bbec847286b383a20d1e1fc71b45137751eceeec5cc470811bd58ecdb73af7ad

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_4f71ddc048829b9e7042917baa29442f_elex_glassworm_stop_vidar.exe
Size 1.6MB
Sample260815-ejhp8syclb
SHA256 bbec847286b383a20d1e1fc71b45137751eceeec5cc470811bd58ecdb73af7ad
MD5 4f71ddc048829b9e7042917baa29442f
SHA1 51ccfc0955e4a470be3b8142a0ab5990f4af5cf9
SHA512 ff985f8750598173fee04c97c9de49183cf18b30fada0b2fb28fff508a4629aa607fe7073dd6b1dad399a7cfddc7759a5b1dedd2f7d5f5cdc56db73102f2af2b
SSDEEP 49152:U+E9oqatglJ+E9U+E9oqatglJ+E95Dd79WCe:1AWp7I
TLSH
T175754A41FBC58072F477023149AB82BA5A74BD214F16D6DFB348936E5E33BD0AA31726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5252	svchost_ACABCBAACAAABCBCCACBBCCBABBCBBCBACCBCCCBCACABACCCCABBAB.exe
5488	svchost_CBCCAACACABCBBCBCABCBCABBACBBBCCBCBBCABCCCACBCBBBBCACCB.exe
3924	svchost_ACABCBAACAAABCBCCACBBCCBABBCBBCBACCBCCCBCACABACCCCABBAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BABBABBBBCABBACBBAABABBACBBACCABAABBCBACBABABABBAACACAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACABCBAACAAABCBCCACBBCCBABBCBBCBACCBCCCBCACABACCCCABBAB.exe"	2026-08-15_4f71ddc048829b9e7042917baa29442f_elex_glassworm_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCCCBCAACBACACBBACACABBABBABBCCBCACAACCBCBBCCCBCAACAACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCCAACACABCBBCBCABCBCABBACBBBCCBCBBCABCCCACBCBBBBCACCB.exe"	svchost_ACABCBAACAAABCBCCACBBCCBABBCBBCBACCBCCCBCACABACCCCABBAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5424	sc.exe
5532	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4808	cmd.exe
5680	cmd.exe
4148	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_4f71ddc048829b9e7042917baa29442f_elex_glassworm_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACABCBAACAAABCBCCACBBCCBABBCBBCBACCBCCCBCACABACCCCABBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCCAACACABCBBCBCABCBCABBACBBBCCBCBBCABCCCACBCBBBBCACCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6100	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5572	2026-08-15_4f71ddc048829b9e7042917baa29442f_elex_glassworm_stop_vidar.exe
5572	2026-08-15_4f71ddc048829b9e7042917baa29442f_elex_glassworm_stop_vidar.exe
5572	2026-08-15_4f71ddc048829b9e7042917baa29442f_elex_glassworm_stop_vidar.exe
5572	2026-08-15_4f71ddc048829b9e7042917baa29442f_elex_glassworm_stop_vidar.exe
5252	svchost_ACABCBAACAAABCBCCACBBCCBABBCBBCBACCBCCCBCACABACCCCABBAB.exe
5252	svchost_ACABCBAACAAABCBCCACBBCCBABBCBBCBACCBCCCBCACABACCCCABBAB.exe
5252	svchost_ACABCBAACAAABCBCCACBBCCBABBCBBCBACCBCCCBCACABACCCCABBAB.exe
5252	svchost_ACABCBAACAAABCBCCACBBCCBABBCBBCBACCBCCCBCACABACCCCABBAB.exe
5488	svchost_CBCCAACACABCBBCBCABCBCABBACBBBCCBCBBCABCCCACBCBBBBCACCB.exe
5488	svchost_CBCCAACACABCBBCBCABCBCABBACBBBCCBCBBCABCCCACBCBBBBCACCB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5572	2026-08-15_4f71ddc048829b9e7042917baa29442f_elex_glassworm_stop_vidar.exe
Token: SeDebugPrivilege	5252	svchost_ACABCBAACAAABCBCCACBBCCBABBCBBCBACCBCCCBCACABACCCCABBAB.exe
Token: SeDebugPrivilege	5488	svchost_CBCCAACACABCBBCBCABCBCABBACBBBCCBCBBCABCCCACBCBBBBCACCB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5572 wrote to memory of 4808	5572	2026-08-15_4f71ddc048829b9e7042917baa29442f_elex_glassworm_stop_vidar.exe	92
PID 4808 wrote to memory of 6100	4808	cmd.exe	94
PID 5252 wrote to memory of 2084	5252	svchost_ACABCBAACAAABCBCCACBBCCBABBCBBCBACCBCCCBCACABACCCCABBAB.exe	95
PID 5572 wrote to memory of 5680	5572	2026-08-15_4f71ddc048829b9e7042917baa29442f_elex_glassworm_stop_vidar.exe	98
PID 5680 wrote to memory of 5532	5680	cmd.exe	100
PID 5572 wrote to memory of 4148	5572	2026-08-15_4f71ddc048829b9e7042917baa29442f_elex_glassworm_stop_vidar.exe	101
PID 4148 wrote to memory of 5424	4148	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-15_4f71ddc048829b9e7042917baa29442f_elex_glassworm_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_4f71ddc048829b9e7042917baa29442f_elex_glassworm_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5572
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBBACACABCABAACABACACACAACCABBBCACABAACCBCBCBCAACAAACAABBCBBBCBBBBCACCCACACBBBABBBACACBBBAABCAACCABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCBAACAAABCBCCACBBCCBABBCBBCBACCBCCCBCACABACCCCABBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4808
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBBACACABCABAACABACACACAACCABBBCACABAACCBCBCBCAACAAACAABBCBBBCBBBBCACCCACACBBBABBBACACBBBAABCAACCABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCBAACAAABCBCCACBBCCBABBCBBCBACCBCCCBCACABACCCCABBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6100
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBCBCBAABCCCACBACABBBBAABBBCCBBABCBBCBBACCCBACBCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCBAACAAABCBCCACBBCCBABBCBBCBACCBCCCBCACABACCCCABBAB.exe" start= auto displayName= "UserDataSvc_ABBCBCBAABCCCACBACABBBBAABBBCCBBABCBBCBBACCCBACBCBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5680
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBCBCBAABCCCACBACABBBBAABBBCCBBABCBBCBBACCCBACBCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCBAACAAABCBCCACBBCCBABBCBBCBACCBCCCBCACABACCCCABBAB.exe" start= auto displayName= "UserDataSvc_ABBCBCBAABCCCACBACABBBBAABBBCCBBABCBBCBBACCCBACBCBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5532
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBCBCBAABCCCACBACABBBBAABBBCCBBABCBBCBBACCCBACBCBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4148
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBCBCBAABCCCACBACABBBBAABBBCCBBABCBBCBBACCCBACBCBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5424

