2d226e15de0da2a57124c2d0ed601a63e9c22fd34c90bb21724d626e0174c71f

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 09:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_5ef4166f3371ea99077d89b7b294b815_elex_glassworm_hawkeye_remcos_vidar_wannacry.exe
Size 9.9MB
Sample260905-ler7fa1fkc
SHA256 2d226e15de0da2a57124c2d0ed601a63e9c22fd34c90bb21724d626e0174c71f
MD5 5ef4166f3371ea99077d89b7b294b815
SHA1 04414a03cd29f3786c2999be5921f086f3d022be
SHA512 d88d7ee6dce7c41143c326643fd3fed7ffae591e5ede93d537bf7a3bdbf116399167539f8ce0a022c7e2f0254152780255528234be4c4f24187d392bb203a7c3
SSDEEP 49152:U+ES+EzD+Es+ES+EKqatglS+Es+ES+EzD+Es+ES+EN+Es+ES+Es+ES+EzD+Es+Ec:GMMMMM87p
TLSH
T15FB62B05F98740B1E82B01B04CDBD3BF8A70BA258B128EEBF74D875FA933B919534655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3404	svchost_AACCAACBBCCAACCCCAABABCACABABCCCAABCBBBABCCBCBBBBABABCC.exe
1264	svchost_AACCAACBBCCAACCCCAABABCACABABCCCAABCBBBABCCBCBBBBABABCC.exe
4568	svchost_BCCCBCAAACAABBBBBBCCCCABBABACBCCABCCCBAAABCBCBBABACACAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCCACBACABBACBCAACCCCAAABBACCCCBBABACACACBBCBBCBCCCCBCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCCBCAAACAABBBBBBCCCCABBABACBCCABCCCBAAABCBCBBABACACAC.exe"	svchost_AACCAACBBCCAACCCCAABABCACABABCCCAABCBBBABCCBCBBBBABABCC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CACACBAAAAACBCACACCCCABCBBCBACBACCAACCBCCBAACCABCCAABBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACCAACBBCCAACCCCAABABCACABABCCCAABCBBBABCCBCBBBBABABCC.exe"	2026-09-04_5ef4166f3371ea99077d89b7b294b815_elex_glassworm_hawkeye_remcos_vidar_wannacry.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4984	sc.exe
2212	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
972	cmd.exe
2564	cmd.exe
4132	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_5ef4166f3371ea99077d89b7b294b815_elex_glassworm_hawkeye_remcos_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACCAACBBCCAACCCCAABABCACABABCCCAABCBBBABCCBCBBBBABABCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCCBCAAACAABBBBBBCCCCABBABACBCCABCCCBAAABCBCBBABACACAC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
524	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
6052	2026-09-04_5ef4166f3371ea99077d89b7b294b815_elex_glassworm_hawkeye_remcos_vidar_wannacry.exe
6052	2026-09-04_5ef4166f3371ea99077d89b7b294b815_elex_glassworm_hawkeye_remcos_vidar_wannacry.exe
6052	2026-09-04_5ef4166f3371ea99077d89b7b294b815_elex_glassworm_hawkeye_remcos_vidar_wannacry.exe
6052	2026-09-04_5ef4166f3371ea99077d89b7b294b815_elex_glassworm_hawkeye_remcos_vidar_wannacry.exe
3404	svchost_AACCAACBBCCAACCCCAABABCACABABCCCAABCBBBABCCBCBBBBABABCC.exe
3404	svchost_AACCAACBBCCAACCCCAABABCACABABCCCAABCBBBABCCBCBBBBABABCC.exe
3404	svchost_AACCAACBBCCAACCCCAABABCACABABCCCAABCBBBABCCBCBBBBABABCC.exe
3404	svchost_AACCAACBBCCAACCCCAABABCACABABCCCAABCBBBABCCBCBBBBABABCC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	6052	2026-09-04_5ef4166f3371ea99077d89b7b294b815_elex_glassworm_hawkeye_remcos_vidar_wannacry.exe
Token: SeDebugPrivilege	3404	svchost_AACCAACBBCCAACCCCAABABCACABABCCCAABCBBBABCCBCBBBBABABCC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6052 wrote to memory of 4132	6052	2026-09-04_5ef4166f3371ea99077d89b7b294b815_elex_glassworm_hawkeye_remcos_vidar_wannacry.exe	91
PID 4132 wrote to memory of 524	4132	cmd.exe	93
PID 3404 wrote to memory of 2496	3404	svchost_AACCAACBBCCAACCCCAABABCACABABCCCAABCBBBABCCBCBBBBABABCC.exe	94
PID 6052 wrote to memory of 972	6052	2026-09-04_5ef4166f3371ea99077d89b7b294b815_elex_glassworm_hawkeye_remcos_vidar_wannacry.exe	95
PID 972 wrote to memory of 4984	972	cmd.exe	97
PID 6052 wrote to memory of 2564	6052	2026-09-04_5ef4166f3371ea99077d89b7b294b815_elex_glassworm_hawkeye_remcos_vidar_wannacry.exe	98
PID 2564 wrote to memory of 2212	2564	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-09-04_5ef4166f3371ea99077d89b7b294b815_elex_glassworm_hawkeye_remcos_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_5ef4166f3371ea99077d89b7b294b815_elex_glassworm_hawkeye_remcos_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6052
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCACBAACAAABBACCBCBCBACACBBAABCBAAACABCBCCBCCBBAAABCACBABCCCCAABBCCBABACABBCACCCBCACCBAAACBBAAACCCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCAACBBCCAACCCCAABABCACABABCCCAABCBBBABCCBCBBBBABABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4132
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCACBAACAAABBACCBCBCBACACBBAABCBAAACABCBCCBCCBBAAABCACBABCCCCAABBCCBABACABBCACCCBCACCBAAACBBAAACCCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCAACBBCCAACCCCAABABCACABABCCCAABCBBBABCCBCBBBBABABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:524
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAABBCCAABACCACABCBBABCBBCBBACACBCABCBBAABABBAACBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCAACBBCCAACCCCAABABCACABABCCCAABCBBBABCCBCBBBBABABCC.exe" start= auto displayName= "UserDataSvc_CAABBCCAABACCACABCBBABCBBCBBACACBCABCBBAABABBAACBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:972
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAABBCCAABACCACABCBBABCBBCBBACACBCABCBBAABABBAACBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCAACBBCCAACCCCAABABCACABABCCCAABCBBBABCCBCBBBBABABCC.exe" start= auto displayName= "UserDataSvc_CAABBCCAABACCACABCBBABCBBCBBACACBCABCBBAABABBAACBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4984
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAABBCCAABACCACABCBBABCBBCBBACACBCABCBBAABABBAACBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAABBCCAABACCACABCBBABCBBCBBACACBCABCBBAABABBAACBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2212

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCAACBBCCAACCCCAABABCACABABCCCAABCBBBABCCBCBBBBABABCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCAACBBCCAACCCCAABABCACABABCCCAABCBBBABCCBCBBBBABABCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2496

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCAACBBCCAACCCCAABABCACABABCCCAABCBBBABCCBCBBBBABABCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCAACBBCCAACCCCAABABCACABABCCCAABCBBBABCCBCBBBBABABCC.exe
1⤵
- Executes dropped EXE
PID:1264

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBCAAACAABBBBBBCCCCABBABACBCCABCCCBAAABCBCBBABACACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBCAAACAABBBBBBCCCCABBABACBCCABCCCBAAABCBCBBABACACAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bcdce9431198975401ce7c512e9f600ca62eb2d253138a32a35ff0d5ff76c6f9
MD5 f8c06f85826181c456fec9d54b7c3263
SHA1 974d27a36682ad9756a05a06edf91cbf2138a755
SHA512 cf72fdf302a195cc4f332f0bd581f0e1b616c384d0dc61d1e1a07f7e8129dfe453f0cdc7765c61d5509de4e33aca97b7595e5f4600773d0063c7fc9403c49678
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fb0f12aca70de570f4d5a11dcf6314ab9995a8e7aec7048d37bdb8037b6a62e7
MD5 a379d50de58bdb3f5f2d307073042ec2
SHA1 97ddd950307e8654f4a2bf032a831ba1e67a0e6c
SHA512 41f8b6aa0dfe456bbc3c262e4316ce96c0e0551150143811603dd8442c8c73ee123a7de7f6114a14c1898c139c46d28d347e47f96edc6af712f1ac52aaeaec87
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 462ac5b19bb85355ee983cbbc49c9c2c1096282222ccf28b9442a4ee647d6f4b
MD5 333b6d6a157d9070c638012fbb30778e
SHA1 3465e9e65c214a95799022dcc75d37e72a995232
SHA512 50ff0d1a6d16a667bc6b88ae6808878280ca15e800f13d4dae8a49c8f70ddad7b3db2bfc9d9bd31ecda4e608c94dd6db993fe8a4798c7439c2ee57d92832b99d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cd2efee21f186b8349767499ae07719526fec18e24cc42b8c8d5cb4eaf1a346e
MD5 a4d1d03cfe32c5a2f32c112d87d7c3c5
SHA1 3435c627b29d25ec5e06b74b9d203725111c9313
SHA512 9c058785071f8be11918d23d3e163c5b3545a7eaacf3ff4933fc0b9f2138d75ad80b06c8532de99c9293fc1f62a90573ce158c8ba999916a8ac81612a6d7deb5
MD5 SHA1 SHA512

Submit Download

svchost_AACCAACBBCCAACCCCAABABCACABABCCCAABCBBBABCCBCBBBBABABCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCAACBBCCAACCCCAABABCACABABCCCAABCBBBABCCBCBBBBABABCC.exe
Size 9.9MB
SHA256 2d226e15de0da2a57124c2d0ed601a63e9c22fd34c90bb21724d626e0174c71f
MD5 5ef4166f3371ea99077d89b7b294b815
SHA1 04414a03cd29f3786c2999be5921f086f3d022be
SHA512 d88d7ee6dce7c41143c326643fd3fed7ffae591e5ede93d537bf7a3bdbf116399167539f8ce0a022c7e2f0254152780255528234be4c4f24187d392bb203a7c3
SSDEEP 49152:U+ES+EzD+Es+ES+EKqatglS+Es+ES+EzD+Es+ES+EN+Es+ES+Es+ES+EzD+Es+Ec:GMMMMM87p
TLSH
T15FB62B05F98740B1E82B01B04CDBD3BF8A70BA258B128EEBF74D875FA933B919534655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3404-24-0x00000000009A0000-0x00000000009C1000-memory.dmp

Download

memory/3404-37-0x00000000009A0000-0x00000000009C1000-memory.dmp

Download

memory/6052-0-0x0000000000B90000-0x0000000000BB1000-memory.dmp

Download

memory/6052-7-0x0000000000B90000-0x0000000000BB1000-memory.dmp

Download