57eff70fa21b2f978f9682133e6c8db45ecd7fb592832500e40f7ea8cf5c90c6

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/09/2026, 22:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-06_92cbc4c34bbdc40d137adbd34775a662_elex_glassworm_stop_vidar.exe
Size 11.5MB
Sample260906-2d99matflf
SHA256 57eff70fa21b2f978f9682133e6c8db45ecd7fb592832500e40f7ea8cf5c90c6
MD5 92cbc4c34bbdc40d137adbd34775a662
SHA1 1ab79e365c3928ba30fe380cf8b22f6ce36bd93c
SHA512 992e95a0c7e28afb9f3208e366f274f7538eb5660141d74443e1d663f62611bcac64204d48b8610268ea8bfa33c6478798f364a89e11266a843013494e1fa680
SSDEEP 196608:85VJ5zj5VR5VJ505VR5VJ5zj5VR5VJ505VR5VJ5zM:85D5H5H5D505H5D5H5H5D505H5D5Y
TLSH
T153C68D19B7D61161F6B3667088BBC3F66D35B9200B3087DF6704B62D1E32AD0E93971A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
564	svchost_BACBABAABBBBBCACACBBCBCABABABCCAAAABBBBBCBCABBBCBABACBB.exe
3628	svchost_BACBABAABBBBBCACACBBCBCABABABCCAAAABBBBBCBCABBBCBABACBB.exe
4892	svchost_BAACCABCBAAACACCCBBCBACBBBBCBCCBBCAACACACBBABACACACCAAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CABBCCCBAABABCCCBACAAAABBBBCBAAABBBBCBCAABBBCACACBBCCABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAACCABCBAAACACCCBBCBACBBBBCBCCBBCAACACACBBABACACACCAAA.exe"	svchost_BACBABAABBBBBCACACBBCBCABABABCCAAAABBBBBCBCABBBCBABACBB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_ACCCAABBCBBBCCBAACBCBCAABBACABBAACCACAABBCABBACBACBAABCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACBABAABBBBBCACACBBCBCABABABCCAAAABBBBBCBCABBBCBABACBB.exe"	2026-09-06_92cbc4c34bbdc40d137adbd34775a662_elex_glassworm_stop_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4372	sc.exe
708	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3972	cmd.exe
4164	cmd.exe
4824	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-06_92cbc4c34bbdc40d137adbd34775a662_elex_glassworm_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACBABAABBBBBCACACBBCBCABABABCCAAAABBBBBCBCABBBCBABACBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAACCABCBAAACACCCBBCBACBBBBCBCCBBCAACACACBBABACACACCAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3576	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1620	2026-09-06_92cbc4c34bbdc40d137adbd34775a662_elex_glassworm_stop_vidar.exe
1620	2026-09-06_92cbc4c34bbdc40d137adbd34775a662_elex_glassworm_stop_vidar.exe
1620	2026-09-06_92cbc4c34bbdc40d137adbd34775a662_elex_glassworm_stop_vidar.exe
1620	2026-09-06_92cbc4c34bbdc40d137adbd34775a662_elex_glassworm_stop_vidar.exe
564	svchost_BACBABAABBBBBCACACBBCBCABABABCCAAAABBBBBCBCABBBCBABACBB.exe
564	svchost_BACBABAABBBBBCACACBBCBCABABABCCAAAABBBBBCBCABBBCBABACBB.exe
564	svchost_BACBABAABBBBBCACACBBCBCABABABCCAAAABBBBBCBCABBBCBABACBB.exe
564	svchost_BACBABAABBBBBCACACBBCBCABABABCCAAAABBBBBCBCABBBCBABACBB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1620	2026-09-06_92cbc4c34bbdc40d137adbd34775a662_elex_glassworm_stop_vidar.exe
Token: SeDebugPrivilege	564	svchost_BACBABAABBBBBCACACBBCBCABABABCCAAAABBBBBCBCABBBCBABACBB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2476	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 3972	1620	2026-09-06_92cbc4c34bbdc40d137adbd34775a662_elex_glassworm_stop_vidar.exe	97
PID 3972 wrote to memory of 3576	3972	cmd.exe	99
PID 1620 wrote to memory of 4164	1620	2026-09-06_92cbc4c34bbdc40d137adbd34775a662_elex_glassworm_stop_vidar.exe	100
PID 4164 wrote to memory of 4372	4164	cmd.exe	102
PID 1620 wrote to memory of 4824	1620	2026-09-06_92cbc4c34bbdc40d137adbd34775a662_elex_glassworm_stop_vidar.exe	103
PID 4824 wrote to memory of 708	4824	cmd.exe	105
PID 564 wrote to memory of 3596	564	svchost_BACBABAABBBBBCACACBBCBCABABABCCAAAABBBBBCBCABBBCBABACBB.exe	107
PID 3596 wrote to memory of 2216	3596	notepad.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-09-06_92cbc4c34bbdc40d137adbd34775a662_elex_glassworm_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-06_92cbc4c34bbdc40d137adbd34775a662_elex_glassworm_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACBBABBBCBBBBCCCAAABBBCCAACBACCACAABABAACABCBBCBCCAACBAACCBBBCAACCBCCAACCBACBACABBAAACCABBCBABACABCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBABAABBBBBCACACBBCBCABABABCCAAAABBBBBCBCABBBCBABACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3972
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACBBABBBCBBBBCCCAAABBBCCAACBACCACAABABAACABCBBCBCCAACBAACCBBBCAACCBCCAACCBACBACABBAAACCABBCBABACABCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBABAABBBBBCACACBBCBCABABABCCAAAABBBBBCBCABBBCBABACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3576
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAABBCBCABBBBCBAABABABCCCBBCBCCBACCCBCCACBBBACCCACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBABAABBBBBCACACBBCBCABABABCCAAAABBBBBCBCABBBCBABACBB.exe" start= auto displayName= "UserDataSvc_AAABBCBCABBBBCBAABABABCCCBBCBCCBACCCBCCACBBBACCCACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4164
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAABBCBCABBBBCBAABABABCCCBBCBCCBACCCBCCACBBBACCCACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBABAABBBBBCACACBBCBCABABABCCAAAABBBBBCBCABBBCBABACBB.exe" start= auto displayName= "UserDataSvc_AAABBCBCABBBBCBAABABABCCCBBCBCCBACCCBCCACBBBACCCACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAABBCBCABBBBCBAABABABCCCBBCBCCBACCCBCCACBBBACCCACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAABBCBCABBBBCBAABABABCCCBBCBCCBACCCBCCACBBBACCCACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:708

