9e76c939ab39348f38eb46e85074b216e555f4c23bccb7ac3c9e4dc36168735f

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 04:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_68ca2d1704e42f948e9d0c787ce2977a_amadey_elex_glassworm_remcos_stop_vidar.exe
Size 3.1MB
Sample260814-etm3psvbkh
SHA256 9e76c939ab39348f38eb46e85074b216e555f4c23bccb7ac3c9e4dc36168735f
MD5 68ca2d1704e42f948e9d0c787ce2977a
SHA1 9b9c709eed22d0b0e9bac4c5bf4f6f271d8e5e93
SHA512 c9534f87fbe40dab16d335494a30a324b64895bf79e931a0ac47d0249f016d9cb1354acc00feff5a4cdb49bbf2f001d32d03915d334f38b65d646e43555b3dd5
SSDEEP 49152:U+EmLZ5zoTqatgla+ES+EmLZ5zoTqatgleL+EmLZ5zoTqatgla+ES+EmLZ5zoTqd:BLZ1o3LLZ1o3YLZ1o3LLZ1o38p7J
TLSH
T146E57E02F542C073F6560132495F97767B78BA200F569ACBB3C8A66E7E337C1A732259
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1436	svchost_BBCBCCBABCCCAAAACBACACABBCBBBABBBBBBAACBAACBCCABACCCAAA.exe
4660	svchost_CBACBAABACCCACABBCBCBBCACBACAABBCCCCCCCBCBCCACBBBCABCAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CBACCACBCBCACCABBCCAACBBAAAAAACBABBBBCABCBBAACBABAABCCAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCBCCBABCCCAAAACBACACABBCBBBABBBBBBAACBAACBCCABACCCAAA.exe"	2026-08-14_68ca2d1704e42f948e9d0c787ce2977a_amadey_elex_glassworm_remcos_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BACACBCCBCCCABBCCBAABCCBCBBBBBCAABACABBABBCCABCBBBCAABAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBACBAABACCCACABBCBCBBCACBACAABBCCCCCCCBCBCCACBBBCABCAB.exe"	svchost_BBCBCCBABCCCAAAACBACACABBCBBBABBBBBBAACBAACBCCABACCCAAA.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4904	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_68ca2d1704e42f948e9d0c787ce2977a_amadey_elex_glassworm_remcos_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCBCCBABCCCAAAACBACACABBCBBBABBBBBBAACBAACBCCABACCCAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBACBAABACCCACABBCBCBBCACBACAABBCCCCCCCBCBCCACBBBCABCAB.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2156	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
464	2026-08-14_68ca2d1704e42f948e9d0c787ce2977a_amadey_elex_glassworm_remcos_stop_vidar.exe
464	2026-08-14_68ca2d1704e42f948e9d0c787ce2977a_amadey_elex_glassworm_remcos_stop_vidar.exe
464	2026-08-14_68ca2d1704e42f948e9d0c787ce2977a_amadey_elex_glassworm_remcos_stop_vidar.exe
464	2026-08-14_68ca2d1704e42f948e9d0c787ce2977a_amadey_elex_glassworm_remcos_stop_vidar.exe
1436	svchost_BBCBCCBABCCCAAAACBACACABBCBBBABBBBBBAACBAACBCCABACCCAAA.exe
1436	svchost_BBCBCCBABCCCAAAACBACACABBCBBBABBBBBBAACBAACBCCABACCCAAA.exe
1436	svchost_BBCBCCBABCCCAAAACBACACABBCBBBABBBBBBAACBAACBCCABACCCAAA.exe
1436	svchost_BBCBCCBABCCCAAAACBACACABBCBBBABBBBBBAACBAACBCCABACCCAAA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	464	2026-08-14_68ca2d1704e42f948e9d0c787ce2977a_amadey_elex_glassworm_remcos_stop_vidar.exe
Token: SeDebugPrivilege	1436	svchost_BBCBCCBABCCCAAAACBACACABBCBBBABBBBBBAACBAACBCCABACCCAAA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1248	OpenWith.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 464 wrote to memory of 4904	464	2026-08-14_68ca2d1704e42f948e9d0c787ce2977a_amadey_elex_glassworm_remcos_stop_vidar.exe	89
PID 4904 wrote to memory of 2156	4904	cmd.exe	91
PID 1436 wrote to memory of 3520	1436	svchost_BBCBCCBABCCCAAAACBACACABBCBBBABBBBBBAACBAACBCCABACCCAAA.exe	98
PID 3520 wrote to memory of 412	3520	notepad.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-08-14_68ca2d1704e42f948e9d0c787ce2977a_amadey_elex_glassworm_remcos_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_68ca2d1704e42f948e9d0c787ce2977a_amadey_elex_glassworm_remcos_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:464
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABAAACCBBAACCBCBAAAACBCBAAACAAAABACCACBBBACBBCCBAABBCACBBBCBCBBBBACABABCCBAAABABABBBCBABCABAAACCCCCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCCBABCCCAAAACBACACABBCBBBABBBBBBAACBAACBCCABACCCAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4904
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABAAACCBBAACCBCBAAAACBCBAAACAAAABACCACBBBACBBCCBAABBCACBBBCBCBBBBACABABCCBAAABABABBBCBABCABAAACCCCCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCCBABCCCAAAACBACACABBCBBBABBBBBBAACBAACBCCABACCCAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2156

