0e48ba95824c283482244dd0e9c9c4f29e514bdb6ca509b5d65bcf6d1a731d2d

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 16:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_25109fa0579aecc938bb5426e44dd769_elex_glassworm_stop_vidar.exe
Size 753KB
Sample260905-tqaersvxcy
SHA256 0e48ba95824c283482244dd0e9c9c4f29e514bdb6ca509b5d65bcf6d1a731d2d
MD5 25109fa0579aecc938bb5426e44dd769
SHA1 76889513599e8649f054bfaa7534b3cc156e0528
SHA512 6fc1b606b430e9bb875652d945f067dbaaf0b2f646ecde91e8b42009bd53c24279d554df6f5a76ef2fa58f07a0b3cbeec03eeee163c25668f58127660478d067
SSDEEP 12288:mgUFgEsnojA8a0wIk0BX3RKuemGd70ioGuVWW6oIT+BeDuUlEqatglsLb0:m9+EM0JafDd70iTWCTExqatgl8b0
TLSH
T162F47D01BB81C132F467053249AF93B65A79B8215F2996CFB388637E5E327D0B731726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2960	svchost_CCABAAACCAACBAAAACBACBCAAABCCCCBACBABAABABBABABCCCCAACB.exe
3612	svchost_BACCABCCAAACBCCBACACBBBCBAACABCCCCBCABACCAABBAABCBBBCBB.exe
4884	svchost_CCABAAACCAACBAAAACBACBCAAABCCCCBACBABAABABBABABCCCCAACB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CABCBBCCCBCAACBCABABABBCBABABCACCAABCCABCCABBAAABCBABCBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACCABCCAAACBCCBACACBBBCBAACABCCCCBCABACCAABBAABCBBBCBB.exe"	svchost_CCABAAACCAACBAAAACBACBCAAABCCCCBACBABAABABBABABCCCCAACB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACBAABBACCBACAACCACBBAABBCCCCBBBBBBBCCCAABCBAAABCBBCABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCABAAACCAACBAAAACBACBCAAABCCCCBACBABAABABBABABCCCCAACB.exe"	2026-09-04_25109fa0579aecc938bb5426e44dd769_elex_glassworm_stop_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2264	sc.exe
5788	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5424	cmd.exe
3156	cmd.exe
3236	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACCABCCAAACBCCBACACBBBCBAACABCCCCBCABACCAABBAABCBBBCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_25109fa0579aecc938bb5426e44dd769_elex_glassworm_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCABAAACCAACBAAAACBACBCAAABCCCCBACBABAABABBABABCCCCAACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4972	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
476	2026-09-04_25109fa0579aecc938bb5426e44dd769_elex_glassworm_stop_vidar.exe
476	2026-09-04_25109fa0579aecc938bb5426e44dd769_elex_glassworm_stop_vidar.exe
476	2026-09-04_25109fa0579aecc938bb5426e44dd769_elex_glassworm_stop_vidar.exe
476	2026-09-04_25109fa0579aecc938bb5426e44dd769_elex_glassworm_stop_vidar.exe
2960	svchost_CCABAAACCAACBAAAACBACBCAAABCCCCBACBABAABABBABABCCCCAACB.exe
2960	svchost_CCABAAACCAACBAAAACBACBCAAABCCCCBACBABAABABBABABCCCCAACB.exe
2960	svchost_CCABAAACCAACBAAAACBACBCAAABCCCCBACBABAABABBABABCCCCAACB.exe
2960	svchost_CCABAAACCAACBAAAACBACBCAAABCCCCBACBABAABABBABABCCCCAACB.exe
3612	svchost_BACCABCCAAACBCCBACACBBBCBAACABCCCCBCABACCAABBAABCBBBCBB.exe
