72437635f4c6bfb9ca86700e4eb5787e9f152d5a24ce8b28aec26710a8bab0d6

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/09/2026, 03:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-07_e4f0f2a1c0f4d8a1312d7f3801ffbe17_elex_glassworm_stop_vidar.exe
Size 3.8MB
Sample260908-dpcwhacg29
SHA256 72437635f4c6bfb9ca86700e4eb5787e9f152d5a24ce8b28aec26710a8bab0d6
MD5 e4f0f2a1c0f4d8a1312d7f3801ffbe17
SHA1 c7a560e73e7edf42abec182b69b5537d33f463c4
SHA512 cde1995a065ec48df6783171a7bfcd1a6d9ad04d06cd038b4b0ee859cbea677314684e716d0af2a7d6294be6d54b9749712af7bf412571b0371d554fb85521c5
SSDEEP 49152:U+ES+EN+ES+ES+EruDd79WCSqatgl6+ES+EN+ES+ES+EruDd79WCSqatgl6+ES+E:Up725p725p727
TLSH
T1F0067D05FA8280B2F477117149AFD37A4A75B9214F268ADFE388833E5E337D0A935716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2660	svchost_BBCCCBCCCCBCACBBCACBCAABCAACCBCBABAABBBCBAAABAACCCCACBB.exe
3260	svchost_ACBBAABBCBAACBCBACCAAAABABCAAABBBACCCABBABCACBABBCCCABB.exe
1124	svchost_BBCCCBCCCCBCACBBCACBCAABCAACCBCBABAABBBCBAAABAACCCCACBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_AAAACAAACAABCABBAABBBCBBCABACAAAACBACAACBBBABAAACACAACAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCCCBCCCCBCACBBCACBCAABCAACCBCBABAABBBCBAAABAACCCCACBB.exe"	2026-09-07_e4f0f2a1c0f4d8a1312d7f3801ffbe17_elex_glassworm_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BCBBBACCABAAABACBBBBBBBCBBBBBABAABCCAAABCBBCCACABBBAAAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBBAABBCBAACBCBACCAAAABABCAAABBBACCCABBABCACBABBCCCABB.exe"	svchost_BBCCCBCCCCBCACBBCACBCAABCAACCBCBABAABBBCBAAABAACCCCACBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2552	sc.exe
3032	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2824	cmd.exe
2632	cmd.exe
2364	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-07_e4f0f2a1c0f4d8a1312d7f3801ffbe17_elex_glassworm_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCCCBCCCCBCACBBCACBCAABCAACCBCBABAABBBCBAAABAACCCCACBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBBAABBCBAACBCBACCAAAABABCAAABBBACCCABBABCACBABBCCCABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2028	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3056	2026-09-07_e4f0f2a1c0f4d8a1312d7f3801ffbe17_elex_glassworm_stop_vidar.exe
3056	2026-09-07_e4f0f2a1c0f4d8a1312d7f3801ffbe17_elex_glassworm_stop_vidar.exe
3056	2026-09-07_e4f0f2a1c0f4d8a1312d7f3801ffbe17_elex_glassworm_stop_vidar.exe
3056	2026-09-07_e4f0f2a1c0f4d8a1312d7f3801ffbe17_elex_glassworm_stop_vidar.exe
2660	svchost_BBCCCBCCCCBCACBBCACBCAABCAACCBCBABAABBBCBAAABAACCCCACBB.exe
2660	svchost_BBCCCBCCCCBCACBBCACBCAABCAACCBCBABAABBBCBAAABAACCCCACBB.exe
2660	svchost_BBCCCBCCCCBCACBBCACBCAABCAACCBCBABAABBBCBAAABAACCCCACBB.exe
2660	svchost_BBCCCBCCCCBCACBBCACBCAABCAACCBCBABAABBBCBAAABAACCCCACBB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3056	2026-09-07_e4f0f2a1c0f4d8a1312d7f3801ffbe17_elex_glassworm_stop_vidar.exe
Token: SeDebugPrivilege	2660	svchost_BBCCCBCCCCBCACBBCACBCAABCAACCBCBABAABBBCBAAABAACCCCACBB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1052	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 2824	3056	2026-09-07_e4f0f2a1c0f4d8a1312d7f3801ffbe17_elex_glassworm_stop_vidar.exe	96
PID 2824 wrote to memory of 2028	2824	cmd.exe	98
PID 2660 wrote to memory of 540	2660	svchost_BBCCCBCCCCBCACBBCACBCAABCAACCBCBABAABBBCBAAABAACCCCACBB.exe	99
PID 540 wrote to memory of 4880	540	notepad.exe	100
PID 3056 wrote to memory of 2632	3056	2026-09-07_e4f0f2a1c0f4d8a1312d7f3801ffbe17_elex_glassworm_stop_vidar.exe	104
PID 2632 wrote to memory of 3032	2632	cmd.exe	106
PID 3056 wrote to memory of 2364	3056	2026-09-07_e4f0f2a1c0f4d8a1312d7f3801ffbe17_elex_glassworm_stop_vidar.exe	107
PID 2364 wrote to memory of 2552	2364	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-09-07_e4f0f2a1c0f4d8a1312d7f3801ffbe17_elex_glassworm_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-07_e4f0f2a1c0f4d8a1312d7f3801ffbe17_elex_glassworm_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACBBACBBBACACACABCBBBCAAABCCBCCBABBABABABACBCACBCCABACCBAAABACBABCCCBACCBACACACACBABBCBAABAACACAABCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCBCCCCBCACBBCACBCAABCAACCBCBABAABBBCBAAABAACCCCACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACBBACBBBACACACABCBBBCAAABCCBCCBABBABABABACBCACBCCABACCBAAABACBABCCCBACCBACACACACBABBCBAABAACACAABCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCBCCCCBCACBBCACBCAABCAACCBCBABAABBBCBAAABAACCCCACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2028
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACABAACBCCAABCAACBABABBAACBABCCCABBCCBBCACCBABBABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCBCCCCBCACBBCACBCAABCAACCBCBABAABBBCBAAABAACCCCACBB.exe" start= auto displayName= "UserDataSvc_BACABAACBCCAABCAACBABABBAACBABCCCABBCCBBCACCBABBABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACABAACBCCAABCAACBABABBAACBABCCCABBCCBBCACCBABBABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCBCCCCBCACBBCACBCAABCAACCBCBABAABBBCBAAABAACCCCACBB.exe" start= auto displayName= "UserDataSvc_BACABAACBCCAABCAACBABABBAACBABCCCABBCCBBCACCBABBABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3032
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACABAACBCCAABCAACBABABBAACBABCCCABBCCBBCACCBABBABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACABAACBCCAABCAACBABABBAACBABCCCABBCCBBCACCBABBABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2552

