beb5e6e110a6aa0e219393ad1917e8bd1e3a228e2c8d5660b8e9fbbfe678edd1

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
Size 7.7MB
Sample261110-vtl4eahb83
SHA256 beb5e6e110a6aa0e219393ad1917e8bd1e3a228e2c8d5660b8e9fbbfe678edd1
MD5 68b7cb79d31d8f5aa608213df5225f01
SHA1 3ed4fc70927d93829a66ddd0259ce900393b716c
SHA512 c6112074e1060a5265f55c83477b2b1e471a817af5c3a149b049b49e31fc51cfcbededa3da2df1f4cbfb343713fcb0ad025c58db07defd1579d15c5369634840
SSDEEP 196608:k4JE6Tki//Nk/vnuhRBhRnhRchRihRbhRYhRs:L/kilMvKRLRhRARGRtRkRs
TLSH
T14286E02527EC8A6AD2EF937EE072051A0BF5E527721FEB4D9C8494FD2C4375588423A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence upx

Malware Config

Signatures

Custom signature

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
behavioral2/files/0x000200000001b2c4-6.dat	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Custom signature

UPX dump on OEP (original entry point) 12 IoCs

resource	yara_rule
behavioral2/memory/5124-0-0x0000000000400000-0x00000000009C1000-memory.dmp	UPX
behavioral2/memory/5124-1-0x0000000000400000-0x00000000009C1000-memory.dmp	UPX
behavioral2/files/0x000200000001b2c4-6.dat	UPX
behavioral2/memory/5124-473-0x0000000000400000-0x00000000009C1000-memory.dmp	UPX
behavioral2/memory/5124-1055-0x0000000000400000-0x00000000009C1000-memory.dmp	UPX
behavioral2/memory/5124-1698-0x0000000000400000-0x00000000009C1000-memory.dmp	UPX
behavioral2/memory/5124-2330-0x0000000000400000-0x00000000009C1000-memory.dmp	UPX
behavioral2/memory/5124-2572-0x0000000000400000-0x00000000009C1000-memory.dmp	UPX
behavioral2/memory/5124-2619-0x0000000000400000-0x00000000009C1000-memory.dmp	UPX
behavioral2/memory/5124-2759-0x0000000000400000-0x00000000009C1000-memory.dmp	UPX
behavioral2/memory/5124-2904-0x0000000000400000-0x00000000009C1000-memory.dmp	UPX
behavioral2/memory/5124-2960-0x0000000000400000-0x00000000009C1000-memory.dmp	UPX

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VUi = "c:\\Windows\\System32\\VUi.exe"	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wtrg = "c:\\Windows\\System32\\wtrg.exe"	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wPs = "c:\\Windows\\System32\\wPs.exe"	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\VUi.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	\??\c:\Windows\System32\wtrg.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	\??\c:\Windows\System32\wPs.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5124-0-0x0000000000400000-0x00000000009C1000-memory.dmp	upx
behavioral2/memory/5124-1-0x0000000000400000-0x00000000009C1000-memory.dmp	upx
behavioral2/files/0x000200000001b2c4-6.dat	upx
behavioral2/memory/5124-473-0x0000000000400000-0x00000000009C1000-memory.dmp	upx
behavioral2/memory/5124-1055-0x0000000000400000-0x00000000009C1000-memory.dmp	upx
behavioral2/memory/5124-1698-0x0000000000400000-0x00000000009C1000-memory.dmp	upx
behavioral2/memory/5124-2330-0x0000000000400000-0x00000000009C1000-memory.dmp	upx
behavioral2/memory/5124-2572-0x0000000000400000-0x00000000009C1000-memory.dmp	upx
behavioral2/memory/5124-2619-0x0000000000400000-0x00000000009C1000-memory.dmp	upx
behavioral2/memory/5124-2759-0x0000000000400000-0x00000000009C1000-memory.dmp	upx
behavioral2/memory/5124-2904-0x0000000000400000-0x00000000009C1000-memory.dmp	upx
behavioral2/memory/5124-2960-0x0000000000400000-0x00000000009C1000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8EN.LEX.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe.manifest.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\shortcuts_log.ini	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\RESENDL.ICO	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\nl\msipc.dll.mui	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.Diagnostics.dll.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN058.XML.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Royale.dll	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\Windows Defender\DefenderCSP.dll	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-runtime-l1-1-0.dll.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\prism_d3d.dll.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\dom.md.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-pl.xrm-ms	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\msvcp120.dll	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL103.XML	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\el.pak	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ul-oob.xrm-ms.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OSFSHARED.DLL	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\api-ms-win-core-timezone-l1-1-0.dll	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_18_b81900_40x40.png.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Grace-ul-oob.xrm-ms.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\manifest.xml	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OFFREL.DLL	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LAYERS\LAYERS.ELM.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\libEGL.dll	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-pl.xrm-ms	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Grace-ul-oob.xrm-ms	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\POST.CFG	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotelemetry.dll.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SATIN\PREVIEW.GIF.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.config	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-ul-oob.xrm-ms.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\YAHOO.COM.MY.XML	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\proof.fr-fr.msi.16.fr-fr.tree.dat	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\vlc.mo	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libdirectsound_plugin.dll	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_gather_plugin.dll	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libmagnify_plugin.dll.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-conio-l1-1-0.dll	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet.xml.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-ppd.xrm-ms.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ul.xrm-ms.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ul-oob.xrm-ms.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Grace-ppd.xrm-ms	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Core.NetFX35.V7.dll	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\Windows Defender\MsMpEng.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\Java\jdk-1.8\jre\COPYRIGHT.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ppd.xrm-ms	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ul-oob.xrm-ms.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ja\msipc.dll.mui	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\YAHOO.DE.XML.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN089.XML	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8ES.LEX	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\vi_NEUTER.pak	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\npt.dll	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ul-phn.xrm-ms	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSPST32.DLL.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.UI.dll.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\tzdb.dat.exe	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe

C:\Users\Admin\AppData\Local\Temp\2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-09_68b7cb79d31d8f5aa608213df5225f01_glassworm_snatch.exe"
1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
PID:5124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7-zip.dll

Path C:\Program Files\7-Zip\7-zip.dll
Size 8.4MB
SHA256 0ab8aaa8621e759771f5cb47ff06fb72efdf200d05a672d7e80c85ac8ff4973e
MD5 d06eed9210bced0dc16bb3944d324d50
SHA1 2e1119eb950f1d153675f940268b70aef00707da
SHA512 d63532b588c7f19e65ea5790ad60e236a32c097ea0f6f506a0df77f5e47846adb66b051e436d1c021e1338ef2bc4e24338fa73b2c1ced4f216c1e354e6498775
SSDEEP 196608:k4JE6Tki//Nk/vnuhRBhRnhRchRihRbhRYhRdhRu:L/kilMvKRLRhRARGRtRkRvRu
TLSH
T19C96D02527EC8A6AD2EF977AF072051A0BF1E527721FEB4D9C8494FD2C4375588423A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5124-0-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

memory/5124-1-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

memory/5124-473-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

memory/5124-1055-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

memory/5124-1698-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

memory/5124-2330-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

memory/5124-2572-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

memory/5124-2619-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

memory/5124-2759-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

memory/5124-2904-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

memory/5124-2960-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads