5acaa9573cb0de4b94a089ce450d91f3168e46bd4d5e5c7e1bd4be7774678cb6

Analysis

max time kernel
148s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 04:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_42a86c9cfe4ca30d3b72d3cec9f5a422_elex_glassworm_stop_vidar.exe
Size 1.1MB
Sample260815-epekrsdg57
SHA256 5acaa9573cb0de4b94a089ce450d91f3168e46bd4d5e5c7e1bd4be7774678cb6
MD5 42a86c9cfe4ca30d3b72d3cec9f5a422
SHA1 f75451ac167c30c442720d81940579aa94f5b630
SHA512 3225ec18aae50676d9f02c18fc733a4fbf43ab78ffe04bcf479431acbf74721cdd003cafe4a22cf1844be11de188032d3029f873a88d87b06bae23afa5c6ab4a
SSDEEP 24576:m9+EM0HdExqatgly9+EM0HdExqatglyafDd70iTWCD:U+E9oqatglg+E9oqatglVDd79WCD
TLSH
T1EA454A41BB858172F473023249BF92B65674BC214F16C6DFB388636D5E32BD0AB32766
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
6044	svchost_CACAAACBCCCAAACCCBCCBCBBABBCCCBCBAABABBBABABABBACACABBC.exe
3600	svchost_ABABCACCBCCCABCCBCACBABCAABBBABCBBACACACBABAACAABCABACC.exe
4216	svchost_CACAAACBCCCAAACCCBCCBCBBABBCCCBCBAABABBBABABABBACACABBC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCAACABACABCBABCACABBACBAAABBABAACBBBABBCABAACCBACCBABBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACAAACBCCCAAACCCBCCBCBBABBCCCBCBAABABBBABABABBACACABBC.exe"	2026-08-15_42a86c9cfe4ca30d3b72d3cec9f5a422_elex_glassworm_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBBCCAAABBBBCBCCBBABABBBCAABCCBAACACABBCBACBABBBAAAACAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABABCACCBCCCABCCBCACBABCAABBBABCBBACACACBABAACAABCABACC.exe"	svchost_CACAAACBCCCAAACCCBCCBCBBABBCCCBCBAABABBBABABABBACACABBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3804	sc.exe
1648	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3132	cmd.exe
2224	cmd.exe
2788	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_42a86c9cfe4ca30d3b72d3cec9f5a422_elex_glassworm_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACAAACBCCCAAACCCBCCBCBBABBCCCBCBAABABBBABABABBACACABBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABABCACCBCCCABCCBCACBABCAABBBABCBBACACACBABAACAABCABACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2864	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5800	2026-08-15_42a86c9cfe4ca30d3b72d3cec9f5a422_elex_glassworm_stop_vidar.exe
5800	2026-08-15_42a86c9cfe4ca30d3b72d3cec9f5a422_elex_glassworm_stop_vidar.exe
5800	2026-08-15_42a86c9cfe4ca30d3b72d3cec9f5a422_elex_glassworm_stop_vidar.exe
5800	2026-08-15_42a86c9cfe4ca30d3b72d3cec9f5a422_elex_glassworm_stop_vidar.exe
6044	svchost_CACAAACBCCCAAACCCBCCBCBBABBCCCBCBAABABBBABABABBACACABBC.exe
6044	svchost_CACAAACBCCCAAACCCBCCBCBBABBCCCBCBAABABBBABABABBACACABBC.exe
6044	svchost_CACAAACBCCCAAACCCBCCBCBBABBCCCBCBAABABBBABABABBACACABBC.exe
6044	svchost_CACAAACBCCCAAACCCBCCBCBBABBCCCBCBAABABBBABABABBACACABBC.exe
3600	svchost_ABABCACCBCCCABCCBCACBABCAABBBABCBBACACACBABAACAABCABACC.exe
3600	svchost_ABABCACCBCCCABCCBCACBABCAABBBABCBBACACACBABAACAABCABACC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5800	2026-08-15_42a86c9cfe4ca30d3b72d3cec9f5a422_elex_glassworm_stop_vidar.exe
Token: SeDebugPrivilege	6044	svchost_CACAAACBCCCAAACCCBCCBCBBABBCCCBCBAABABBBABABABBACACABBC.exe
Token: SeDebugPrivilege	3600	svchost_ABABCACCBCCCABCCBCACBABCAABBBABCBBACACACBABAACAABCABACC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5800 wrote to memory of 3132	5800	2026-08-15_42a86c9cfe4ca30d3b72d3cec9f5a422_elex_glassworm_stop_vidar.exe	92
PID 3132 wrote to memory of 2864	3132	cmd.exe	94
PID 6044 wrote to memory of 2440	6044	svchost_CACAAACBCCCAAACCCBCCBCBBABBCCCBCBAABABBBABABABBACACABBC.exe	95
PID 5800 wrote to memory of 2224	5800	2026-08-15_42a86c9cfe4ca30d3b72d3cec9f5a422_elex_glassworm_stop_vidar.exe	98
PID 2224 wrote to memory of 3804	2224	cmd.exe	100
PID 5800 wrote to memory of 2788	5800	2026-08-15_42a86c9cfe4ca30d3b72d3cec9f5a422_elex_glassworm_stop_vidar.exe	101
PID 2788 wrote to memory of 1648	2788	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-15_42a86c9cfe4ca30d3b72d3cec9f5a422_elex_glassworm_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_42a86c9cfe4ca30d3b72d3cec9f5a422_elex_glassworm_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCCCBCABBCAABCCCCCACCBCBCAACCAACBCACBABBBACAACBCACCCCBBBCCBCACCACAABCCCCBCACABCBCABAABAACBCACABCCABCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAAACBCCCAAACCCBCCBCBBABBCCCBCBAABABBBABABABBACACABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3132
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCCCBCABBCAABCCCCCACCBCBCAACCAACBCACBABBBACAACBCACCCCBBBCCBCACCACAABCCCCBCACABCBCABAABAACBCACABCCABCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAAACBCCCAAACCCBCCBCBBABBCCCBCBAABABBBABABABBACACABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2864
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAABBCCBACCCBACACCABAAACCABCABAACCAABABCCCCCBCCCABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAAACBCCCAAACCCBCCBCBBABBCCCBCBAABABBBABABABBACACABBC.exe" start= auto displayName= "UserDataSvc_CAABBCCBACCCBACACCABAAACCABCABAACCAABABCCCCCBCCCABA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAABBCCBACCCBACACCABAAACCABCABAACCAABABCCCCCBCCCABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAAACBCCCAAACCCBCCBCBBABBCCCBCBAABABBBABABABBACACABBC.exe" start= auto displayName= "UserDataSvc_CAABBCCBACCCBACACCABAAACCABCABAACCAABABCCCCCBCCCABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAABBCCBACCCBACACCABAAACCABCABAACCAABABCCCCCBCCCABA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAABBCCBACCCBACACCABAAACCABCABAACCAABABCCCCCBCCCABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1648