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBABAABBBBBCACACBBCBCABABABCCAAAABBBBBCBCABBBCBABACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBABAABBBBBCACACBBCBCABABABCCAAAABBBBBCBCABBBCBABACBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:564
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3596
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2216

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBABAABBBBBCACACBBCBCABABABCCAAAABBBBBCBCABBBCBABACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBABAABBBBBCACACBBCBCABABABCCAAAABBBBBCBCABBBCBABACBB.exe
1⤵
- Executes dropped EXE
PID:3628

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2476

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCABCBAAACACCCBBCBACBBBBCBCCBBCAACACACBBABACACACCAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCABCBAAACACCCBBCBACBBBBCBCCBBCAACACACBBABACACACCAAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 855e495aa9d6164f7095aff48bc463aa8e94207d4ff92ea589b62a134c3b4f77
MD5 1e7049935071eee764a049aeadfb5bd0
SHA1 d33cd8c953f86ce2e769ba264062bf14e3a492be
SHA512 93dd605f916b8272f95150c54f4a590adaaa0bd971646e905b0de5b9cec4189a94ef6a0ddfb794f77c73a2615cb7171f9dbd86a33232a55f5cb533c073bec9e5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cd73199e51b5a5073eea1f0864ba6bb861908f8aedecbb43b684c6b2f9f7d339
MD5 14c48d82fca36ef43e230351fe60c2dd
SHA1 df14211f21076dc9f66410906f21440009b9d1fe
SHA512 155db3a718e1029aa1bcb6b45217ce5e66acd15799f082cfbe112e6a97c53d0d3ad059819d778e46a5105d65bd14475e8cd4b68ac2c58d4bffa9340024fd33c8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f4ed6b88f6c641daf3ee87e2e2236e7363b2485819de9c6ca7a6415ead6adf39
MD5 ca16b88e5e8f54b04531386a85892f3c
SHA1 a334e16551be659fce9a456fd7e3db257222a2cb
SHA512 6c23a624b6a0787b22246b5591bfb1b7613770f2a63c06cf2103710147c2c705b7d759d1eec6248dc2751401911124d142c4524360bc23a24e2bb3e67cff70fe
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b4e72fd5a0aaf269b5e730581e9ee5325d1aaa13f5d433e77a05281b5fbda6e9
MD5 9893b1284768d97ebcff4890e9d92d14
SHA1 c804f3172a0ef163d0d6e6038b29c9c998b431e9
SHA512 1264636ed2a1f1dc1e15807d8550f4b5e925b0033ff818bd1a971d66916288bb82a0fdbbe35c4eb5610c7cbefa0b42618c4acabef44db338edb8216557c4052d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ac3008ab2d68c4eec2cadee253ff751b6e74386c84bb4bd0374d7baa2c3b24e5
MD5 21fed40eb6c678d3d0758d5b1ea13e06
SHA1 5e946210071b907680f9fa578bdc18fe90bdb1da
SHA512 350c405ba5cf43e6e639445a530e0332ba3b815db6db766373ae7e16cee0178c4f76754e22a1b327c69a32784f6d8fbb49184aa48e94e4f897368dbeb77ed9da
MD5 SHA1 SHA512

Submit Download

svchost_BACBABAABBBBBCACACBBCBCABABABCCAAAABBBBBCBCABBBCBABACBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBABAABBBBBCACACBBCBCABABABCCAAAABBBBBCBCABBBCBABACBB.exe
Size 11.5MB
SHA256 57eff70fa21b2f978f9682133e6c8db45ecd7fb592832500e40f7ea8cf5c90c6
MD5 92cbc4c34bbdc40d137adbd34775a662
SHA1 1ab79e365c3928ba30fe380cf8b22f6ce36bd93c
SHA512 992e95a0c7e28afb9f3208e366f274f7538eb5660141d74443e1d663f62611bcac64204d48b8610268ea8bfa33c6478798f364a89e11266a843013494e1fa680
SSDEEP 196608:85VJ5zj5VR5VJ505VR5VJ5zj5VR5VJ505VR5VJ5zM:85D5H5H5D505H5D5H5H5D505H5D5Y
TLSH
T153C68D19B7D61161F6B3667088BBC3F66D35B9200B3087DF6704B62D1E32AD0E93971A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/564-25-0x0000000000290000-0x00000000002B1000-memory.dmp

Download

memory/564-38-0x0000000000290000-0x00000000002B1000-memory.dmp

Download

memory/1620-6-0x0000000000100000-0x0000000000121000-memory.dmp

Download

memory/3596-67-0x00000000051D0000-0x00000000051D1000-memory.dmp

Download

memory/3628-74-0x0000000000290000-0x00000000002B1000-memory.dmp

Download

memory/4892-80-0x00000000008C0000-0x00000000008E1000-memory.dmp

Download