e0ebf9b4279d749591bbc443ae4cf167f9b8037ebbf49ec01b13d1da2616f5cf

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/10/2026, 07:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-20_389cab93fb50ca484c20791e9d985e7f_elex_glassworm_stop_vidar.exe
Size 1.2MB
Sample261020-jpc46aa13q
SHA256 e0ebf9b4279d749591bbc443ae4cf167f9b8037ebbf49ec01b13d1da2616f5cf
MD5 389cab93fb50ca484c20791e9d985e7f
SHA1 9e661e1a50aa337c2c5ed85ad415e7db5a1ddd2f
SHA512 96dd30b9c9a19f98572b5bbaaddcd7131c0725b1693755026067ccd305f49e94bbdb41a14171c466621dcaa4cf801d261159bb06dde56be53a7940cdc297a650
SSDEEP 24576:m9+EM0B9+EM0q9+EM0q9+EM0p1afDd70iTWC7Exqatgl8bUQZ6:U+EN+ES+ES+EruDd79WCSqatglFG6
TLSH
T1FA456C01FA8180B2F477117149BFD37A5A75B9214F268ADFE388532E5E33BD0AA31716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2364	svchost_CBABAAAACABAACCCCBBCAAACCBAABAACAACCCBACBACCABCCBACCCAC.exe
2140	svchost_ACBACBBBAACABCCABACACACCACCCBBCBBCACACCCABACBCCBCCBCCCA.exe
1268	svchost_CBABAAAACABAACCCCBBCAAACCBAABAACAACCCBACBACCABCCBACCCAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBACAAACBCAACAAABABCCBCBBBAACBCBABACBBABBBCBCCABCCBACABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBACBBBAACABCCABACACACCACCCBBCBBCACACCCABACBCCBCCBCCCA.exe"	svchost_CBABAAAACABAACCCCBBCAAACCBAABAACAACCCBACBACCABCCBACCCAC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBAABBACCBCCCBBBBABCCBACAAAACBBABCBCBBACABBAABBACCABBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBABAAAACABAACCCCBBCAAACCBAABAACAACCCBACBACCABCCBACCCAC.exe"	2026-10-20_389cab93fb50ca484c20791e9d985e7f_elex_glassworm_stop_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4832	sc.exe
3396	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6064	cmd.exe
4776	cmd.exe
4104	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-20_389cab93fb50ca484c20791e9d985e7f_elex_glassworm_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBACBBBAACABCCABACACACCACCCBBCBBCACACCCABACBCCBCCBCCCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBABAAAACABAACCCCBBCAAACCBAABAACAACCCBACBACCABCCBACCCAC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6040	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3336	2026-10-20_389cab93fb50ca484c20791e9d985e7f_elex_glassworm_stop_vidar.exe
3336	2026-10-20_389cab93fb50ca484c20791e9d985e7f_elex_glassworm_stop_vidar.exe
3336	2026-10-20_389cab93fb50ca484c20791e9d985e7f_elex_glassworm_stop_vidar.exe
3336	2026-10-20_389cab93fb50ca484c20791e9d985e7f_elex_glassworm_stop_vidar.exe
2364	svchost_CBABAAAACABAACCCCBBCAAACCBAABAACAACCCBACBACCABCCBACCCAC.exe
2364	svchost_CBABAAAACABAACCCCBBCAAACCBAABAACAACCCBACBACCABCCBACCCAC.exe
2364	svchost_CBABAAAACABAACCCCBBCAAACCBAABAACAACCCBACBACCABCCBACCCAC.exe
2364	svchost_CBABAAAACABAACCCCBBCAAACCBAABAACAACCCBACBACCABCCBACCCAC.exe
2140	svchost_ACBACBBBAACABCCABACACACCACCCBBCBBCACACCCABACBCCBCCBCCCA.exe
2140	svchost_ACBACBBBAACABCCABACACACCACCCBBCBBCACACCCABACBCCBCCBCCCA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3336	2026-10-20_389cab93fb50ca484c20791e9d985e7f_elex_glassworm_stop_vidar.exe
Token: SeDebugPrivilege	2364	svchost_CBABAAAACABAACCCCBBCAAACCBAABAACAACCCBACBACCABCCBACCCAC.exe
Token: SeDebugPrivilege	2140	svchost_ACBACBBBAACABCCABACACACCACCCBBCBBCACACCCABACBCCBCCBCCCA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3336 wrote to memory of 6064	3336	2026-10-20_389cab93fb50ca484c20791e9d985e7f_elex_glassworm_stop_vidar.exe	91
PID 6064 wrote to memory of 6040	6064	cmd.exe	93
PID 2364 wrote to memory of 5384	2364	svchost_CBABAAAACABAACCCCBBCAAACCBAABAACAACCCBACBACCABCCBACCCAC.exe	94
PID 3336 wrote to memory of 4776	3336	2026-10-20_389cab93fb50ca484c20791e9d985e7f_elex_glassworm_stop_vidar.exe	97
PID 4776 wrote to memory of 4832	4776	cmd.exe	99
PID 3336 wrote to memory of 4104	3336	2026-10-20_389cab93fb50ca484c20791e9d985e7f_elex_glassworm_stop_vidar.exe	100
PID 4104 wrote to memory of 3396	4104	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-10-20_389cab93fb50ca484c20791e9d985e7f_elex_glassworm_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-20_389cab93fb50ca484c20791e9d985e7f_elex_glassworm_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3336
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCBBBCACAABCAAAABABBAABACACBABAACCACBCAACCCAAACBBCBCCACBABAAACCCACBCBCBBBCBABACBBBBAACAABBABBABCCCBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAAAACABAACCCCBBCAAACCBAABAACAACCCBACBACCABCCBACCCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6064
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCBBBCACAABCAAAABABBAABACACBABAACCACBCAACCCAAACBBCBCCACBABAAACCCACBCBCBBBCBABACBBBBAACAABBABBABCCCBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAAAACABAACCCCBBCAAACCBAABAACAACCCBACBACCABCCBACCCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6040
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBBCBACBACBABBABCCCCAABBAAACBACBCBAACCCCCCCCABBBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAAAACABAACCCCBBCAAACCBAABAACAACCCBACBACCABCCBACCCAC.exe" start= auto displayName= "UserDataSvc_CBBBCBACBACBABBABCCCCAABBAAACBACBCBAACCCCCCCCABBBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4776
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBBCBACBACBABBABCCCCAABBAAACBACBCBAACCCCCCCCABBBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAAAACABAACCCCBBCAAACCBAABAACAACCCBACBACCABCCBACCCAC.exe" start= auto displayName= "UserDataSvc_CBBBCBACBACBABBABCCCCAABBAAACBACBCBAACCCCCCCCABBBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4832
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBBCBACBACBABBABCCCCAABBAAACBACBCBAACCCCCCCCABBBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4104
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBBCBACBACBABBABCCCCAABBAAACBACBCBAACCCCCCCCABBBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3396

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAAAACABAACCCCBBCAAACCBAABAACAACCCBACBACCABCCBACCCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAAAACABAACCCCBBCAAACCBAABAACAACCCBACBACCABCCBACCCAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5384

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACBBBAACABCCABACACACCACCCBBCBBCACACCCABACBCCBCCBCCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACBBBAACABCCABACACACCACCCBBCBBCACACCCABACBCCBCCBCCCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2140

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAAAACABAACCCCBBCAAACCBAABAACAACCCBACBACCABCCBACCCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAAAACABAACCCCBBCAAACCBAABAACAACCCBACBACCABCCBACCCAC.exe
1⤵
- Executes dropped EXE
PID:1268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 655e7637d79d29fced26f172b9747b9c7526de1839e635251f56eca0c55b0efc
MD5 531398a6b192b57abbcdab14793c1933
SHA1 9beea8702bcffea47dfb26378b4fafbe3e679002
SHA512 e9e733493ce77f17432108815d4b5bb6aec60cc5e7a4f764bf123c9f62ddb973a1b08f87a39cac247e4b608132938a225ba93af5cbcd3ccb4ad78a85cecfc0b6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 48b5fa0b34a9cc1425455eefb46f7146346b887a0e265507e4671190668ca9a9
MD5 236004bcf2f05a1e6997502956d0f5ca
SHA1 a8f66ecdeda344c3fa6ecd5c8026bb541abf079f
SHA512 ae471fdbd91fd0b2bf79a8099586fa94a8a5a47105f655aa95df05cf0486d151ca40489eb2f3383399d1c2c2b67351d529da31492e41ac8d86db5c8609e40d78
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 73a906df72f678a3918adcb6b4e10521026c0f328c1ad0898490aada23157bc5
MD5 3dad089f87c7722ef43515236221a6b7
SHA1 3c4d3dbcc73fa64de6abf1bfe18dc3260fd8823b
SHA512 d41fb9cfc361d2709e4e345b63336161dcba97cfd8281d41a405e6beb5d01c42ecd2d242472c08f04f9510dacb066f5cd99a6e4069ceda7086973453f0acafc5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1e890206a8f8edf8aa7fb99227e09b652a11ce4cd2f14f628311415604243794
MD5 cf2d50f101d2c363a2b8eb9c3f068492
SHA1 e357ea878d1001f34b1813f018e0577b02857f7d
SHA512 67d0cc939886531c857271711572c35aab63867c5ad9af0178b3cb3238aa9d7b4276f7b068eda5c3f231d35836ef7c96c706831ffb8adcc0f3e8c945bd8dfe2f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1946f1b06bc58c4abbd69732e09da90871b9770262f6ad1a08eeb996936b2fff
MD5 c9f6e804532d67cc44269b48bbaea394
SHA1 128d7448a0b51d7abae7dfbfde81b54af767b998
SHA512 6113be2f9659f99d47caadfef7d09cb1808728ecced145478309d3b7faa858792c7b6ab5a6331951872aa16bae672617a5d5d601a7465683504f8301df254ff6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 61bc91143505cb3ff10d4a0ab8bdaa83dba1a03432315797c339fcaa81742248
MD5 8fa7d49a1334bb013e6f0ae96062b30b
SHA1 a136de8c312ba714c60a7fe6b82ffbde7b7f074d