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCBAACAAABCBCCACBBCCBABBCBBCBACCBCCCBCACABACCCCABBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCBAACAAABCBCCACBBCCBABBCBBCBACCBCCCBCACABACCCCABBAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5252
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2084

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCAACACABCBBCBCABCBCABBACBBBCCBCBBCABCCCACBCBBBBCACCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCAACACABCBBCBCABCBCABBACBBBCCBCBBCABCCCACBCBBBBCACCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5488

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCBAACAAABCBCCACBBCCBABBCBBCBACCBCCCBCACABACCCCABBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCBAACAAABCBCCACBBCCBABBCBBCBACCBCCCBCACABACCCCABBAB.exe
1⤵
- Executes dropped EXE
PID:3924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8b0a417f3df43f6345675c30ece1035e7d6c68ce5d2e5058395e890f89cf65f1
MD5 485ae5f69f9443319e3bdd97daee33f1
SHA1 58b85f351cd9b744dca8b06018eb2b816e6545ce
SHA512 5d1f706ab6d9668e4f68fdb11d219bf93dca7d5f4138be2f6cf2efd4a1ec07374ca3454083bcd3d615da3ec00229032764225743990927e9adc0df12ed19d2c2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3a885bfe37c2fb40a1cb501358d893366ac2d34c4f58496657a4ee54faf1ebb8
MD5 e99e1ca6679359ee82e281ba56b4cbe1
SHA1 9f4022d06690619c07d6a7e15cbfd51ef70909fa
SHA512 1ea24c7f1dc51b9d7f9f36eef0ec0f5daf3134d6eb3c5e422c9186a05bbaf1405b55e8a202dfba043bc982170921395fda2b9a90eb70b01b442ad60610f0fb27
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 19c51a8ab80aa883a2b4335fc0cd2621161593acce1d1e93ea2d2ac48c745156
MD5 6ccfce75341fe0407cbc24891bec50c7
SHA1 55e3eb59376489eb76983ffa5bf6cae3682a1358
SHA512 eb436165bb5368b382697b31f56e061746e0b379debdec57ba64c33312583e62853019d0743a206341462698baeeaf863e25dad19d0f094d4ba6720849b7a7be
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 25e08881c281438b344f6208a955b1311c4a69d16106be50f2e4ed48c7804aea
MD5 c87faa3d2cd2bf4a7b4275d9159b650f
SHA1 c0f26152bc538411305b67380524fa5ec06cbdfa
SHA512 5a279f426961849fca5a84b5ccb80d5273ed5f00b807b4697f74a137683915d89f84dc0907561876bb2ae35c8757c1e13499cf2d69c3fb7f79b7720cc692e7d2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 74e830d989a8469675f6b96c8a4131e0bb10cc38b15a6bb1f0c1f69bf47e1ab4
MD5 c3ba541dc62417408583538599d3a947
SHA1 6038d0c68bf48ef5957baad516fab1fcaa003bc7
SHA512 9a53be94a80eea24878a5449192f35e31a68383b48f6793052d07982fdeeae6981171ee25ee611d1564616dcc4777695ef01c4cf704f59edeccff2ba94368d59
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 962560249e423d63e1d9d61d1b79eaaa839421b4301420221c64b7a8555141b0
MD5 dff87befd534d12b9c0d9bae296c61cb
SHA1 d5c055fc632dbbab5de1272d72f48d6592b597ff
SHA512 326966083a6e8d94c34825e5de53e673d3d27eb8b51e5292b04a6340c97c4ec79129e337ec2017cdca86d53821d37a7f110d13fb397dd26a6ca9aef134965302
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 5c7befa45a885b546b4f617b489fa500d588b87b7b9956d8d658a858104aa384
MD5 4fa6e31a1bbdae5bc4cbc75e6336d692
SHA1 58851daf75f71051d44dea08e4f005a6344672c3
SHA512 0513a5f4331a0b8ce1574c6f11dc1a02fb16819418ea2d274b94bb9d47fed284eb833f6e0bbc68977b16297b4ef8f95fbc49857275c09c1795d117e5764cacd1
MD5 SHA1 SHA512

Submit Download

svchost_ACABCBAACAAABCBCCACBBCCBABBCBBCBACCBCCCBCACABACCCCABBAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCBAACAAABCBCCACBBCCBABBCBBCBACCBCCCBCACABACCCCABBAB.exe
Size 1.6MB
SHA256 bbec847286b383a20d1e1fc71b45137751eceeec5cc470811bd58ecdb73af7ad
MD5 4f71ddc048829b9e7042917baa29442f
SHA1 51ccfc0955e4a470be3b8142a0ab5990f4af5cf9
SHA512 ff985f8750598173fee04c97c9de49183cf18b30fada0b2fb28fff508a4629aa607fe7073dd6b1dad399a7cfddc7759a5b1dedd2f7d5f5cdc56db73102f2af2b
SSDEEP 49152:U+E9oqatglJ+E9U+E9oqatglJ+E95Dd79WCe:1AWp7I
TLSH
T175754A41FBC58072F477023149AB82BA5A74BD214F16D6DFB348936E5E33BD0AA31726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 ac9ebb2a5d05c271c7533cbdedf73aadb356703d4a08b936cbc2221e700b1c5c
MD5 73f40ba5008b741c6bad8d818c606550
SHA1 34e928613361533cf72e38e07c0ec47840363301
SHA512 1a46a0b66ff2393d4e61076583e7b876f1215b877f28d859ce9f8f0280cea996e1d28c96206e388c5d709148feec2f6f38e2d417ca57ea036d4769e8700f2dec
TLSH
T17D110441B8F59C57F833A4CA161DDBD308F87B8B9C986F58234C4118F741D368D550D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5252-34-0x0000000000250000-0x0000000000271000-memory.dmp

Download

memory/5488-74-0x0000000000ED0000-0x0000000000EF1000-memory.dmp

Download

memory/5572-0-0x0000000000140000-0x0000000000161000-memory.dmp

Download

memory/5572-8-0x0000000000140000-0x0000000000161000-memory.dmp

Download