db940fc50557340a733dbc2c86827c642376ba9f7e1706bac7a4a43cf7a47240

Analysis

max time kernel
149s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_8a8ebaa05fe620b83d24b6476033604b_elex_glassworm_stop_vidar.exe
Size 5.5MB
Sample260814-ee7hssfa64
SHA256 db940fc50557340a733dbc2c86827c642376ba9f7e1706bac7a4a43cf7a47240
MD5 8a8ebaa05fe620b83d24b6476033604b
SHA1 45379278334a2875e2802f8e8bf3a3280c45c5d3
SHA512 6fca694980dfd2db5379df7541caf6394f173caeff89fb102644bf719ec1c84f2e08b2141bce419690ab48f8389784b36df4037620c5e753e294aef267e85ad6
SSDEEP 49152:U+ES+E2+ES+ES+E9qatglI+ES+Ek+ES+ES+E2+ES+ES+E9qatglI+ES+Ek+ES+ET:oYYaYYnp78
TLSH
T12E464C05F94380B2D82B01B14CCBD3BF4A70BA258B129EEBF74D876EA9337D06635655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
108	svchost_AACACCBABABBAAABCAACCCBBBAABBBAAABBBBCACABABCBAAACAABCB.exe
4492	svchost_CAABCBBBBAACBCCAAACCBCCCCCACBABACCBAAACBBACCACBABABCACA.exe
2332	svchost_AACACCBABABBAAABCAACCCBBBAABBBAAABBBBCACABABCBAAACAABCB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCCBBCCCBBACACCBBABBACBBCBAAABBCACBABCBBABBCCCABCACCABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACACCBABABBAAABCAACCCBBBAABBBAAABBBBCACABABCBAAACAABCB.exe"	2026-08-14_8a8ebaa05fe620b83d24b6476033604b_elex_glassworm_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CAACBCBACAAAABAAACCACCCAAACCBCAABCCACCABBBAAACBCABAAACAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAABCBBBBAACBCCAAACCBCCCCCACBABACCBAAACBBACCACBABABCACA.exe"	svchost_AACACCBABABBAAABCAACCCBBBAABBBAAABBBBCACABABCBAAACAABCB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4848	sc.exe
4768	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2216	cmd.exe
1872	cmd.exe
5276	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACACCBABABBAAABCAACCCBBBAABBBAAABBBBCACABABCBAAACAABCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAABCBBBBAACBCCAAACCBCCCCCACBABACCBAAACBBACCACBABABCACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_8a8ebaa05fe620b83d24b6476033604b_elex_glassworm_stop_vidar.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5804	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4708	2026-08-14_8a8ebaa05fe620b83d24b6476033604b_elex_glassworm_stop_vidar.exe
4708	2026-08-14_8a8ebaa05fe620b83d24b6476033604b_elex_glassworm_stop_vidar.exe
4708	2026-08-14_8a8ebaa05fe620b83d24b6476033604b_elex_glassworm_stop_vidar.exe
4708	2026-08-14_8a8ebaa05fe620b83d24b6476033604b_elex_glassworm_stop_vidar.exe
108	svchost_AACACCBABABBAAABCAACCCBBBAABBBAAABBBBCACABABCBAAACAABCB.exe
108	svchost_AACACCBABABBAAABCAACCCBBBAABBBAAABBBBCACABABCBAAACAABCB.exe
108	svchost_AACACCBABABBAAABCAACCCBBBAABBBAAABBBBCACABABCBAAACAABCB.exe
108	svchost_AACACCBABABBAAABCAACCCBBBAABBBAAABBBBCACABABCBAAACAABCB.exe
4492	svchost_CAABCBBBBAACBCCAAACCBCCCCCACBABACCBAAACBBACCACBABABCACA.exe