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAAACBCCCAAACCCBCCBCBBABBCCCBCBAABABBBABABABBACACABBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAAACBCCCAAACCCBCCBCBBABBCCCBCBAABABBBABABABBACACABBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6044
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2440

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCACCBCCCABCCBCACBABCAABBBABCBBACACACBABAACAABCABACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCACCBCCCABCCBCACBABCAABBBABCBBACACACBABAACAABCABACC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3600

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAAACBCCCAAACCCBCCBCBBABBCCCBCBAABABBBABABABBACACABBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAAACBCCCAAACCCBCCBCBBABBCCCBCBAABABBBABABABBACACABBC.exe
1⤵
- Executes dropped EXE
PID:4216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 817c78f7b937522936b8e270ff0363f5c426359c892fcf6692c381d252c465df
MD5 de20cd9f41f3b6569216c5ddad74243e
SHA1 74b97532414fcd1e24292abb7e90d093bf8feabd
SHA512 70308aceb62d98d2460be1d710c49b6335eb9c47cc187918353858239747e79addefa5a5d89c98e4b8cf6c651b4488640c8cb55e15dce046ce180955456fc87e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bf71d14f2eb70ff5ad928d1ccf6a396c4745c260e5b66c00c7ae9e47b9eb1a53
MD5 8b152710756f2c4319bb487f09ca23a2
SHA1 21d13530636fdf9408e85d19ad35e17c09201751
SHA512 5922bf556f7b10447d661896cc1da615b90c1dfe852da46d45405ca503fb9bb8ed32743f8a757c147302b00966c9637704da9c10a5cca099d51aaab753936e3d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d79832693c4acbce371b7df367300e56ee75bfc13cd994953d6a53d38ec18b09
MD5 f6732140a2b57e555c667ce464f14215
SHA1 25c9eb5aae2e57af4ce23982e2961662f9ebfd66
SHA512 be6ec404bdc233e583da251d36673825ef81ac7f3f91dba97bddbe6726fe4927b961602826e019d4ce1aa4d5a78d9dd59faeefee4b39998e5c04b45b38cf1376
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 55e0b789493e67553f081c687fa152fc6c92f2f39c2b5443e8888dc90b4b6451
MD5 503610ffdd87b06bf3a03b0769be62ca
SHA1 05d42eddb77fed5c9fa6d3889878d1b6667cb13f
SHA512 d7bcc36c3e4321bf8538f820ad19723e84181bf87fb3f697e4774eb33470146c32fef420e54aed25b447da616e969189b45ea9784050707f6249d329270aadc5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a89357eee9ad395cc03fc8cb268c8cf7e8a84ac31d52eb1522aff88beb27983c
MD5 b4a26e820cc98da8adeda412eecb5f1c
SHA1 9941d0850af0c96322e5348c543d07adc47451cc
SHA512 55852b5d04af3bcc371f545a4de9f361226110a437389195a311b73eddd44f7f70b6a21c7db2572c46ae2d102a26d15b386b5259b037c940dafda6af2aada53d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ed7406d178bc6f6ea5eb46c6f95768cb7f75873937f54d0332c3f1c7d9f43309
MD5 45a171f4c9637816657367d8ef82e5ad
SHA1 8723023e43bed49c38c62ad5a3809249b444f1ae
SHA512 ffffbe7fa50a103e985ffd2707ab73054656aeafdc484a037aae97d6eeb9a2d02715d628cd7858b214c5d6e83f009d5cfacf18dc01dcbb1dcdef2d43fa894866
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 56b57751727e4e340ce0f13626b448179c99823ecf725640d03a4ade59aabc43
MD5 e2699373943f3509ecfe52f1af1d0760
SHA1 141b266ef93d9833fd5d8086952a5b34eecb1622
SHA512 20e13f9dc93d75e0864fd6db3492e582b8559199684362f0ac6d52091ff4da560e7bd7476d2189300ed85cd1588ae85c0d901b26de5be60b844e09291b44e905
MD5 SHA1 SHA512

Submit Download

svchost_CACAAACBCCCAAACCCBCCBCBBABBCCCBCBAABABBBABABABBACACABBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAAACBCCCAAACCCBCCBCBBABBCCCBCBAABABBBABABABBACACABBC.exe
Size 1.1MB
SHA256 5acaa9573cb0de4b94a089ce450d91f3168e46bd4d5e5c7e1bd4be7774678cb6
MD5 42a86c9cfe4ca30d3b72d3cec9f5a422
SHA1 f75451ac167c30c442720d81940579aa94f5b630
SHA512 3225ec18aae50676d9f02c18fc733a4fbf43ab78ffe04bcf479431acbf74721cdd003cafe4a22cf1844be11de188032d3029f873a88d87b06bae23afa5c6ab4a
SSDEEP 24576:m9+EM0HdExqatgly9+EM0HdExqatglyafDd70iTWCD:U+E9oqatglg+E9oqatglVDd79WCD
TLSH
T1EA454A41BB858172F473023249BF92B65674BC214F16C6DFB388636D5E32BD0AB32766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 f3c12a69bf0bb26dfdae593198262d70292c8df16b25cd43b31966a5a83c74a1
MD5 850ef80a1dbe1d29bfcd33cc380f9ea7
SHA1 dcfba9b58861ff6b330c1e42532f532c6b953703
SHA512 30a041eb045411c2479b63d5b87a02c41414516bdb8206db900e1bc18028a6d605a9da4098a82e8eb308d8c7877e1195918f13e12b95c8aca9c618aaaf5d8e66
TLSH
T114112B62F8E5C863F93238CF9919CB5318F43B9F689C7F54520A4618E7A9D32CD550D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3600-74-0x0000000000E40000-0x0000000000E61000-memory.dmp

Download

memory/5800-0-0x00000000000E0000-0x0000000000101000-memory.dmp

Download

memory/5800-8-0x00000000000E0000-0x0000000000101000-memory.dmp

Download

memory/6044-34-0x0000000000670000-0x0000000000691000-memory.dmp

Download