8ca18586c6704136ae280796224c9412139adb8f0e743675f554e6c7f8762204

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 03:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_99dddd545ff8674097608e21f98b7afe_elex_glassworm_stop_vidar.exe
Size 3.3MB
Sample260814-d9vxtafa42
SHA256 8ca18586c6704136ae280796224c9412139adb8f0e743675f554e6c7f8762204
MD5 99dddd545ff8674097608e21f98b7afe
SHA1 ef9218ae890d1a0609c3fc746f712f5515de7ca3
SHA512 72a98b061081eba0c7bef0c44a0ca23f1ed4bd26de430b4281d5d389e23c1760a1f5a228d27762dde78715bfa85a9fc15fbba900be99ce6c95e88e0738380844
SSDEEP 49152:U+EPiw2k+EPiw2k+EPiw2jqatglg+EPiw2k+EPiw2k+EPiw2jqatglVDd79WCt:vWgp7r
TLSH
T19EF5390577ED4825F4B7623189B7866A9AB2B8515F32C7CF6284833D4E73BD0AD30B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
108	svchost_BCBBBBCCBCBCACACCBBBACBBAABBBACBBABAACCABCCBBBABCBAABCB.exe
672	svchost_AABBCACACBBACCBBAACCCBCCBBBCBBBCACCBBACBBACCBACABCAABAC.exe
3096	svchost_BCBBBBCCBCBCACACCBBBACBBAABBBACBBABAACCABCCBBBABCBAABCB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACCABABABBCCBACAAACCCCBBBCACACAABBBACABBAACCAAABBACBACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBBBBCCBCBCACACCBBBACBBAABBBACBBABAACCABCCBBBABCBAABCB.exe"	2026-08-14_99dddd545ff8674097608e21f98b7afe_elex_glassworm_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAABCCACACBCCCAAABBCAAACAAAACBCCAACABAABAACAABAACBCAABBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABBCACACBBACCBBAACCCBCCBBBCBBBCACCBBACBBACCBACABCAABAC.exe"	svchost_BCBBBBCCBCBCACACCBBBACBBAABBBACBBABAACCABCCBBBABCBAABCB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1852	sc.exe
3828	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6036	cmd.exe
5228	cmd.exe
1520	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_99dddd545ff8674097608e21f98b7afe_elex_glassworm_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBBBBCCBCBCACACCBBBACBBAABBBACBBABAACCABCCBBBABCBAABCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABBCACACBBACCBBAACCCBCCBBBCBBBCACCBBACBBACCBACABCAABAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2612	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1628	2026-08-14_99dddd545ff8674097608e21f98b7afe_elex_glassworm_stop_vidar.exe
1628	2026-08-14_99dddd545ff8674097608e21f98b7afe_elex_glassworm_stop_vidar.exe
1628	2026-08-14_99dddd545ff8674097608e21f98b7afe_elex_glassworm_stop_vidar.exe
1628	2026-08-14_99dddd545ff8674097608e21f98b7afe_elex_glassworm_stop_vidar.exe
108	svchost_BCBBBBCCBCBCACACCBBBACBBAABBBACBBABAACCABCCBBBABCBAABCB.exe
108	svchost_BCBBBBCCBCBCACACCBBBACBBAABBBACBBABAACCABCCBBBABCBAABCB.exe
108	svchost_BCBBBBCCBCBCACACCBBBACBBAABBBACBBABAACCABCCBBBABCBAABCB.exe
108	svchost_BCBBBBCCBCBCACACCBBBACBBAABBBACBBABAACCABCCBBBABCBAABCB.exe
672	svchost_AABBCACACBBACCBBAACCCBCCBBBCBBBCACCBBACBBACCBACABCAABAC.exe
