0d48e005e94c94f24a6acd653d11a4712b626a920035fa917155bd44c00e54a9

Analysis

max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 03:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_4dc93e9bafb1904d51f045b4a916febf_elex_glassworm_stop_vidar.exe
Size 7.5MB
Sample260815-ej6r3aycmc
SHA256 0d48e005e94c94f24a6acd653d11a4712b626a920035fa917155bd44c00e54a9
MD5 4dc93e9bafb1904d51f045b4a916febf
SHA1 4966b5f0a57c086b125c4a5afcb9ed5141365f30
SHA512 ad191da79f3e5ae77a5e0f7317021740a983910cbf823674850bc9eed9c9392990a619a4d472d676fb95211864b5f393c8954c9dc2e4640479f383b80d629759
SSDEEP 49152:U+ES+E2+ES+ES+ES+ES+ES+ES+E2+ES+ES+ES+ES+ES+ES+ETqatglu+ES+ES+En:FCCCep79
TLSH
T156863A09F94340B2D92B11B14CCBD3BF8A60BA2587128EEBF74DC75F6933BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
700	svchost_CCBBCCACABBAAACCAABCCAAAABABCACCBBABBBCBBAACCABABABACCA.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCCCCBBCCABAABBBBBABCACCBACCBBAACBAAAAAAACAACBCABACACCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBBCCACABBAAACCAABCCAAAABABCACCBBABBBCBBAACCABABABACCA.exe"	2026-08-15_4dc93e9bafb1904d51f045b4a916febf_elex_glassworm_stop_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1848	sc.exe
4732	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4624	cmd.exe
2032	cmd.exe
4688	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_4dc93e9bafb1904d51f045b4a916febf_elex_glassworm_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBBCCACABBAAACCAABCCAAAABABCACCBBABBBCBBAACCABABABACCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2276	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3880	2026-08-15_4dc93e9bafb1904d51f045b4a916febf_elex_glassworm_stop_vidar.exe
3880	2026-08-15_4dc93e9bafb1904d51f045b4a916febf_elex_glassworm_stop_vidar.exe
3880	2026-08-15_4dc93e9bafb1904d51f045b4a916febf_elex_glassworm_stop_vidar.exe
3880	2026-08-15_4dc93e9bafb1904d51f045b4a916febf_elex_glassworm_stop_vidar.exe
700	svchost_CCBBCCACABBAAACCAABCCAAAABABCACCBBABBBCBBAACCABABABACCA.exe
700	svchost_CCBBCCACABBAAACCAABCCAAAABABCACCBBABBBCBBAACCABABABACCA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3880	2026-08-15_4dc93e9bafb1904d51f045b4a916febf_elex_glassworm_stop_vidar.exe
Token: SeDebugPrivilege	700	svchost_CCBBCCACABBAAACCAABCCAAAABABCACCBBABBBCBBAACCABABABACCA.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3880 wrote to memory of 4624	3880	2026-08-15_4dc93e9bafb1904d51f045b4a916febf_elex_glassworm_stop_vidar.exe	92
PID 4624 wrote to memory of 2276	4624	cmd.exe	94
PID 3880 wrote to memory of 2032	3880	2026-08-15_4dc93e9bafb1904d51f045b4a916febf_elex_glassworm_stop_vidar.exe	95
PID 2032 wrote to memory of 1848	2032	cmd.exe	97
PID 3880 wrote to memory of 4688	3880	2026-08-15_4dc93e9bafb1904d51f045b4a916febf_elex_glassworm_stop_vidar.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-08-15_4dc93e9bafb1904d51f045b4a916febf_elex_glassworm_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_4dc93e9bafb1904d51f045b4a916febf_elex_glassworm_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3880
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABACCBBCABAACBCACBAABBCCCABCCCCBAACABAACCBBBCBCABCACBACBAAABACCBBBBBBAACAACCAAACBBBCCBBBBBCCABABCAABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCCACABBAAACCAABCCAAAABABCACCBBABBBCBBAACCABABABACCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4624
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABACCBBCABAACBCACBAABBCCCABCCCCBAACABAACCBBBCBCABCACBACBAAABACCBBBBBBAACAACCAAACBBBCCBBBBBCCABABCAABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCCACABBAAACCAABCCAAAABABCACCBBABBBCBBAACCABABABACCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2276
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCABABBBBCCAACAAACACBBCAACACAABCCCABCBAABBBCAABBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCCACABBAAACCAABCCAAAABABCACCBBABBBCBBAACCABABABACCA.exe" start= auto displayName= "UserDataSvc_BCCABABBBBCCAACAAACACBBCAACACAABCCCABCBAABBBCAABBBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCABABBBBCCAACAAACACBBCAACACAABCCCABCBAABBBCAABBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCCACABBAAACCAABCCAAAABABCACCBBABBBCBBAACCABABABACCA.exe" start= auto displayName= "UserDataSvc_BCCABABBBBCCAACAAACACBBCAACACAABCCCABCBAABBBCAABBBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1848
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCABABBBBCCAACAAACACBBCAACACAABCCCABCBAABBBCAABBBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4688
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCABABBBBCCAACAAACACBBCAACACAABCCCABCBAABBBCAABBBC"
    3⤵
    - Launches sc.exe
    PID:4732