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCBCCCCBCACBBCACBCAABCAACCBCBABAABBBCBAAABAACCCCACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCBCCCCBCACBBCACBCAABCAACCBCBABAABBBCBAAABAACCCCACBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:540
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4880

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1052

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBAABBCBAACBCBACCAAAABABCAAABBBACCCABBABCACBABBCCCABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBAABBCBAACBCBACCAAAABABCAAABBBACCCABBABCACBABBCCCABB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3260

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCBCCCCBCACBBCACBCAABCAACCBCBABAABBBCBAAABAACCCCACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCBCCCCBCACBBCACBCAABCAACCBCBABAABBBCBAAABAACCCCACBB.exe
1⤵
- Executes dropped EXE
PID:1124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d717a920470a71ab6d234e64cbc4befbf21a0908921495f3342db9983b65e244
MD5 9d0f5be9aa8822b9e40f7b159c51413b
SHA1 f13abb49c8bfda133ce04326a1475388ed653935
SHA512 d1fe2a57208e82068765d25fcf024a1159e25b953b619d71407a658e41c7798d4f844df367a1802735a08df9c16febb1acb9bb0e978ce981802aa2100d96e55f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4c8ae025e824b017a9ee6fd0995858a103ff3c39cc355b95706216920abae12a
MD5 d414a7ed7df0a9482c88984db426d84c
SHA1 d0c257b545c8607a8a162717ff0c9f339feac548
SHA512 93be7418ec817a9d7061d1e2611b04ba12e1aca05e613c479ab6f623da1af3b9609bcb2e80ad0bc1d4bb3eab4896c949a70401fa6b7b27cb99a5259e4aeca29c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3e2e2153656d12ba0dba25a2d3fff0d45643fd80e49c79f5e1a5d841b49e0dff
MD5 73c70b0bf94f2f7443b1502028cce999
SHA1 abf5e1e2d91a8ade27b35cbfa8aaad12d14ed384
SHA512 4d2aafc3c09fa26fd8bed7e347cedf70c5e7a57911b9d57d36d612e7c9285bf66f4401f0e73c5a4d75313ea0d8d8beb48c277056fffa981f2b87bdfaa9117073
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 60623991be0afb481eb12212c837534ffe80160df4f3ac1cfd217bb9e1df4f15
MD5 226388e1ecab26d60596b5a57ec0be3d
SHA1 efb6aa8988d4817ad4b17c6d23b1d2dc97f9195e
SHA512 ac4e30626d3661bcee5ca85c35c3e13547f5e5ad84f6cb3e9d69637e572023a5b0bfc6afd717c3473cfaab4e69be04552164012419fbe0e4b2befe2e55903fb6
MD5 SHA1 SHA512

Submit Download

svchost_BBCCCBCCCCBCACBBCACBCAABCAACCBCBABAABBBCBAAABAACCCCACBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCBCCCCBCACBBCACBCAABCAACCBCBABAABBBCBAAABAACCCCACBB.exe
Size 3.8MB
SHA256 72437635f4c6bfb9ca86700e4eb5787e9f152d5a24ce8b28aec26710a8bab0d6
MD5 e4f0f2a1c0f4d8a1312d7f3801ffbe17
SHA1 c7a560e73e7edf42abec182b69b5537d33f463c4
SHA512 cde1995a065ec48df6783171a7bfcd1a6d9ad04d06cd038b4b0ee859cbea677314684e716d0af2a7d6294be6d54b9749712af7bf412571b0371d554fb85521c5
SSDEEP 49152:U+ES+EN+ES+ES+EruDd79WCSqatgl6+ES+EN+ES+ES+EruDd79WCSqatgl6+ES+E:Up725p725p727
TLSH
T1F0067D05FA8280B2F477117149AFD37A4A75B9214F268ADFE388833E5E337D0A935716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/540-61-0x0000000005190000-0x0000000005191000-memory.dmp

Download

memory/2660-27-0x0000000000570000-0x0000000000591000-memory.dmp

Download

memory/2660-37-0x0000000000570000-0x0000000000591000-memory.dmp

Download

memory/3056-0-0x0000000000530000-0x0000000000551000-memory.dmp

Download

memory/3056-8-0x0000000000530000-0x0000000000551000-memory.dmp

Download