4492	svchost_CAABCBBBBAACBCCAAACCBCCCCCACBABACCBAAACBBACCACBABABCACA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4708	2026-08-14_8a8ebaa05fe620b83d24b6476033604b_elex_glassworm_stop_vidar.exe
Token: SeDebugPrivilege	108	svchost_AACACCBABABBAAABCAACCCBBBAABBBAAABBBBCACABABCBAAACAABCB.exe
Token: SeDebugPrivilege	4492	svchost_CAABCBBBBAACBCCAAACCBCCCCCACBABACCBAAACBBACCACBABABCACA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 2216	4708	2026-08-14_8a8ebaa05fe620b83d24b6476033604b_elex_glassworm_stop_vidar.exe	92
PID 2216 wrote to memory of 5804	2216	cmd.exe	94
PID 108 wrote to memory of 2744	108	svchost_AACACCBABABBAAABCAACCCBBBAABBBAAABBBBCACABABCBAAACAABCB.exe	95
PID 4708 wrote to memory of 1872	4708	2026-08-14_8a8ebaa05fe620b83d24b6476033604b_elex_glassworm_stop_vidar.exe	98
PID 1872 wrote to memory of 4848	1872	cmd.exe	100
PID 4708 wrote to memory of 5276	4708	2026-08-14_8a8ebaa05fe620b83d24b6476033604b_elex_glassworm_stop_vidar.exe	101
PID 5276 wrote to memory of 4768	5276	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-14_8a8ebaa05fe620b83d24b6476033604b_elex_glassworm_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_8a8ebaa05fe620b83d24b6476033604b_elex_glassworm_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAABBCCCCCBCBAACAABCCCCCCBACBBAACBABACBACBABBABBCBBACABCCBBCCBBABCAACACCCABABAABBBBACAABCACAABBBCCCCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACCBABABBAAABCAACCCBBBAABBBAAABBBBCACABABCBAAACAABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAABBCCCCCBCBAACAABCCCCCCBACBBAACBABACBACBABBABBCBBACABCCBBCCBBABCAACACCCABABAABBBBACAABCACAABBBCCCCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACCBABABBAAABCAACCCBBBAABBBAAABBBBCACABABCBAAACAABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCCBACCCACCACAABBBCABAABBCBCABACBAABCACCAACCACCCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACCBABABBAAABCAACCCBBBAABBBAAABBBBCACABABCBAAACAABCB.exe" start= auto displayName= "UserDataSvc_BCCCBACCCACCACAABBBCABAABBCBCABACBAABCACCAACCACCCCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1872
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCCBACCCACCACAABBBCABAABBCBCABACBAABCACCAACCACCCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACCBABABBAAABCAACCCBBBAABBBAAABBBBCACABABCBAAACAABCB.exe" start= auto displayName= "UserDataSvc_BCCCBACCCACCACAABBBCABAABBCBCABACBAABCACCAACCACCCCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4848
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCCBACCCACCACAABBBCABAABBCBCABACBAABCACCAACCACCCCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5276
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCCBACCCACCACAABBBCABAABBCBCABACBAABCACCAACCACCCCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4768

