8c17839f52f8f4470b471b624e23000c65c2e3fcb7c0edee2c769cb1fba4d6af

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_484ff267c8d4834fda49db0f2cf28cb6_elex_glassworm_stop_vidar.exe
Size 1.7MB
Sample260814-e7rytavcqc
SHA256 8c17839f52f8f4470b471b624e23000c65c2e3fcb7c0edee2c769cb1fba4d6af
MD5 484ff267c8d4834fda49db0f2cf28cb6
SHA1 78812093dae724452d6fe63563f75db73f944a92
SHA512 676a746fc49cdbcd4e88456743b3c6c3caa5421fb7c91469aee9e4eff5e30dc3aee80055f49df2c111fc284c3e66825da4327c3d42b6d8f40368fb1e81276a99
SSDEEP 49152:U+EPiw2jqatglg+EPiw2jqatglVDd79WCs:P+gp7u
TLSH
T17B854B05B7D98532F4B7223149AB83669AB2B8515F36D3CF6384933D4E337D0AA31B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4352	svchost_CBCACCAACABACBCABACCAABCBABABAAAACCACBABBBCCBACBCCACCBC.exe
1604	svchost_CCBCAABBACACAABBBBAAABACACBACACABBCCBCABBABBBCACACBCCAC.exe
2636	svchost_CBCACCAACABACBCABACCAABCBABABAAAACCACBABBBCCBACBCCACCBC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CACAAABBACBAABCABBACBAACABAABBBCAACBBBBBBACBCCBABBBBCACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCACCAACABACBCABACCAABCBABABAAAACCACBABBBCCBACBCCACCBC.exe"	2026-08-14_484ff267c8d4834fda49db0f2cf28cb6_elex_glassworm_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCBCAABBACBABCBBAACBAABCBBAAACCACCBACAABBBCCBABABBAABCAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBCAABBACACAABBBBAAABACACBACACABBCCBCABBABBBCACACBCCAC.exe"	svchost_CBCACCAACABACBCABACCAABCBABABAAAACCACBABBBCCBACBCCACCBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4280	sc.exe
864	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4048	cmd.exe
2192	cmd.exe
3812	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCACCAACABACBCABACCAABCBABABAAAACCACBABBBCCBACBCCACCBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_484ff267c8d4834fda49db0f2cf28cb6_elex_glassworm_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBCAABBACACAABBBBAAABACACBACACABBCCBCABBABBBCACACBCCAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4984	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4824	2026-08-14_484ff267c8d4834fda49db0f2cf28cb6_elex_glassworm_stop_vidar.exe
4824	2026-08-14_484ff267c8d4834fda49db0f2cf28cb6_elex_glassworm_stop_vidar.exe
4824	2026-08-14_484ff267c8d4834fda49db0f2cf28cb6_elex_glassworm_stop_vidar.exe
4824	2026-08-14_484ff267c8d4834fda49db0f2cf28cb6_elex_glassworm_stop_vidar.exe
4352	svchost_CBCACCAACABACBCABACCAABCBABABAAAACCACBABBBCCBACBCCACCBC.exe
4352	svchost_CBCACCAACABACBCABACCAABCBABABAAAACCACBABBBCCBACBCCACCBC.exe
4352	svchost_CBCACCAACABACBCABACCAABCBABABAAAACCACBABBBCCBACBCCACCBC.exe
4352	svchost_CBCACCAACABACBCABACCAABCBABABAAAACCACBABBBCCBACBCCACCBC.exe
1604	svchost_CCBCAABBACACAABBBBAAABACACBACACABBCCBCABBABBBCACACBCCAC.exe
1604	svchost_CCBCAABBACACAABBBBAAABACACBACACABBCCBCABBABBBCACACBCCAC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4824	2026-08-14_484ff267c8d4834fda49db0f2cf28cb6_elex_glassworm_stop_vidar.exe
