668-2583-0x0000000000400000-0x00000000009C1000-memory.dmp	UPX
behavioral1/memory/4668-2666-0x0000000000400000-0x00000000009C1000-memory.dmp	UPX
behavioral1/memory/4668-2829-0x0000000000400000-0x00000000009C1000-memory.dmp	UPX
behavioral1/memory/4668-2976-0x0000000000400000-0x00000000009C1000-memory.dmp	UPX
behavioral1/memory/4668-2987-0x0000000000400000-0x00000000009C1000-memory.dmp	UPX
behavioral1/memory/4668-2988-0x0000000000400000-0x00000000009C1000-memory.dmp	UPX
behavioral1/memory/4668-2989-0x0000000000400000-0x00000000009C1000-memory.dmp	UPX
behavioral1/memory/4668-2990-0x0000000000400000-0x00000000009C1000-memory.dmp	UPX
behavioral1/memory/4668-3035-0x0000000000400000-0x00000000009C1000-memory.dmp	UPX
behavioral1/memory/4668-3049-0x0000000000400000-0x00000000009C1000-memory.dmp	UPX

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WSLUJPZ = "c:\\Windows\\System32\\WSLUJPZ.exe"	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sFNtAxSw = "c:\\Windows\\System32\\sFNtAxSw.exe"	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GBMzlQscY = "c:\\Windows\\System32\\GBMzlQscY.exe"	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\desktop.ini	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\WSLUJPZ.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	\??\c:\Windows\System32\sFNtAxSw.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	\??\c:\Windows\System32\GBMzlQscY.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4668-0-0x0000000000400000-0x00000000009C1000-memory.dmp	upx
behavioral1/memory/4668-1-0x0000000000400000-0x00000000009C1000-memory.dmp	upx
behavioral1/files/0x0002000000022b7b-6.dat	upx
behavioral1/memory/4668-451-0x0000000000400000-0x00000000009C1000-memory.dmp	upx
behavioral1/memory/4668-1006-0x0000000000400000-0x00000000009C1000-memory.dmp	upx
behavioral1/memory/4668-1761-0x0000000000400000-0x00000000009C1000-memory.dmp	upx
behavioral1/memory/4668-2583-0x0000000000400000-0x00000000009C1000-memory.dmp	upx
behavioral1/memory/4668-2666-0x0000000000400000-0x00000000009C1000-memory.dmp	upx
behavioral1/memory/4668-2829-0x0000000000400000-0x00000000009C1000-memory.dmp	upx
behavioral1/memory/4668-2976-0x0000000000400000-0x00000000009C1000-memory.dmp	upx
behavioral1/memory/4668-2987-0x0000000000400000-0x00000000009C1000-memory.dmp	upx
behavioral1/memory/4668-2988-0x0000000000400000-0x00000000009C1000-memory.dmp	upx
behavioral1/memory/4668-2989-0x0000000000400000-0x00000000009C1000-memory.dmp	upx
behavioral1/memory/4668-2990-0x0000000000400000-0x00000000009C1000-memory.dmp	upx
behavioral1/memory/4668-3035-0x0000000000400000-0x00000000009C1000-memory.dmp	upx
behavioral1/memory/4668-3049-0x0000000000400000-0x00000000009C1000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarMediumTile.scale-400.png.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Configuration.winmd	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNewNoteLargeTile.scale-400.png.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationUI.resources.dll	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\LibrarySquare150x150Logo.scale-100_contrast-white.png	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-72_altform-unplated.png.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.UI\Resources\Images\star_half.png.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-ppd.xrm-ms.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-conio-l1-1-0.dll.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul-oob.xrm-ms	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\SplashScreen.scale-200_contrast-white.png	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailSplashLogo.scale-300.png	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-100.png	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-72_altform-unplated_contrast-black.png.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SmallTile.scale-150_contrast-black.png.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\System.Xaml.resources.dll	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.he-il.dll.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\VisualElements\SmallLogoBeta.png	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\plugin2\msvcp140.dll	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-black\LargeTile.scale-125.png.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-100_8wekyb3d8bbwe\resources.pri	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\Doughboy.scale-100.png.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Design.resources.dll	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\WISC30.DLL.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.VisualElementsManifest.xml.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-40_contrast-black.png	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\ErrorDot.png.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionMedTile.scale-100.png.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\buttons.png.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-80_altform-lightunplated.png	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeApi.dll	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Speech\en-GB\tokens_enGB.xml	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-32.png.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-16_altform-unplated.png.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-white\SmallTile.scale-200.png.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\UIAutomationClientSideProviders.resources.dll	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libdvdnav_plugin.dll	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionGroupWideTile.scale-125.png.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\WindowsBase.resources.dll	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\fa.pak.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\Windows.winmd	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_Call_Ringback.m4a	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-48_altform-unplated_contrast-black.png	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-black_targetsize-30.png.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\PlatformCapabilities\CommonCapabilities.json.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\TelemetryUWP.dll	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\MixedRealityPortalAppList.scale-100_contrast-black.png	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNotebookWideTile.scale-400.png.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-36_altform-unplated_contrast-high.png.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\ReachFramework.resources.dll	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7FR.LEX	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libwav_plugin.dll	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\Timer10Sec.targetsize-24.png	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreBadgeLogo.scale-200.png.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Controls.Ribbon.resources.dll	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSPTLS.DLL.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SyncFusion.Tools.Windows.dll.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\SplashScreen\PaintSplashScreen.scale-100.png	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\import_google_contacts\googleImportNoResults.png.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe

C:\Users\Admin\AppData\Local\Temp\2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe"
1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
PID:4668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7-zip.dll

Path C:\Program Files\7-Zip\7-zip.dll
Size 8.4MB
SHA256 205f2c0e9f7382910bd62e85b10cb50c3a25c6b4e4f7a20f600a0a7b240fe0c6
MD5 0133a2e24fca3babbb7813a0679b6ae0
SHA1 96a95f398be250d1161252f0e667885b3a2278c1
SHA512 9397c3c6e05a67f1ac9419125f5c35a46841fb874806fea46e6cfad55c9f5d8e703dd49f68c7d0864bbbdf8d5f44b79146b28d1a96b1eb2066859afd9d8d1571
SSDEEP 196608:k4JE6Tki//Nk/vnuhRBhRnhRchRihRbhRYhRdhRD:L/kilMvKRLRhRARGRtRkRvRD
TLSH
T1CA96D02527EC8A6AD2EF937AF072051A0BF5E527721FEB4D9C8494FD2C4375588423A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4668-2829-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

memory/4668-2988-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

memory/4668-451-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

memory/4668-1006-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

memory/4668-1761-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

memory/4668-2583-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

memory/4668-1-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

memory/4668-2976-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

memory/4668-2666-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

memory/4668-2987-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

memory/4668-0-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

memory/4668-2989-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

memory/4668-2990-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

memory/4668-3035-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

memory/4668-3049-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads