2ff7af29094b28ffb93e6777c492f33420a5574f7c974b66439fd7ccfa83b984

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_60ed7e061584ecdb9a6b094fca13e90f_amadey_elex_glassworm_remcos_stop_vidar.exe
Size 5.0MB
Sample260816-e3m43azzdx
SHA256 2ff7af29094b28ffb93e6777c492f33420a5574f7c974b66439fd7ccfa83b984
MD5 60ed7e061584ecdb9a6b094fca13e90f
SHA1 09555376d0dd543822f3d3c2f86103d494cfff2b
SHA512 85ce4592c8d3213532e74892fa2a5e3fa86699749a427e9faf36ead081daca0bfea4a2ff9d2027efb6cb59710ebb0e1684d603df4699707572c0108ef3ac3d8d
SSDEEP 98304:8LZ1o3LLZ1o3LLZ1o3DLZ1o3LLZ1o3LLZ1o3ap7R:8LZWLZWLZELZWLZWLZnR
TLSH
T18D367E01F9828073F5621132495B93766B74B9200F66DADFA3C8973E6E337C1AB32756
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3716	svchost_CBBBACACACACCBCABCBBABCAACBBBBBACACBABBBABBBABBCABAAACB.exe
2684	svchost_CBBBACACACACCBCABCBBABCAACBBBBBACACBABBBABBBABBCABAAACB.exe
4812	svchost_AACCCCABAABBBACBBAABAAACCCABBABCBAAABBCACCABBCBCBBCCBBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CCCBCBCCCBCACCBCBABBCBBACAABAAABBABACAACABACAACACACACCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACCCCABAABBBACBBAABAAACCCABBABCBAAABBCACCABBCBCBBCCBBB.exe"	svchost_CBBBACACACACCBCABCBBABCAACBBBBBACACBABBBABBBABBCABAAACB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABACAABBABCCBAAAAAABABCBAAABAABCBABCBBBCACBBCABABCACABBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBBACACACACCBCABCBBABCAACBBBBBACACBABBBABBBABBCABAAACB.exe"	2026-08-16_60ed7e061584ecdb9a6b094fca13e90f_amadey_elex_glassworm_remcos_stop_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2960	sc.exe
4148	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1916	cmd.exe
344	cmd.exe
376	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_60ed7e061584ecdb9a6b094fca13e90f_amadey_elex_glassworm_remcos_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACCCCABAABBBACBBAABAAACCCABBABCBAAABBCACCABBCBCBBCCBBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBBACACACACCBCABCBBABCAACBBBBBACACBABBBABBBABBCABAAACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4624	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5016	2026-08-16_60ed7e061584ecdb9a6b094fca13e90f_amadey_elex_glassworm_remcos_stop_vidar.exe
5016	2026-08-16_60ed7e061584ecdb9a6b094fca13e90f_amadey_elex_glassworm_remcos_stop_vidar.exe
5016	2026-08-16_60ed7e061584ecdb9a6b094fca13e90f_amadey_elex_glassworm_remcos_stop_vidar.exe
5016	2026-08-16_60ed7e061584ecdb9a6b094fca13e90f_amadey_elex_glassworm_remcos_stop_vidar.exe
3716	svchost_CBBBACACACACCBCABCBBABCAACBBBBBACACBABBBABBBABBCABAAACB.exe
3716	svchost_CBBBACACACACCBCABCBBABCAACBBBBBACACBABBBABBBABBCABAAACB.exe
3716	svchost_CBBBACACACACCBCABCBBABCAACBBBBBACACBABBBABBBABBCABAAACB.exe
3716	svchost_CBBBACACACACCBCABCBBABCAACBBBBBACACBABBBABBBABBCABAAACB.exe
4812	svchost_AACCCCABAABBBACBBAABAAACCCABBABCBAAABBCACCABBCBCBBCCBBB.exe
4812	svchost_AACCCCABAABBBACBBAABAAACCCABBABCBAAABBCACCABBCBCBBCCBBB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5016	2026-08-16_60ed7e061584ecdb9a6b094fca13e90f_amadey_elex_glassworm_remcos_stop_vidar.exe
Token: SeDebugPrivilege	3716	svchost_CBBBACACACACCBCABCBBABCAACBBBBBACACBABBBABBBABBCABAAACB.exe
Token: SeDebugPrivilege	4812	svchost_AACCCCABAABBBACBBAABAAACCCABBABCBAAABBCACCABBCBCBBCCBBB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4100	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 376	5016	2026-08-16_60ed7e061584ecdb9a6b094fca13e90f_amadey_elex_glassworm_remcos_stop_vidar.exe	106
PID 376 wrote to memory of 4624	376	cmd.exe	108
PID 3716 wrote to memory of 3564	3716	svchost_CBBBACACACACCBCABCBBABCAACBBBBBACACBABBBABBBABBCABAAACB.exe	115
PID 3564 wrote to memory of 3648	3564	notepad.exe	116
PID 5016 wrote to memory of 1916	5016	2026-08-16_60ed7e061584ecdb9a6b094fca13e90f_amadey_elex_glassworm_remcos_stop_vidar.exe	118
PID 1916 wrote to memory of 2960	1916	cmd.exe	120
PID 5016 wrote to memory of 344	5016	2026-08-16_60ed7e061584ecdb9a6b094fca13e90f_amadey_elex_glassworm_remcos_stop_vidar.exe	121
PID 344 wrote to memory of 4148	344	cmd.exe	123

C:\Users\Admin\AppData\Local\Temp\2026-08-16_60ed7e061584ecdb9a6b094fca13e90f_amadey_elex_glassworm_remcos_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_60ed7e061584ecdb9a6b094fca13e90f_amadey_elex_glassworm_remcos_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCACCBCBBACCACCACAABCACABCAABBBAAAACABBBCAACCCCBCBCABCAABAAABABBCCCCCACCABCBBBBAACBBAACBCCBCAACABCACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBACACACACCBCABCBBABCAACBBBBBACACBABBBABBBABBCABAAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:376
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCACCBCBBACCACCACAABCACABCAABBBAAAACABBBCAACCCCBCBCABCAABAAABABBCCCCCACCABCBBBBAACBBAACBCCBCAACABCACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBACACACACCBCABCBBABCAACBBBBBACACBABBBABBBABBCABAAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBAABCAAAABBCBCAABBCCCBABCABAAABABBCACCAACABACBCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBACACACACCBCABCBBABCAACBBBBBACACBABBBABBBABBCABAAACB.exe" start= auto displayName= "UserDataSvc_BBBAABCAAAABBCBCAABBCCCBABCABAAABABBCACCAACABACBCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1916
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBBAABCAAAABBCBCAABBCCCBABCABAAABABBCACCAACABACBCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBACACACACCBCABCBBABCAACBBBBBACACBABBBABBBABBCABAAACB.exe" start= auto displayName= "UserDataSvc_BBBAABCAAAABBCBCAABBCCCBABCABAAABABBCACCAACABACBCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2960
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBAABCAAAABBCBCAABBCCCBABCABAAABABBCACCAACABACBCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:344
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBBAABCAAAABBCBCAABBCCCBABCABAAABABBCACCAACABACBCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4148

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBACACACACCBCABCBBABCAACBBBBBACACBABBBABBBABBCABAAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBACACACACCBCABCBBABCAACBBBBBACACBABBBABBBABBCABAAACB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3564
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3648

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4100

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBACACACACCBCABCBBABCAACBBBBBACACBABBBABBBABBCABAAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBACACACACCBCABCBBABCAACBBBBBACACBABBBABBBABBCABAAACB.exe
1⤵
- Executes dropped EXE
PID:2684

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCCABAABBBACBBAABAAACCCABBABCBAAABBCACCABBCBCBBCCBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCCABAABBBACBBAABAAACCCABBABCBAAABBCACCABBCBCBBCCBBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fdee263e3747502e8953e5c46e6db33b0f11258898cf0912bb9a7ea724eadd12
MD5 387972dd97ecdcf978214315eeb4dd1c
SHA1 a9a20570e90bb91f631e469d5a615a0051876dd6
SHA512 94fd9e5221f739b3d9c64735c78c324567722ae8c50d12859740ce0320778a2d6820d256699b0a2c81855c39fb59530fef3fdd578c21797f6666a89a797cfb37
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d6fac56207aa4d70f2ada6e3ace60627657ff1cef3fb8e1f22ba6ae320690d2b
MD5 0d92f91555dfa0d9f61a77a7491f32cb
SHA1 823a9772c34b4e6457a1457c66f7ba398732accc
SHA512 e5a38ab67cc27d1d68506d535cf9fad800c5aaaf1c3c157ad88b9cf3f78a2c25a1839a1564750b17ad149c7e3259b03c2868924faf22a39ed0556208d50b3934
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c2a8f2d2bdb04594eb3dbf1d2b8e399103390e2189de43bd77de08f4ed45eafc
MD5 7878a9aba2f0fd5273be3d7372403513
SHA1 c8502abb747181a2bab70f50df755f03d86a837a
SHA512 89799e45c7f8461dc1312aa07e1619445bdddbcd5547afcd7bb0882ede521e0daf3541249b4c9fb8d18875b524a28194a9ae4aaa208b305bdfc73c70dcb6c15b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0fa5b5ad840ed96c39444a800acefbf265448cd42777bb02e083504c6833815d
MD5 39614457aefdac4ac82a5874ca7ed5f5
SHA1 8d28fa3f3ff0a006071bcd6a50b585ac060baca1
SHA512 bac65ad3f83b0a7fafb018e574dc2e634cc885bada3b860ec3097410bd95dae8608337476f2cb2913393fe1bd17bc5e917f5d52b4a14b3bfe6c3b96ad86f437c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a7e1f3d93c3f3a43800400c7c200d8f4e34c3c9f750bdfea59b0c8037eb4d456
MD5 861426af2501f1472add027033dce5cb
SHA1 335f14f8fc763f701f99b47f05fec7fdd03742f2
SHA512 623210b645e3d3c9f5f1e985ff866c58e5f2b530d8bc4998701ae81a5134fc29a1cc2f3d47121b5f8450e760c0366eb1da5090f7e1e1b3be7850e2c41d4a704c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 98040ac38300cac05e8edc142916bc7cd3a0564ed40994c077e6ddaf5fed9e2a
MD5 4e13dac7d8a5159b7a7f64e7fed447af
SHA1 26cf6fd5a942ff5bfdc5b8b6ba65d532325a9136
SHA512 1c4ececc6ae93d2227f4737e469ed917faf58fbf1fadd04c4d0e1c915a76de8b1fefb632fbad2fad2bc959622155861492fd5c200cc65778234795020f45afe9
MD5 SHA1 SHA512

Submit Download

svchost_CBBBACACACACCBCABCBBABCAACBBBBBACACBABBBABBBABBCABAAACB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBACACACACCBCABCBBABCAACBBBBBACACBABBBABBBABBCABAAACB.exe
Size 5.0MB
SHA256 2ff7af29094b28ffb93e6777c492f33420a5574f7c974b66439fd7ccfa83b984
MD5 60ed7e061584ecdb9a6b094fca13e90f
SHA1 09555376d0dd543822f3d3c2f86103d494cfff2b
SHA512 85ce4592c8d3213532e74892fa2a5e3fa86699749a427e9faf36ead081daca0bfea4a2ff9d2027efb6cb59710ebb0e1684d603df4699707572c0108ef3ac3d8d
SSDEEP 98304:8LZ1o3LLZ1o3LLZ1o3DLZ1o3LLZ1o3LLZ1o3ap7R:8LZWLZWLZELZWLZWLZnR
TLSH
T18D367E01F9828073F5621132495B93766B74B9200F66DADFA3C8973E6E337C1AB32756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 bcc475fda27ef12ae996d4751edc67df41a5b851e1a5a0c32a6b43988f12275d
MD5 7183feaaee6876d2e620969ce3ecab5c
SHA1 d836dbbcef15b5eadd92c813801108d6a83051fb
SHA512 e59d10134328152340040f94dfe5dc7f0a7b32ac7c7186bf9a1c09b3cfa07571eb0420597345428634afb314b3f24d8ca5525c72254f17a5a243e53c119122be
TLSH
T184119161D8E5DC57EB3368CA932EEFC20CE5779BA85CAA5423090218F7C9D358D510B2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2684-75-0x0000000000200000-0x0000000000221000-memory.dmp

Download

memory/3564-60-0x0000000005460000-0x0000000005461000-memory.dmp

Download

memory/3716-26-0x0000000000200000-0x0000000000221000-memory.dmp

Download

memory/3716-39-0x0000000000200000-0x0000000000221000-memory.dmp

Download

memory/4812-89-0x0000000000F80000-0x0000000000FA1000-memory.dmp

Download

memory/5016-0-0x0000000000A80000-0x0000000000AA1000-memory.dmp

Download

memory/5016-7-0x0000000000A80000-0x0000000000AA1000-memory.dmp

Download