3612	svchost_BACCABCCAAACBCCBACACBBBCBAACABCCCCBCABACCAABBAABCBBBCBB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	476	2026-09-04_25109fa0579aecc938bb5426e44dd769_elex_glassworm_stop_vidar.exe
Token: SeDebugPrivilege	2960	svchost_CCABAAACCAACBAAAACBACBCAAABCCCCBACBABAABABBABABCCCCAACB.exe
Token: SeDebugPrivilege	3612	svchost_BACCABCCAAACBCCBACACBBBCBAACABCCCCBCABACCAABBAABCBBBCBB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 476 wrote to memory of 5424	476	2026-09-04_25109fa0579aecc938bb5426e44dd769_elex_glassworm_stop_vidar.exe	93
PID 5424 wrote to memory of 4972	5424	cmd.exe	95
PID 2960 wrote to memory of 5816	2960	svchost_CCABAAACCAACBAAAACBACBCAAABCCCCBACBABAABABBABABCCCCAACB.exe	96
PID 476 wrote to memory of 3156	476	2026-09-04_25109fa0579aecc938bb5426e44dd769_elex_glassworm_stop_vidar.exe	99
PID 3156 wrote to memory of 2264	3156	cmd.exe	101
PID 476 wrote to memory of 3236	476	2026-09-04_25109fa0579aecc938bb5426e44dd769_elex_glassworm_stop_vidar.exe	102
PID 3236 wrote to memory of 5788	3236	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-09-04_25109fa0579aecc938bb5426e44dd769_elex_glassworm_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_25109fa0579aecc938bb5426e44dd769_elex_glassworm_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:476
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACACBAABBBAABABABBCBAABCABCBAAACBBBABBCBCACACAABCACBACCBACCCCAAABCCBABBBCABABCAABAACAACAAAACCBCABCACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABAAACCAACBAAAACBACBCAAABCCCCBACBABAABABBABABCCCCAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5424
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACACBAABBBAABABABBCBAABCABCBAAACBBBABBCBCACACAABCACBACCBACCCCAAABCCBABBBCABABCAABAACAACAAAACCBCABCACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABAAACCAACBAAAACBACBCAAABCCCCBACBABAABABBABABCCCCAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4972
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCCABCACBBBACBBBABCABABBAAABCCAACAABBBACCBABABAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABAAACCAACBAAAACBACBCAAABCCCCBACBABAABABBABABCCCCAACB.exe" start= auto displayName= "UserDataSvc_CCCCABCACBBBACBBBABCABABBAAABCCAACAABBBACCBABABAABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3156
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCCABCACBBBACBBBABCABABBAAABCCAACAABBBACCBABABAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABAAACCAACBAAAACBACBCAAABCCCCBACBABAABABBABABCCCCAACB.exe" start= auto displayName= "UserDataSvc_CCCCABCACBBBACBBBABCABABBAAABCCAACAABBBACCBABABAABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2264
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCCABCACBBBACBBBABCABABBAAABCCAACAABBBACCBABABAABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3236
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCCABCACBBBACBBBABCABABBAAABCCAACAABBBACCBABABAABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5788

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABAAACCAACBAAAACBACBCAAABCCCCBACBABAABABBABABCCCCAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABAAACCAACBAAAACBACBCAAABCCCCBACBABAABABBABABCCCCAACB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5816

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCABCCAAACBCCBACACBBBCBAACABCCCCBCABACCAABBAABCBBBCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCABCCAAACBCCBACACBBBCBAACABCCCCBCABACCAABBAABCBBBCBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3612

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABAAACCAACBAAAACBACBCAAABCCCCBACBABAABABBABABCCCCAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABAAACCAACBAAAACBACBCAAABCCCCBACBABAABABBABABCCCCAACB.exe
1⤵
- Executes dropped EXE
PID:4884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 41478ced29198af1b667fa52e67d9e7faa1bdda7818f4491d1d37e711153d7a4
MD5 f4a52819f8cfe2bc017c63bd0e6b5ad6
SHA1 f58463687a148641ea3517f2b1574336c4a16f5f
SHA512 73001550421275d704aa754569d92d2b5bc7d8cd7c6a522be16c6e36fe5183d84dda4a03cabb42d94d7c226159a46dc5bcce3e51a88a8811e387cd8ee60d5ed9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 91cc4a71708a43865b791402cfbcac41eb28fbb140d83740221675062b46abca
MD5 d4fed770a38c97251af040c99bdf0ebd
SHA1 e61c05a9663feb40537e18a54c7bbc06abb5a6d7
SHA512 ac077f325bcdaa7f57809cef318935a8727b2bf1aed35f7d8bfa1c0a9faa6b85fb5d22efcbb198b0fb155181a5bec8a15069e8ec8d4b932378bf725cba668cb7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a6454214867d2c409ac4ad5ea3e12b8909d6d80919e3bddb669cf9281f1005ea
MD5 81af09353b832469d7cf15af534f64bb
SHA1 c0f37b173d90eb101608cca991ac995051b6fac7
SHA512 b1af52f5f29cb6f88fd08b203e501ce93e932804db2c6510a04543619d1215b17fd9b0ede797975a4c2821167f7796478946b7889dda379549686c9560678462
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f23328dfb42b98dc50de475e475d374a1b9b9b1f9eff384360655c2c1abda7e3
MD5 7c6d8bed615e10b99d336dcaf2aa65e9
SHA1 3596814ce945ec3a3822369f1e259683cbedf2e6
SHA512 e7cc46779774f4d9b5a676a29b89d1b900c83022eab6fa388c09a49ca26081a361a3ce816b6160cf724091b1dde3fe4c0d6dd9141ccd5be806ea9d6ca83856a8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1996945f00e3add16f9f5042b548f94a26eecc6e6a75e1e07c07d445bfdb6bf8
MD5 546134261ba69e4ef90fff15639f44f0
SHA1 6558dbf3069373e5bfb7a25487eabfa396c598e4
SHA512 e6b46d704c79ae56aadbde154f39104c346e4a9eb56bfb02076e2803dd916c98fed57c1ffdb0920282b759ce92b11325c73752bf1e0d72e05b05edf43c190f5c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c56954877b2327e332cc5eb6cff2717c9e2afd721a8d0e77f3e684e4b84265da
MD5 fe51af0ea40bfae280d0b3f69305e2f4
SHA1 dd5d81ec1d9c2cf2d6a38fe07d67bf95546e6b04
SHA512 b09515197e664a072e6333d9b311bebd947a432781876f048693312529b7a0bad527fef195d3ddff6d763ec4ec9acfea013a550eaa83dad5432b4d8f3cd707e4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f9491edd6263d63b1f3dbfd9079f9469049edf18e07bb1e5c98dba6762580940
MD5 192db2b79efed20e3766bcc59b36c0d2
SHA1 6a61c1f17c095ec3585f5b98d896983cbcc0ce4b
SHA512 b804d81a718dbe12e1289abbd3f2ea26c619f377f3585fb172450bf718fa58184481899444ac8fc5bdb4d1a3f110210a0d75c87afaba1c613d30e1e52ab92a03
MD5 SHA1 SHA512

Submit Download

svchost_CCABAAACCAACBAAAACBACBCAAABCCCCBACBABAABABBABABCCCCAACB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABAAACCAACBAAAACBACBCAAABCCCCBACBABAABABBABABCCCCAACB.exe
Size 753KB
SHA256 0e48ba95824c283482244dd0e9c9c4f29e514bdb6ca509b5d65bcf6d1a731d2d
MD5 25109fa0579aecc938bb5426e44dd769
SHA1 76889513599e8649f054bfaa7534b3cc156e0528
SHA512 6fc1b606b430e9bb875652d945f067dbaaf0b2f646ecde91e8b42009bd53c24279d554df6f5a76ef2fa58f07a0b3cbeec03eeee163c25668f58127660478d067
SSDEEP 12288:mgUFgEsnojA8a0wIk0BX3RKuemGd70ioGuVWW6oIT+BeDuUlEqatglsLb0:m9+EM0JafDd70iTWCTExqatgl8b0
TLSH
T162F47D01BB81C132F467053249AF93B65A79B8215F2996CFB388637E5E327D0B731726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 771603019f6609521d6ed808d099df24b752b13cdfb658c6edeab6833595a9a7
MD5 cdf38b91f897118b5c0a1174a414bf4d
SHA1 54625b579233539ab7db637ada65444f8de23d3a
SHA512 6de5c39fa07906145b0a7add2396e4807d904bd80f7e323baf6875e40c4fda95c396884b8a4d8c2907bdcfea97eca8907aefac1bcb33108e3a6c2a8ce14c6f80
TLSH
T12A119852B0A5D8A7E13128C79229DBC70DE82BEE6C5CAF24130992186756837AE15CF6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/476-8-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/476-0-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2960-34-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3612-70-0x0000000000400000-0x0000000000421000-memory.dmp

Download