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCCBABCCCAAAACBACACABBCBBBABBBBBBAACBAACBCCABACCCAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCCBABCCCAAAACBACACABBCBBBABBBBBBAACBAACBCCABACCCAAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3520
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:412

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1248

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBAABACCCACABBCBCBBCACBACAABBCCCCCCCBCBCCACBBBCABCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBAABACCCACABBCBCBBCACBACAABBCCCCCCCBCBCCACBBBCABCAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ded5ab285d5db9156ce6ac9a0f94d16a3a95dbd8c8cc58141b0f66f6148a4f68
MD5 cd72b010e6a6780d9fd0cb93028cc215
SHA1 5ab12036b1bbfd39224a4e4a97aacc722bb43945
SHA512 79b7e976d8ad65d8379496146456ca13b9a2bff504a5b18ea3da0d383d6c5d4ab08fe236155861dd4b2e8a7bd3cec7d335ff4d8780cee54252ae662bf40c1be6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6f041a5b33a728d30fac2d7792aa4fb0d8e0023f45a5cf069c18cd35f633031d
MD5 bfc84efe0e11b9108a7870dda01fd3b7
SHA1 df0d81e6b6efe7186440613d7eefd418d90d2741
SHA512 22a619b11d43b512ea0e061085f6facacdfb427f9269f476efb0c007bbe2c52239941e7abe3f36e3459087e472a0b3b5c0f6f6d4fcd6292ee81d10839f689f7f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d6cad78960649ffc6955b4b9562a3dc2e9a0a372e0150172fc0fc1171a49a8ed
MD5 4c59d9c9e48d0bc77381af0dcb201977
SHA1 f4e42d2947a2195aecb34c9806051527c2046382
SHA512 87b7bdf9dbf90a9fe650d7c604a771dd9d2542009341282df56b1cddc787352bad223e5d7c9994cf5b323b68765735baa424e7c7a10c4c53e52198595850801b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 487a9ada30ac1b015149514a6bcb0063d295b709697a1c2a3faa0ff78666bf8d
MD5 a7d3d6bbf86a1682aa8802fe36b5536a
SHA1 803e69ab805f57f8ec65406fed2a3639c83a5834
SHA512 ba76e8b35bda65fecb7a1398eed3cf7a6b67129de198d5de6b874166afc4e37387f9ab38868ba53702a63b4b51b6074db2f89182b2e351f14433ca838f4e516d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6cfad10dcf5b16a8c8d34708ac8023a4c8b4c31f05ba027c80c2d2780c4ef0cd
MD5 58719c183a8fdf14b59f4b1d0ecd32bc
SHA1 f4f70df5c58e41f0bad23d427236242b47d3d586
SHA512 ee779ea0f60618eaf4feddcb1f04299e98a66b7876398f088b6e10a553f574f3e6866e454ad91b38a8c3fcd47a11339aace02cc6410d3a5bab314be75bb5fcab
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 952a391e64411674bdac3989718f5f9b4c89785e6f5ae73b6cff99e51acc4d2e
MD5 6583cc81061fb91d0824801efc3d1047
SHA1 087cbd9a0c6548e046f6af0c363f4001a1741333
SHA512 f89d3b375089c52d559b53a7be723eea16a581489d9ba8fa64999d9f62c7f91097f1128d82b88130d42bd91234e45b8228872a2f0e5a34a49e5e8ac80595369c
MD5 SHA1 SHA512

Submit Download

svchost_BBCBCCBABCCCAAAACBACACABBCBBBABBBBBBAACBAACBCCABACCCAAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCCBABCCCAAAACBACACABBCBBBABBBBBBAACBAACBCCABACCCAAA.exe
Size 3.1MB
SHA256 9e76c939ab39348f38eb46e85074b216e555f4c23bccb7ac3c9e4dc36168735f
MD5 68ca2d1704e42f948e9d0c787ce2977a
SHA1 9b9c709eed22d0b0e9bac4c5bf4f6f271d8e5e93
SHA512 c9534f87fbe40dab16d335494a30a324b64895bf79e931a0ac47d0249f016d9cb1354acc00feff5a4cdb49bbf2f001d32d03915d334f38b65d646e43555b3dd5
SSDEEP 49152:U+EmLZ5zoTqatgla+ES+EmLZ5zoTqatgleL+EmLZ5zoTqatgla+ES+EmLZ5zoTqd:BLZ1o3LLZ1o3YLZ1o3LLZ1o38p7J
TLSH
T146E57E02F542C073F6560132495F97767B78BA200F569ACBB3C8A66E7E337C1A732259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/464-0-0x0000000000FE0000-0x0000000001001000-memory.dmp

Download

memory/464-8-0x0000000000FE0000-0x0000000001001000-memory.dmp

Download

memory/1436-38-0x0000000000810000-0x0000000000831000-memory.dmp

Download

memory/3520-61-0x0000000000F70000-0x0000000000F71000-memory.dmp

Download

memory/4660-73-0x0000000000270000-0x0000000000291000-memory.dmp

Download