34d93e031fbb50e893d44df91e11b0c2920e607245f5ca81a5b0303ad0910622

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/08/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_4ed70d6ba5ece049a2aa113dd3d542ee_elex_glassworm_stop_vidar.exe
Size 1.4MB
Sample260815-ejn71syclf
SHA256 34d93e031fbb50e893d44df91e11b0c2920e607245f5ca81a5b0303ad0910622
MD5 4ed70d6ba5ece049a2aa113dd3d542ee
SHA1 70c1a3e2ce2597d56c29f355b405203fbf6d6085
SHA512 670d5feb10cc78fde7f43abcaeebd8bae34882128d50157cdac0420ce7409680dd595955ab9805784936474e74cf686d9c3878d94cd0181626cbb622edc81b03
SSDEEP 24576:m9+EM0q9+EM0q9+EM0bExqatglz9+EM0q9+EM0q9+EM0bExqatglFafDd70iTWCD:U+ES+ES+Ekqatglp+ES+ES+Ekqatglez
TLSH
T191657C05FA828032E96701B14DEFD3BB4574BD218F118ADFF788972E5932BD0A23575A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4596	svchost_CACBBBCBCCACACCACCBBBCBCAABCCABCCACCBBCACACBCCCAAACABBA.exe
4960	svchost_ABACBCBCACBAABCCBAACBABCCCBACBBBBBAACBBBCBACCCBCCCABABC.exe
1048	svchost_CACBBBCBCCACACCACCBBBCBCAABCCABCCACCBBCACACBCCCAAACABBA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BBAAAABBBBBCCCBCABBBBCAACACCCACCBBCABACCBBCCBACCCBBCCBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACBBBCBCCACACCACCBBBCBCAABCCABCCACCBBCACACBCCCAAACABBA.exe"	2026-08-15_4ed70d6ba5ece049a2aa113dd3d542ee_elex_glassworm_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_ACBAABACBACCCACCCCABCAABACCBCACAAACBCCCBCBBCCABBAAABCCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABACBCBCACBAABCCBAACBABCCCBACBBBBBAACBBBCBACCCBCCCABABC.exe"	svchost_CACBBBCBCCACACCACCBBBCBCAABCCABCCACCBBCACACBCCCAAACABBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3100	sc.exe
2184	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2104	cmd.exe
832	cmd.exe
2448	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_4ed70d6ba5ece049a2aa113dd3d542ee_elex_glassworm_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABACBCBCACBAABCCBAACBABCCCBACBBBBBAACBBBCBACCCBCCCABABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACBBBCBCCACACCACCBBBCBCAABCCABCCACCBBCACACBCCCAAACABBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2576	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1180	2026-08-15_4ed70d6ba5ece049a2aa113dd3d542ee_elex_glassworm_stop_vidar.exe
1180	2026-08-15_4ed70d6ba5ece049a2aa113dd3d542ee_elex_glassworm_stop_vidar.exe
1180	2026-08-15_4ed70d6ba5ece049a2aa113dd3d542ee_elex_glassworm_stop_vidar.exe
1180	2026-08-15_4ed70d6ba5ece049a2aa113dd3d542ee_elex_glassworm_stop_vidar.exe
4596	svchost_CACBBBCBCCACACCACCBBBCBCAABCCABCCACCBBCACACBCCCAAACABBA.exe
4596	svchost_CACBBBCBCCACACCACCBBBCBCAABCCABCCACCBBCACACBCCCAAACABBA.exe
4596	svchost_CACBBBCBCCACACCACCBBBCBCAABCCABCCACCBBCACACBCCCAAACABBA.exe
4596	svchost_CACBBBCBCCACACCACCBBBCBCAABCCABCCACCBBCACACBCCCAAACABBA.exe
4960	svchost_ABACBCBCACBAABCCBAACBABCCCBACBBBBBAACBBBCBACCCBCCCABABC.exe