Token: SeDebugPrivilege	4352	svchost_CBCACCAACABACBCABACCAABCBABABAAAACCACBABBBCCBACBCCACCBC.exe
Token: SeDebugPrivilege	1604	svchost_CCBCAABBACACAABBBBAAABACACBACACABBCCBCABBABBBCACACBCCAC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4860	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 4048	4824	2026-08-14_484ff267c8d4834fda49db0f2cf28cb6_elex_glassworm_stop_vidar.exe	99
PID 4048 wrote to memory of 4984	4048	cmd.exe	101
PID 4352 wrote to memory of 2908	4352	svchost_CBCACCAACABACBCABACCAABCBABABAAAACCACBABBBCCBACBCCACCBC.exe	102
PID 2908 wrote to memory of 2308	2908	notepad.exe	103
PID 4824 wrote to memory of 2192	4824	2026-08-14_484ff267c8d4834fda49db0f2cf28cb6_elex_glassworm_stop_vidar.exe	107
PID 2192 wrote to memory of 4280	2192	cmd.exe	109
PID 4824 wrote to memory of 3812	4824	2026-08-14_484ff267c8d4834fda49db0f2cf28cb6_elex_glassworm_stop_vidar.exe	110
PID 3812 wrote to memory of 864	3812	cmd.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-08-14_484ff267c8d4834fda49db0f2cf28cb6_elex_glassworm_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_484ff267c8d4834fda49db0f2cf28cb6_elex_glassworm_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCAAABBABABCBCCBBBCCAABCCCCABCBABBBCBBCAABBBBBAABBCACACCCACCCBCCCABAAABCCCBAACAABACAAAABBACBABBCCBAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCAACABACBCABACCAABCBABABAAAACCACBABBBCCBACBCCACCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4048
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCAAABBABABCBCCBBBCCAABCCCCABCBABBBCBBCAABBBBBAABBCACACCCACCCBCCCABAAABCCCBAACAABACAAAABBACBABBCCBAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCAACABACBCABACCAABCBABABAAAACCACBABBBCCBACBCCACCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4984
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCCABCACACACCAABCBABAAABBBBABBCAACAABCABACABBBBCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCAACABACBCABACCAABCBABABAAAACCACBABBBCCBACBCCACCBC.exe" start= auto displayName= "UserDataSvc_CCCCABCACACACCAABCBABAAABBBBABBCAACAABCABACABBBBCCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2192
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCCABCACACACCAABCBABAAABBBBABBCAACAABCABACABBBBCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCAACABACBCABACCAABCBABABAAAACCACBABBBCCBACBCCACCBC.exe" start= auto displayName= "UserDataSvc_CCCCABCACACACCAABCBABAAABBBBABBCAACAABCABACABBBBCCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4280
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCCABCACACACCAABCBABAAABBBBABBCAACAABCABACABBBBCCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3812
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCCABCACACACCAABCBABAAABBBBABBCAACAABCABACABBBBCCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:864