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACCBABABBAAABCAACCCBBBAABBBAAABBBBCACABABCBAAACAABCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACCBABABBAAABCAACCCBBBAABBBAAABBBBCACABABCBAAACAABCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:108
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2744

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCBBBBAACBCCAAACCBCCCCCACBABACCBAAACBBACCACBABABCACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCBBBBAACBCCAAACCBCCCCCACBABACCBAAACBBACCACBABABCACA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4492

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACCBABABBAAABCAACCCBBBAABBBAAABBBBCACABABCBAAACAABCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACCBABABBAAABCAACCCBBBAABBBAAABBBBCACABABCBAAACAABCB.exe
1⤵
- Executes dropped EXE
PID:2332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5b66845bbd7a3997bc18ec7cc7bc7bf30b4735aa381aca15e396a205c5802708
MD5 0c5ef85512e4d3d1198b53a9f6fb745d
SHA1 b082168c1728b27c547ba7a54cb8c97e1b9f21b6
SHA512 046bb705a5a1ec221dd18fafd0a7de67b0b28d2be92833fb8231fd34159ce8ca423d745ac3972ee25e7e6154419c4de7b4a5bc92ac79f622a36de265b0f94f4e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 13b406b049c4a7f4542c11507ea4ad49e9456b93ce15b009cf65a2d18875c34f
MD5 28221e71070be843afb64fbc0c823e4f
SHA1 907201afedc86771528f4fcce4b1749dd2036f8a
SHA512 2167bab813c7a4e404217f231023d62666ed1763c5c70f83d7a7cf2fb974e49a9eb85a8e47773154128c273237149abd99e9461dac96efc156b380a6698f34b6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8a17cfa0016761edde5018c5c19ad119cbf061225303668ae318d9519f7e9833
MD5 9cc696df3a8e3b02f33eb68f00386968
SHA1 44fe79dddd97d4415101fd31da1dbe45332d5eab
SHA512 1ab013361e99ba233d98a0bad83828cecdec0a5ecce886fbb13fcc7fefe89f8af989a7398029a8be8a49fe515c792b1f775823805553b87bac803ac41ea9f0b4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 99e63b23442c69b3f092ce98976f75fd7fff1ca25e3197c93ade8c82789063a6
MD5 530d2384dcaa4e14ecffb07969bbf9c2
SHA1 74b6981aeff88e89e2a059fa0f5d2101805a1409
SHA512 5c43fdf014bd69dff7867d41d435f5f9e9d9a27a8a87a2d727dd351238263a9455697dd12d3300223f4ea4f3ffed04a3fe1e2ba27d54df3f7479dd5ff70022aa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 9f9193763d7f99cb071d0722f597875ee1beb7a8568f2cd60dc110a8244885de
MD5 bdac55ab4d058cf4943b33e66b9937b3
SHA1 1b68cf911396df24de105b64ea1a2daf2d434380
SHA512 c86281a9b346c4daa08d3364173d41f90d5e3aa32426544c8451b90ba2da4c4fdc31b9435b59c233643f7021dbac67f3222de4738ad19dd3e371568961a7d8b5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ede5ed653be9b28f9d70f951a41181c3557bb1387bbf11a4e7b91a7dc2c821db
MD5 e654299041570f72dafc9bb10fa1a9e4
SHA1 57d6975e7a966c53ad1869832fe1287b216077c0
SHA512 222c0cded29dec9a358ee538561f0213467907fe7e6b18c8c6f9fe80276c571e86857dd7adf9775b24184c00ffbcebd24e95f1019c9218ad5a5816acda3f2f69
MD5 SHA1 SHA512

Submit Download

svchost_AACACCBABABBAAABCAACCCBBBAABBBAAABBBBCACABABCBAAACAABCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACCBABABBAAABCAACCCBBBAABBBAAABBBBCACABABCBAAACAABCB.exe
Size 5.5MB
SHA256 db940fc50557340a733dbc2c86827c642376ba9f7e1706bac7a4a43cf7a47240
MD5 8a8ebaa05fe620b83d24b6476033604b
SHA1 45379278334a2875e2802f8e8bf3a3280c45c5d3
SHA512 6fca694980dfd2db5379df7541caf6394f173caeff89fb102644bf719ec1c84f2e08b2141bce419690ab48f8389784b36df4037620c5e753e294aef267e85ad6
SSDEEP 49152:U+ES+E2+ES+ES+E9qatglI+ES+Ek+ES+ES+E2+ES+ES+E9qatglI+ES+Ek+ES+ET:oYYaYYnp78
TLSH
T12E464C05F94380B2D82B01B14CCBD3BF4A70BA258B129EEBF74D876EA9337D06635655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 d92cc93b7d771e03286fbf7dead8f6ae2d8295f09186a1cc3aaacafcd3c2a0af
MD5 666d3f75bcdefff3efbc2b13ecca4cc3
SHA1 380824a90f470b6952fcee2e96adb3ab1e88e2d9
SHA512 dbc12454042567bbe6c1affac88cbcc57cc343cd92bfe9d51cba70480f8fe332b751d39968416d0e4ba4e78c03e19c3591afd22eaf2a4371c4bf8c8ade6cc4e9
TLSH
T1F011E760E4E5D463FD332C8FD91EFF421CF4768F58586A2512894238BBD9C368E194E6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/108-33-0x0000000000D40000-0x0000000000D61000-memory.dmp

Download

memory/108-23-0x0000000000D40000-0x0000000000D61000-memory.dmp

Download

memory/2332-81-0x0000000000D40000-0x0000000000D61000-memory.dmp

Download

memory/4492-79-0x0000000000A00000-0x0000000000A21000-memory.dmp

Download

memory/4708-7-0x00000000008C0000-0x00000000008E1000-memory.dmp

Download

memory/4708-0-0x00000000008C0000-0x00000000008E1000-memory.dmp

Download