4960	svchost_ABACBCBCACBAABCCBAACBABCCCBACBBBBBAACBBBCBACCCBCCCABABC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1180	2026-08-15_4ed70d6ba5ece049a2aa113dd3d542ee_elex_glassworm_stop_vidar.exe
Token: SeDebugPrivilege	4596	svchost_CACBBBCBCCACACCACCBBBCBCAABCCABCCACCBBCACACBCCCAAACABBA.exe
Token: SeDebugPrivilege	4960	svchost_ABACBCBCACBAABCCBAACBABCCCBACBBBBBAACBBBCBACCCBCCCABABC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2776	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 832	1180	2026-08-15_4ed70d6ba5ece049a2aa113dd3d542ee_elex_glassworm_stop_vidar.exe	98
PID 832 wrote to memory of 2576	832	cmd.exe	100
PID 4596 wrote to memory of 2140	4596	svchost_CACBBBCBCCACACCACCBBBCBCAABCCABCCACCBBCACACBCCCAAACABBA.exe	102
PID 2140 wrote to memory of 3644	2140	notepad.exe	103
PID 1180 wrote to memory of 2448	1180	2026-08-15_4ed70d6ba5ece049a2aa113dd3d542ee_elex_glassworm_stop_vidar.exe	107
PID 2448 wrote to memory of 3100	2448	cmd.exe	109
PID 1180 wrote to memory of 2104	1180	2026-08-15_4ed70d6ba5ece049a2aa113dd3d542ee_elex_glassworm_stop_vidar.exe	110
PID 2104 wrote to memory of 2184	2104	cmd.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-08-15_4ed70d6ba5ece049a2aa113dd3d542ee_elex_glassworm_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_4ed70d6ba5ece049a2aa113dd3d542ee_elex_glassworm_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABCCCBABCACCBBBAACACAABCCCCCCBBACAACABCCAABCCACBBBBCACAACBBBBABACAAAAABBCAACBCBACABACABCACCCBACACACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBCBCCACACCACCBBBCBCAABCCABCCACCBBCACACBCCCAAACABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:832
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABCCCBABCACCBBBAACACAABCCCCCCBBACAACABCCAABCCACBBBBCACAACBBBBABACAAAAABBCAACBCBACABACABCACCCBACACACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBCBCCACACCACCBBBCBCAABCCABCCACCBBCACACBCCCAAACABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2576
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCAABCABBACCACBACABBCAAACABABCCCBCBBCBCAAAAAACBBBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBCBCCACACCACCBBBCBCAABCCABCCACCBBCACACBCCCAAACABBA.exe" start= auto displayName= "UserDataSvc_BCAABCABBACCACBACABBCAAACABABCCCBCBBCBCAAAAAACBBBBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCAABCABBACCACBACABBCAAACABABCCCBCBBCBCAAAAAACBBBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBCBCCACACCACCBBBCBCAABCCABCCACCBBCACACBCCCAAACABBA.exe" start= auto displayName= "UserDataSvc_BCAABCABBACCACBACABBCAAACABABCCCBCBBCBCAAAAAACBBBBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3100
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCAABCABBACCACBACABBCAAACABABCCCBCBBCBCAAAAAACBBBBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2104
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCAABCABBACCACBACABBCAAACABABCCCBCBBCBCAAAAAACBBBBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2184

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBCBCCACACCACCBBBCBCAABCCABCCACCBBCACACBCCCAAACABBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBCBCCACACCACCBBBCBCAABCCABCCACCBBCACACBCCCAAACABBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2140
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3644

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2776

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBCBCACBAABCCBAACBABCCCBACBBBBBAACBBBCBACCCBCCCABABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBCBCACBAABCCBAACBABCCCBACBBBBBAACBBBCBACCCBCCCABABC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4960

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBCBCCACACCACCBBBCBCAABCCABCCACCBBCACACBCCCAAACABBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBCBCCACACCACCBBBCBCAABCCABCCACCBBCACACBCCCAAACABBA.exe
1⤵
- Executes dropped EXE
PID:1048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f186b44ebdad949717123c7dfcce09bd9fc04d29223f84d79b7601f91145c955
MD5 6b56232619146dd365391e0027d4eb02
SHA1 e42345682db2dc19d0d4ff937bb351e75d052a15
SHA512 7737abc666ea27ac0d40d64ec08368c13ca22597bf99841154f4fe8a912a85631778b7e20acbb1899c9aa84da33e6cb003942c122167925458120f765680192b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4ffb3106bd8827f8150badc1d7c5f59a5101afbad8fc1453b6ae4e06e64547a8
MD5 9f336feb464249fc4ccd36911b82ece6
SHA1 3edc274ca32e1fc4535a99c4f52091c8e5220ae5
SHA512 4704271390c67dd6f7d357965a2c8c92a79f912db86d187c40adf25c5c3be5694170eb1d22567fcada7cdbae4464c7b7903b10ba220b7abb63a099067fa77152
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 eaf1d3287139eec28c53c760e2e688653dd59a85898ebba4dc252f29f7b51b5d
MD5 11038a919798b7793271943847d44c55
SHA1 1cf6eb4bc6caed579838f56dcc564a1f82bb68b4
SHA512 337188fa531f22bf3ddffb9d52ee6021b9eb8cbdcb607b764cdb49bd509a84fc3000961a6e58a40f820091dfe5a477161145a45c63d82368781a0e01d1bfa4e9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ef3dcee5bea8be72229e42a28c789cfff5f727b4ae27aa78a2d10805213b9e77
MD5 73e7d29cfe44dc8609a639fbef66ce2c
SHA1 91ffaa15794e39a7d33961f251cea129fe7c8532
SHA512 d77382c562ce2e1e1893d3c4b238b1cc32510494b62726621b00dcab7c9ab7a3415f0a49112c346b334d4ba07f046e630141800414aa28e0f5d1e6ae833ed321
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 27e57590bf9cf55f347a878bc7de08638d4e55366f5be09310754635504da53d
MD5 b3e05815780465eb64e36edfe7ba668c
SHA1 9283a6dd7baad369119e035fb9c42e2b1f7080ff
SHA512 a7c0e9532bfb73d7c44b361d4b786a2d4d618ab82a7d5ff6532db623baac187eb22de1319039f85ba61f5f71f056ec64307621c987bb31ea31bf203d32eeee0d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a3519991a3c37c08468410bac43f0fa7fdd504a083413e706ee980b0af354277
MD5 023bb64b766be7807f6d82d44086ab67
SHA1 186f0713b42604bd028197d5074ebfd32700d044
SHA512 89c3e0767b62d8d9160e550ccefaae1b4ea5da61a893fdcfb9b2b8a3adca521f905aaa4b48799b9edcb809bc6bb2b40ee7e838602ec2961f86d5c57c976e6c38
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e61857325dd39e4efa8fcc539fd68eef0cefbcc5b1bee9338c445d5f9f8d1831
MD5 9f496e57cdaaeae5374ae6b5f8b87261
SHA1 55ec79809b247e4b699446b5e4a4c9bd2d084936
SHA512 2004415e48ed60e1193dbca3517079a5ee1369a1834b80eb4d42bfd27b073205d064e9eae02639f7313879351f5ab078d88a4635867f61d12e89dd8606ca86e6
MD5 SHA1 SHA512

Submit Download

svchost_CACBBBCBCCACACCACCBBBCBCAABCCABCCACCBBCACACBCCCAAACABBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBCBCCACACCACCBBBCBCAABCCABCCACCBBCACACBCCCAAACABBA.exe
Size 1.4MB
SHA256 34d93e031fbb50e893d44df91e11b0c2920e607245f5ca81a5b0303ad0910622
MD5 4ed70d6ba5ece049a2aa113dd3d542ee
SHA1 70c1a3e2ce2597d56c29f355b405203fbf6d6085
SHA512 670d5feb10cc78fde7f43abcaeebd8bae34882128d50157cdac0420ce7409680dd595955ab9805784936474e74cf686d9c3878d94cd0181626cbb622edc81b03
SSDEEP 24576:m9+EM0q9+EM0q9+EM0bExqatglz9+EM0q9+EM0q9+EM0bExqatglFafDd70iTWCD:U+ES+ES+Ekqatglp+ES+ES+Ekqatglez
TLSH
T191657C05FA828032E96701B14DEFD3BB4574BD218F118ADFF788972E5932BD0A23575A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 d1d26e15d0ea79f64b70f5f81f3a4ab3d8744a9794f5c3f8b6d47f92e7878fc1
MD5 1b2b8e526ac0470827594b4add5f784c
SHA1 ea6db68bd0103d90b5954617577d276d25c19bdf
SHA512 80a5bc0dfe30f5007dc9e848e4ab9c2e3a727d4febbb0d41766f0072d2e4ec50485c8e9295ef026ea1e0a362de8c02bcfda4e8e96ff07eca4ddbdcec3b07c43d
TLSH
T1FA11B261E8E5D863F83268CF1A2D9B9308F57B9B685C6E1423098118F769D368E154E3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1048-92-0x0000000000750000-0x0000000000771000-memory.dmp

Download

memory/1180-0-0x0000000000510000-0x0000000000531000-memory.dmp

Download

memory/1180-7-0x0000000000510000-0x0000000000531000-memory.dmp

Download

memory/2140-59-0x0000000005640000-0x0000000005641000-memory.dmp

Download

memory/4596-36-0x0000000000750000-0x0000000000771000-memory.dmp

Download

memory/4960-72-0x0000000000370000-0x0000000000391000-memory.dmp

Download

memory/4960-90-0x0000000000370000-0x0000000000391000-memory.dmp

Download