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCAACABACBCABACCAABCBABABAAAACCACBABBBCCBACBCCACCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCAACABACBCABACCAABCBABABAAAACCACBABBBCCBACBCCACCBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2908
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2308

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4860

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCAABBACACAABBBBAAABACACBACACABBCCBCABBABBBCACACBCCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCAABBACACAABBBBAAABACACBACACABBCCBCABBABBBCACACBCCAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1604

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCAACABACBCABACCAABCBABABAAAACCACBABBBCCBACBCCACCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCAACABACBCABACCAABCBABABAAAACCACBABBBCCBACBCCACCBC.exe
1⤵
- Executes dropped EXE
PID:2636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bbcbb0c10280d195999351a609acc29b1c3e42704bf571df36f4769f72546052
MD5 822b2fc4f5986541505c7650d7c6d337
SHA1 bcbf92aba9ffa3f545d19007aca53b52b4ab3055
SHA512 a47b3aea3f2f48fbc1d3269b98a7dbdfea5a935ecfd795cf9ce3da87166a61d49f627a6e5332289b53a84662ceae86de9662fb0ef1cfc7af2c0da27230722b5f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2902000f140cbd38de431a4073770aff447bf59b38b531a82ce4b8ce2e251ef6
MD5 118295760dd3f77bcbfa0c360c5479b5
SHA1 34f2849a52994426e82373592ac57d5615e9110e
SHA512 a6f99a0968d8eae89fb8d273ab30a50ebb2c17923d80ccb001a4c94383d82b0c3e599b7e38262f6e25d93d82e68fbc26bee311eaaadc3590a77e3aabb283fc28
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f1d03b863badb46855095e2d8ca27ed046881d86959c167e94305282de475bfe
MD5 04dfdbb341949a749c56beeda2b73767
SHA1 64f3dc9320309a086eec685fd08ed48a5b443a69
SHA512 f1facffa83564fc72232324e8c82a4be79fa58773fd04bb6b6ad0bd277763556c4b00e8c60442c15ca6578fda39c9ca2d5c56ad440ec3496d2c9f4254c1b6bd3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 feed17d850d85a2c550c2a657571d394e159819dbe30bbf9f3ee18f504af5476
MD5 33eca9658b97bec9267ab32303bbf0a2
SHA1 45b3d1eed9c7a96551ba62830d52002088cbd1f4
SHA512 756d9a0c6815257eb7e03a22029d7351e8fe3a4e92a87d550169ec8f28d15843954d8b225ed3dcb98a9e8bbf9411182a48a4bba3438f0f92814735caa82ba432
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0663744ddcfb40b484dbc05dd4942ff19ca34fc04bdfe89f7bff2b848a6c5161
MD5 3e5c783c96600ca905bbaa6a3fc3b226
SHA1 83448bbee5022214e4c2688e2eab7956c1a37220
SHA512 72f511b2eedd7e983a74cad67fd8c3942aa52ebe2c389eff539c072cd1319a6e370afcba0b9a3a5eec4268a756fd62172f8aa8d83346749b7cbd457a55f2d846
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b4a12967bf1c89d4e262817cbc1c684cdb1fe03c92dbba514d1d6dd4d7fd6968
MD5 77d1b18e1f1d48eef264038318f6bf5c
SHA1 62da84a4aee8420b813d016b7f2d50ef901326c4
SHA512 a4121010a8aaff1758d70b85ef12e7400caedb8e93fd1fc4317aa0bd68e15cc3cf465d590bdbbf4a28b1d1dc01198ccb632ba56bc5ec60f0a0ff794a545f614f
MD5 SHA1 SHA512

Submit Download

svchost_CBCACCAACABACBCABACCAABCBABABAAAACCACBABBBCCBACBCCACCBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCAACABACBCABACCAABCBABABAAAACCACBABBBCCBACBCCACCBC.exe
Size 1.7MB
SHA256 8c17839f52f8f4470b471b624e23000c65c2e3fcb7c0edee2c769cb1fba4d6af
MD5 484ff267c8d4834fda49db0f2cf28cb6
SHA1 78812093dae724452d6fe63563f75db73f944a92
SHA512 676a746fc49cdbcd4e88456743b3c6c3caa5421fb7c91469aee9e4eff5e30dc3aee80055f49df2c111fc284c3e66825da4327c3d42b6d8f40368fb1e81276a99
SSDEEP 49152:U+EPiw2jqatglg+EPiw2jqatglVDd79WCs:P+gp7u
TLSH
T17B854B05B7D98532F4B7223149AB83669AB2B8515F36D3CF6384933D4E337D0AA31B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 20e0adb19856df57cdaae9b0c7c6aab9d4133255840994f5b14b9edc3a9e1c0e
MD5 4f6eef7e5e5dc05390dd604eba21dd69
SHA1 a9221c475ff02d6a81518d68a3a762b043cd15e7
SHA512 cf3aaec5f97c41c6adecd528fb30a17329286a47109479e21f6f88b3af644060619332ef00b892daa1a1f877fb502eb9a5627dcff71d763ced306523f35cde0b
TLSH
T1FA112B55A8D5D873ED32B4DBA20A9B8708E877ABE9589A0423054228BFC4D31DE590D6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1604-78-0x0000000000E70000-0x0000000000E91000-memory.dmp

Download

memory/2636-89-0x00000000007F0000-0x0000000000811000-memory.dmp

Download

memory/2908-60-0x00000000051D0000-0x00000000051D1000-memory.dmp

Download

memory/4352-26-0x00000000007F0000-0x0000000000811000-memory.dmp

Download

memory/4352-36-0x00000000007F0000-0x0000000000811000-memory.dmp

Download

memory/4824-7-0x00000000002E0000-0x0000000000301000-memory.dmp

Download

memory/4824-0-0x00000000002E0000-0x0000000000301000-memory.dmp

Download