672	svchost_AABBCACACBBACCBBAACCCBCCBBBCBBBCACCBBACBBACCBACABCAABAC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1628	2026-08-14_99dddd545ff8674097608e21f98b7afe_elex_glassworm_stop_vidar.exe
Token: SeDebugPrivilege	108	svchost_BCBBBBCCBCBCACACCBBBACBBAABBBACBBABAACCABCCBBBABCBAABCB.exe
Token: SeDebugPrivilege	672	svchost_AABBCACACBBACCBBAACCCBCCBBBCBBBCACCBBACBBACCBACABCAABAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 1520	1628	2026-08-14_99dddd545ff8674097608e21f98b7afe_elex_glassworm_stop_vidar.exe	91
PID 1520 wrote to memory of 2612	1520	cmd.exe	93
PID 108 wrote to memory of 2288	108	svchost_BCBBBBCCBCBCACACCBBBACBBAABBBACBBABAACCABCCBBBABCBAABCB.exe	94
PID 1628 wrote to memory of 6036	1628	2026-08-14_99dddd545ff8674097608e21f98b7afe_elex_glassworm_stop_vidar.exe	97
PID 6036 wrote to memory of 3828	6036	cmd.exe	99
PID 1628 wrote to memory of 5228	1628	2026-08-14_99dddd545ff8674097608e21f98b7afe_elex_glassworm_stop_vidar.exe	100
PID 5228 wrote to memory of 1852	5228	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-14_99dddd545ff8674097608e21f98b7afe_elex_glassworm_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_99dddd545ff8674097608e21f98b7afe_elex_glassworm_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABABABACBBBAAABACCCBBACACCCABBAAAABACBACCCCBBCCBABBCBABABCBBBCABAABBCCBCACBBCCCCCBBACAACCCCACCCCABBABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBBCCBCBCACACCBBBACBBAABBBACBBABAACCABCCBBBABCBAABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1520
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABABABACBBBAAABACCCBBACACCCABBAAAABACBACCCCBBCCBABBCBABABCBBBCABAABBCCBCACBBCCCCCBBACAACCCCACCCCABBABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBBCCBCBCACACCBBBACBBAABBBACBBABAACCABCCBBBABCBAABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCABCBACBCAABBCBCCCCABAAAABCBCBCAAABBBBCACBBBBBABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBBCCBCBCACACCBBBACBBAABBBACBBABAACCABCCBBBABCBAABCB.exe" start= auto displayName= "UserDataSvc_CCABCBACBCAABBCBCCCCABAAAABCBCBCAAABBBBCACBBBBBABAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6036
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCABCBACBCAABBCBCCCCABAAAABCBCBCAAABBBBCACBBBBBABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBBCCBCBCACACCBBBACBBAABBBACBBABAACCABCCBBBABCBAABCB.exe" start= auto displayName= "UserDataSvc_CCABCBACBCAABBCBCCCCABAAAABCBCBCAAABBBBCACBBBBBABAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3828
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCABCBACBCAABBCBCCCCABAAAABCBCBCAAABBBBCACBBBBBABAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5228
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCABCBACBCAABBCBCCCCABAAAABCBCBCAAABBBBCACBBBBBABAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1852