SHA512 0f75bacb82f56d08f4ae5496415b495a03e90ae6c935954fc6098513149813352591faad4c38bf6e176a4fb95c3dcc844dfd43b5c5f06226c09f16a77fef0ae5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 9b72fc3998a359cfd0f3236dc18b7755b521a1fd955f8c6dbd2b5383e9cb55f1
MD5 e6754ec2dd4c134a9df1c946199a5230
SHA1 27f047e0c5fe7ef1c2e5a2217c11a6ae19ad8948
SHA512 41911b0ddca4d5394bf6db69cd39acefb0465c97241c7b7a822af3739cb948f2f4fe237780cdee77ddec146be92963e146ea7399d2a1b34336533ca6f67b2b4e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0e8445941c4130f9fe06b88f93f5d47a646fc8f7e0c04a8f685e7c9f63bdad0e
MD5 2ae7782b3f72cae0e1a934f199dde1d3
SHA1 be84c34ed5a1a4f6430f391429efed703a847f10
SHA512 6f4029c4ac14f05b48ca3c7265fcfb78bacfee041409c50e320e86c86b88590b0c781ab166ebcce48cf7a34f8ea278cd77e16bbdac1c593dd4026f8e1ddc1107
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 da26064ddaa537bb1bd21ff9da6a806b74637b6571362e0fa3d2e7883bc8dbca
MD5 b2cda66a9da7d23d5947a34ffa199462
SHA1 03f239b51926ef2a2bcd991ae919a5d92d0987ab
SHA512 f0fe4661ecd6dc23965b50804d63aa026439e56488fe9095cb7bcd170f1659d76627b67fc9b20eabd2074c427b53146598918b464d117f768844b0f1cb280576
MD5 SHA1 SHA512

Submit Download

svchost_CBABAAAACABAACCCCBBCAAACCBAABAACAACCCBACBACCABCCBACCCAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAAAACABAACCCCBBCAAACCBAABAACAACCCBACBACCABCCBACCCAC.exe
Size 1.2MB
SHA256 e0ebf9b4279d749591bbc443ae4cf167f9b8037ebbf49ec01b13d1da2616f5cf
MD5 389cab93fb50ca484c20791e9d985e7f
SHA1 9e661e1a50aa337c2c5ed85ad415e7db5a1ddd2f
SHA512 96dd30b9c9a19f98572b5bbaaddcd7131c0725b1693755026067ccd305f49e94bbdb41a14171c466621dcaa4cf801d261159bb06dde56be53a7940cdc297a650
SSDEEP 24576:m9+EM0B9+EM0q9+EM0q9+EM0p1afDd70iTWC7Exqatgl8bUQZ6:U+EN+ES+ES+EruDd79WCSqatglFG6
TLSH
T1FA456C01FA8180B2F477117149BFD37A5A75B9214F268ADFE388532E5E33BD0AA31716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 73ea37e508cb763a817c82f94f25a35f09f2487629f1170e84fe8343c655ad51
MD5 667a7a775eb208e4cbaa2fcf51856c7d
SHA1 f66bf1a80315cf8981b266e1bf906268916ebc14
SHA512 fda1d83affc0101f9786543d0e1409ab7074719c40afd3451c81e5299b328aa11caee487bfa8d9853c86f5b38c643ba8884aa2a68b82a16d58a1ae69e8dc90b6
TLSH
T17C119865E0E5DC17E62165CF013D9A8208F8377F6D986A99134C832C7719C37CD195E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2140-64-0x0000000000B20000-0x0000000000B41000-memory.dmp

Download

memory/2140-82-0x0000000000B20000-0x0000000000B41000-memory.dmp

Download

memory/2364-34-0x00000000008A0000-0x00000000008C1000-memory.dmp

Download

memory/3336-8-0x0000000000D80000-0x0000000000DA1000-memory.dmp

Download

memory/3336-0-0x0000000000D80000-0x0000000000DA1000-memory.dmp

Download