2216c527e7a13a1520421251231be2a2becb29c02ee78d30b59e81a1c71ef30a

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 01:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_244a126c43327230fff4b18c27f3d73f_elex_glassworm_stop_vidar.exe
Size 4.9MB
Sample260815-b6fydadc33
SHA256 2216c527e7a13a1520421251231be2a2becb29c02ee78d30b59e81a1c71ef30a
MD5 244a126c43327230fff4b18c27f3d73f
SHA1 2cfb3a495cadc1f6d5fde12a7ac6c2853d8d59b0
SHA512 3568259c5b1e57b5936bdfc67353c6950d067c5f09d7c0a546af0c136ef4b6991af47a81cdf6596b4f100cb17d38a2fa7a33c463545bb6990820f50cd3562037
SSDEEP 98304:DvO4q75Av7fbUhabg7vO4q75Av7fbUhabgBp78:rO4q7+zUhaszO4q7+zUhasH8
TLSH
T1FE363A2CBD9441B2D4728671C8A7A6EEEA3178126B005FCF62D5534E4D3BBD27D30E29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2460	svchost_BAAAAAABCCAACCCCBABCACBBAAAACAABCCBCCCCBCBCACCCACBABACC.exe
696	svchost_ABACBBBABACBAABACBABAAACBCCCBACABCBBBCCCACBABCCACCBACBC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCCBCCCABBBCCAAAABCBACBAACCCBCBCCCCCCCCABABBCBABACCCBACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAAAAAABCCAACCCCBABCACBBAAAACAABCCBCCCCBCBCACCCACBABACC.exe"	2026-08-15_244a126c43327230fff4b18c27f3d73f_elex_glassworm_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBABACBCBBACBCBBBBAACAAACABBBABBCCACAABBBAABCCACCBACBACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABACBBBABACBAABACBABAAACBCCCBACABCBBBCCCACBABCCACCBACBC.exe"	svchost_BAAAAAABCCAACCCCBABCACBBAAAACAABCCBCCCCBCBCACCCACBABACC.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1424	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_244a126c43327230fff4b18c27f3d73f_elex_glassworm_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAAAAAABCCAACCCCBABCACBBAAAACAABCCBCCCCBCBCACCCACBABACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABACBBBABACBAABACBABAAACBCCCBACABCBBBCCCACBABCCACCBACBC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3004	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2556	2026-08-15_244a126c43327230fff4b18c27f3d73f_elex_glassworm_stop_vidar.exe
2556	2026-08-15_244a126c43327230fff4b18c27f3d73f_elex_glassworm_stop_vidar.exe
2556	2026-08-15_244a126c43327230fff4b18c27f3d73f_elex_glassworm_stop_vidar.exe
2556	2026-08-15_244a126c43327230fff4b18c27f3d73f_elex_glassworm_stop_vidar.exe
2460	svchost_BAAAAAABCCAACCCCBABCACBBAAAACAABCCBCCCCBCBCACCCACBABACC.exe
2460	svchost_BAAAAAABCCAACCCCBABCACBBAAAACAABCCBCCCCBCBCACCCACBABACC.exe
2460	svchost_BAAAAAABCCAACCCCBABCACBBAAAACAABCCBCCCCBCBCACCCACBABACC.exe
2460	svchost_BAAAAAABCCAACCCCBABCACBBAAAACAABCCBCCCCBCBCACCCACBABACC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2556	2026-08-15_244a126c43327230fff4b18c27f3d73f_elex_glassworm_stop_vidar.exe
Token: SeDebugPrivilege	2460	svchost_BAAAAAABCCAACCCCBABCACBBAAAACAABCCBCCCCBCBCACCCACBABACC.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 1424	2556	2026-08-15_244a126c43327230fff4b18c27f3d73f_elex_glassworm_stop_vidar.exe	92
PID 1424 wrote to memory of 3004	1424	cmd.exe	94
PID 2460 wrote to memory of 3972	2460	svchost_BAAAAAABCCAACCCCBABCACBBAAAACAABCCBCCCCBCBCACCCACBABACC.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-08-15_244a126c43327230fff4b18c27f3d73f_elex_glassworm_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_244a126c43327230fff4b18c27f3d73f_elex_glassworm_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBBACBCABCBCABAABACBABBBBCAAABBAACBCCABCCCBACABACBCBCACABCACBBCABABCAAABAABABBBAACAAAAAACBBCBBBACBABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAAAABCCAACCCCBABCACBBAAAACAABCCBCCCCBCBCACCCACBABACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1424
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBBACBCABCBCABAABACBABBBBCAAABBAACBCCABCCCBACABACBCBCACABCACBBCABABCAAABAABABBBAACAAAAAACBBCBBBACBABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAAAABCCAACCCCBABCACBBAAAACAABCCBCCCCBCBCACCCACBABACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3004