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBBCCBCBCACACCBBBACBBAABBBACBBABAACCABCCBBBABCBAABCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBBCCBCBCACACCBBBACBBAABBBACBBABAACCABCCBBBABCBAABCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:108
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2288

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCACACBBACCBBAACCCBCCBBBCBBBCACCBBACBBACCBACABCAABAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCACACBBACCBBAACCCBCCBBBCBBBCACCBBACBBACCBACABCAABAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:672

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBBCCBCBCACACCBBBACBBAABBBACBBABAACCABCCBBBABCBAABCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBBCCBCBCACACCBBBACBBAABBBACBBABAACCABCCBBBABCBAABCB.exe
1⤵
- Executes dropped EXE
PID:3096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d454676f604cc9060efa0a09c1e5b4928763fa59882ad85e4879a626f8b3f98f
MD5 a58b658298f28174fd82964d989c88b4
SHA1 18c373ed75f0f9550c3794bd93e899fb51cd78aa
SHA512 77cf90da4c70772314fc0220c9ca1a470fe2b6f5ad0315fb0ba3b1076781ceb83eee41e0c53d0c599ad957928546fd933d829495d225377d5e5c980ce81d98d9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e1f7693c5620b16a0cb2a46742df6b2c1678ed6b79c38386cba810b9716beae0
MD5 56d320a45ec10bbdce6bf944ac11f6e6
SHA1 122d1495d6f6ff1cd2123058f09627272ec9908e
SHA512 ba54a2a6d110f0572d041684436fe618280a6e1fbf04184c7b381846e4c79727f806ed97eb499cb2ffab2bc6863fbc5fa2f62e361454a202b03c5dca64f0091e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 18a2cb519092241e16fcc1d7a92e704f272c1aab7f33d0598d8dab9006473cbe
MD5 a1474092c61be64fbe3218b7be0c3331
SHA1 4e45d897338de5f2a9ce63f64f649f253e80559c
SHA512 aa932ab9cc6aee2812ee389191486466a8d7323bee0dc7152db1700772b17dd2fe3c5ea40993bc27a5a664bc337df3568b18e11d6327ab8fef664fda55852e5c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ecfa9cbfff4b2470dbe26d9970af9f4079e409920a8f0ccfcfa6bac3e75f23c7
MD5 55a78cc1ebcc3a33eba95aabc5aa1205
SHA1 72429ff23565de091a305f2472e5c73ef647aff6
SHA512 17eeceb6e4e2ad3d6b0b68dd57bf93729fed987b005f42120b2809949647d6d975c6a1d7c4a9273c1d097a97a1cfb7a4f0ab9a803e899cbf6a3f765f03bfcb88
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a45caea9138cb4a89eff697c1d7be37c2edc18d83a5bef5a7ed012ea766b995c
MD5 13c301c0be63be5bd32fa47ad445210a
SHA1 b47225c53208d6973fe087ec302d66779583c374
SHA512 583379b3b2b233793fec4318628d079ba55fa0714b6541f528685c74ea4ff5cbab2762bd6a0e5d9cadd3b25bea8ba379421bf550f3a64602a45a47670cd7f862
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2a22070ae90bfcf4f2e2a81615f9aec021ed61b7dd8db3eb6f40395c3697b536
MD5 6a5c4cdc21cc561259ea4612331fcdd9
SHA1 a29d6357465d1959641687803543b650017f1b4f
SHA512 1265b7af68956342943f35b6072c6d93cc608e3ade2f93f77bfaa9738c28952a317792f728f46e4dba149e592ed65371f088eded6725222fdaca5cc597fcf3f1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b8da5c1258f48fd22f738cd824c9693452938f46ecb06bc7c6309ea16290018f
MD5 1de31e20a76646903f234ee0b83193ac
SHA1 6488ab635d448a8e1a13795850cef59b563142e8
SHA512 b0d0dbd2b87ec86a7ebf0d4ef45eb58a1142515d8e9a8cb95e653823824b704a6c3d0dd6bea5b4d2c3ac4e7d5ef6677446e163cac0175a3696df5a991ee3ab65
MD5 SHA1 SHA512

Submit Download

svchost_BCBBBBCCBCBCACACCBBBACBBAABBBACBBABAACCABCCBBBABCBAABCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBBCCBCBCACACCBBBACBBAABBBACBBABAACCABCCBBBABCBAABCB.exe
Size 3.3MB
SHA256 8ca18586c6704136ae280796224c9412139adb8f0e743675f554e6c7f8762204
MD5 99dddd545ff8674097608e21f98b7afe
SHA1 ef9218ae890d1a0609c3fc746f712f5515de7ca3
SHA512 72a98b061081eba0c7bef0c44a0ca23f1ed4bd26de430b4281d5d389e23c1760a1f5a228d27762dde78715bfa85a9fc15fbba900be99ce6c95e88e0738380844
SSDEEP 49152:U+EPiw2k+EPiw2k+EPiw2jqatglg+EPiw2k+EPiw2k+EPiw2jqatglVDd79WCt:vWgp7r
TLSH
T19EF5390577ED4825F4B7623189B7866A9AB2B8515F32C7CF6284833D4E73BD0AD30B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 3f0d17db87a49a4701ba8592b97308fda5a0d6e889f282b7a716e0b75dbf4d29
MD5 b3712c87c046d74a92bc313b6086f98b
SHA1 f99439b9990c1604132423769c190c90c63881f8
SHA512 3fa1a5f2c98557583d12b5a9d708653711a5e86ad4fbfc374c719a7858ff566425d33cf4af7190794ff999c80c00197d518a13c35ad666e447daffbe699118dd
TLSH
T1DA11E360E5F5D813EC3378CB5F3ADBD218A47A9F5C986A252304022CBF99C335D190EA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/108-34-0x0000000000DC0000-0x0000000000DE1000-memory.dmp

Download

memory/672-74-0x0000000000670000-0x0000000000691000-memory.dmp

Download

memory/1628-8-0x00000000006E0000-0x0000000000701000-memory.dmp

Download

memory/1628-0-0x00000000006E0000-0x0000000000701000-memory.dmp

Download