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCCACABBAAACCAABCCAAAABABCACCBBABBBCBBAACCABABABACCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCCACABBAAACCAABCCAAAABABCACCBBABBBCBBAACCABABABACCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:700

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCCACABBAAACCAABCCAAAABABCACCBBABBBCBBAACCABABABACCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCCACABBAAACCAABCCAAAABABCACCBBABBBCBBAACCABABABACCA.exe
1⤵
PID:1088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c35f68dba41bf08ac6a5e0320b7ab531a829bb2e3c4e4366789f89a6ad697fc5
MD5 842ab719e9b4db3b7b87ad4e94518ee7
SHA1 f4b45807c1f7798076769fa6f715f411f80e47bb
SHA512 75dd36c83682a1ba3af99112719de60ce2595122264bb8b5232a9dc64ab2415252dc6564578ad437fcd05fcef82c2f0133319a243e6c64d538aabd32b44d6733
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 77362f016c803dc85ac8cf5eba4b2e8bd97749b637c264ce4870a5eba0f985ea
MD5 12751683b07c6f25c8e1e5865c513691
SHA1 d819352410da9408701f28d79978f3e75c483ef1
SHA512 759f343e5a77df04429c2abe920c27d5cc39743ce29f012f2ff2494b68ba7ba9722998ee2545aceb11aaaa33fe49580d787c084b777540448304e4bd2bbda6e8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e4db2aff0d5c25e661b345fe04c560e861bb9bd7b320547eb39ff3697529c536
MD5 b04f6edc210bd08b7e32b59db1dd8ca4
SHA1 96ab41c3ad2d5e8b62cef90bb3d269b86c9f27a7
SHA512 77a9d5ec5e869b3968bdcb883f5586234cfc71d9929c4d71a061b001b4a15a3efe79b17a542589bf66bcdae512f849072359c9b97d6db4880bbd1dd5fce56a0e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 768d625cd68116f98cb27bb4c3550a7647e6f26a4b6e7c31700d7705a868fc5f
MD5 806d321861ccf1603d108f2154774886
SHA1 23d85634243e8f4e25a12d9eb2a93419961314b0
SHA512 7cb86e0073924daecd25963a292cc786f4a523a414f193e8d6774f1746f88ed04c644a02612b6d0e294bd12a0df11b1ce19e742d2c1dab242199555696b8b276
MD5 SHA1 SHA512

Submit Download

svchost_CCBBCCACABBAAACCAABCCAAAABABCACCBBABBBCBBAACCABABABACCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCCACABBAAACCAABCCAAAABABCACCBBABBBCBBAACCABABABACCA.exe
Size 7.5MB
SHA256 0d48e005e94c94f24a6acd653d11a4712b626a920035fa917155bd44c00e54a9
MD5 4dc93e9bafb1904d51f045b4a916febf
SHA1 4966b5f0a57c086b125c4a5afcb9ed5141365f30
SHA512 ad191da79f3e5ae77a5e0f7317021740a983910cbf823674850bc9eed9c9392990a619a4d472d676fb95211864b5f393c8954c9dc2e4640479f383b80d629759
SSDEEP 49152:U+ES+E2+ES+ES+ES+ES+ES+ES+E2+ES+ES+ES+ES+ES+ES+ETqatglu+ES+ES+En:FCCCep79
TLSH
T156863A09F94340B2D92B11B14CCBD3BF8A60BA2587128EEBF74DC75F6933BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_CCBBCCACABBAAACCAABCCAAAABABCACCBBABBBCBBAACCABABABACCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCCACABBAAACCAABCCAAAABABCACCBBABBBCBBAACCABABABACCA.exe
Size 2.6MB
SHA256 2ea1a785ea3f74dd7293ac8d8f26ebccf49500fd58adecbb1ba897200ea481d7
MD5 2bdfeb18679e0d994763510f60367c22
SHA1 180a04e4e606183570468e378450bbb7f19206b1
SHA512 d7c656afdb6325989c9964c874ffb61fe443a298f0771ed8cc315f5ae6d953d02013a6229de39337d8e4d04387ee5b76f3941598870846cbd35de471390e2352
SSDEEP 49152:U+ES+E2+ES+ES+ES+ES+ES+ES+E2+ES+ES+ES+ES+ES+ES+ETqatglu+ES+ES+EP:F
TLSH
T11DC52A09F94344B1D92B51B04CCBD3BF8A60BB2587128EF7FB4ECB5B6933BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/700-25-0x0000000000330000-0x0000000000351000-memory.dmp

Download

memory/700-38-0x0000000000330000-0x0000000000351000-memory.dmp

Download

memory/3880-0-0x0000000000B50000-0x0000000000B71000-memory.dmp

Download

memory/3880-8-0x0000000000B50000-0x0000000000B71000-memory.dmp

Download