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAAAABCCAACCCCBABCACBBAAAACAABCCBCCCCBCBCACCCACBABACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAAAABCCAACCCCBABCACBBAAAACAABCCBCCCCBCBCACCCACBABACC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3972

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBBBABACBAABACBABAAACBCCCBACABCBBBCCCACBABCCACCBACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBBBABACBAABACBABAAACBCCCBACABCBBBCCCACBABCCACCBACBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7b1fc6ad7c3f3019fe19f48da647b03a83463f02ff4df47026ef5302c4b58117
MD5 26d5198c777182d049b7e3ea09afb668
SHA1 950ad9aa392f9517128f20a64db0f288fe07da71
SHA512 0bd2455c2bc333beeb8c8148a05e8c8d9069369d993e49f33a2c947799775ea6a743a7af800fe621c86a2c4ec84b2d1f01be397aac77861c03d81c414888866e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 33959bf5d01d46889c854c854475fb903bffe67edd4eb91332f5cda60f60a2e9
MD5 07426a08ef286867764037c2b224a8bf
SHA1 c7296993f43b132e2fb9219f4ed7427381cee441
SHA512 7563d24cd3ed45a32b158564a2eac6cb839ee2be2cef864c5c10d54b488ccaa9fc8fbd90df060bcb826aba0631ab3af19329881d4196fea019a9434a939c325f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8128d288e02af8983ab584ee3600f3f1ceabd618b47c123570d84a9622f9be26
MD5 bf173dcaae55c97a473144c48a8a77eb
SHA1 0a0581c6e2d8bfdd91f67b6d39055b92dda7d511
SHA512 a32caa201d51e7489569a916e48b353af745b4a624d7ec808e41d7ac88f34fdd1eb2f953dc6b4ae4490950279c5edd0c92dc71f250a1238daacbf2084feacd33
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 837f1c65262a1257265e5561aa8534974795f76841f7fca68fae682321391cc4
MD5 fd409b39085a0629640bc7fa8e078d54
SHA1 34e38e55181fc7ba714f3c9c3292301daa3ea538
SHA512 9cd9a195c2f4b6b2386c1f46d462b1ad54a6ec78d708d06a276122876608a948a13101a6cd6f732cbc1954b275557c3d79fe0f8ffef08986c81b75c1d6c4baa3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f15b2f964977e81411f6f2ff2bbaedf2c2f280c850ac4fa1c5dec25645884769
MD5 5ba535634399a968333979080efb2e1b
SHA1 a2417a12a0c94c7f1c6485cfede57600edabf0c7
SHA512 f744db4bd0337e9947d1759f64ea73c1b46b9c87eea2901997c843c9806b30f6114a74fa2eee02c20a02f2348eb13d345a6d0332c7595c0fa8c13ed5178f9399
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 5219ad0c70113856680f6700f44b105f8f57e246f871d7f7d7f8e0ea8a2e6448
MD5 9d4496afe6998a69a16abbc5ebad68eb
SHA1 e7de14ec44bb5087e8742db99e1bf6d1592cc10c
SHA512 8af3db3eb1101dfdf989c741bb877a178803ccd9cc95ff8b562dc3a9ed82d1cd4706b1876b42a76f3f0403da262dc4485ced39ebc57011e4909ef74412b5fb71
MD5 SHA1 SHA512

Submit Download

svchost_BAAAAAABCCAACCCCBABCACBBAAAACAABCCBCCCCBCBCACCCACBABACC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAAAABCCAACCCCBABCACBBAAAACAABCCBCCCCBCBCACCCACBABACC.exe
Size 4.9MB
SHA256 2216c527e7a13a1520421251231be2a2becb29c02ee78d30b59e81a1c71ef30a
MD5 244a126c43327230fff4b18c27f3d73f
SHA1 2cfb3a495cadc1f6d5fde12a7ac6c2853d8d59b0
SHA512 3568259c5b1e57b5936bdfc67353c6950d067c5f09d7c0a546af0c136ef4b6991af47a81cdf6596b4f100cb17d38a2fa7a33c463545bb6990820f50cd3562037
SSDEEP 98304:DvO4q75Av7fbUhabg7vO4q75Av7fbUhabgBp78:rO4q7+zUhaszO4q7+zUhasH8
TLSH
T1FE363A2CBD9441B2D4728671C8A7A6EEEA3178126B005FCF62D5534E4D3BBD27D30E29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2460-35-0x0000000000060000-0x0000000000081000-memory.dmp

Download

memory/2556-0-0x0000000000FC0000-0x0000000000FE1000-memory.dmp

Download

memory/2556-8-0x0000000000FC0000-0x0000000000FE1000-memory.dmp

Download