Analysis
- max time kernel
150s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
16/09/2026, 18:53
General
- Target 2026-09-16_9bc9f730f8e9ed4b8f0aea189108371b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_poet-rat_ryuk.exe
- Size 37.9MB
- Sample260916-xjsvbasyfx
- SHA256 05d1651bb0e2fc5a071ac347c988a2385fc725d9eaa4f527189f0afdf59e0d40
Malware Config
Signatures
- Downloads MZ/PE file 19 IoCs
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Enumerates system info in registry 2 TTPs 4 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-16_9bc9f730f8e9ed4b8f0aea189108371b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_poet-rat_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-16_9bc9f730f8e9ed4b8f0aea189108371b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_poet-rat_ryuk.exe"1⤵
- Downloads MZ/PE file
- Checks computer location settings
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\revival_launcher.exeC:\Users\Admin\AppData\Local\Temp\revival_launcher.exe2⤵
- Downloads MZ/PE file
- Checks computer location settings
- Executes dropped EXE
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
0CA52F84AA22863CEDA8F675B44B34F9
8B2B9A00839EED1DFDCCC3BFC2F5DF12
B46811C17859FFB409CF0E904A4AA8F8
E79ACA28BF1B928826447D60186C1F1D
0CA52F84AA22863CEDA8F675B44B34F9
8B2B9A00839EED1DFDCCC3BFC2F5DF12
B46811C17859FFB409CF0E904A4AA8F8
E79ACA28BF1B928826447D60186C1F1D
2269da1129b1cc2d04ba8f904947ed9ce9e43a79.qmlc
39ec586142c26040122de6a7f062acb19b619eea.qmlc
409dfcae27e899a5023be3cd84e752caa2301ba6.qmlc
49ec827f853cbf34884ae43990c5d36c5e2d4a03.qmlc
935d09fbb09ec87fdae011d147a1d9c0d5f1a26f.qmlc
b24fa691a05346b204fc7e74619a49d60535fd1d.qmlc
c1558e5972531e069eb31f77cb266503181439d7.qmlc
c36ae9c3ab7f5cf04eb1200a362a142f0f6f2da4.qmlc
cff1d099fe3668a71b891c7a783c8a9261ac6222.qmlc
revival_launcher.exe
memory/2216-88-0x0000013944310000-0x0000013944311000-memory.dmp
memory/2216-95-0x00000139308E0000-0x00000139308E1000-memory.dmp
memory/2216-436-0x0000013948320000-0x0000013948322000-memory.dmp
memory/2216-437-0x0000013948320000-0x0000013948322000-memory.dmp
memory/2216-107-0x0000013948320000-0x0000013948322000-memory.dmp
memory/2216-102-0x00000139308E0000-0x00000139308E1000-memory.dmp
memory/2216-103-0x00000139308E0000-0x00000139308E1000-memory.dmp
memory/2216-104-0x00000139308E0000-0x00000139308E1000-memory.dmp
memory/2216-105-0x00000139308E0000-0x00000139308E1000-memory.dmp
memory/2216-87-0x000001392D000000-0x000001392D001000-memory.dmp
memory/2216-89-0x0000013944310000-0x0000013944311000-memory.dmp
memory/2216-90-0x0000013944310000-0x0000013944311000-memory.dmp
memory/2216-91-0x0000013944310000-0x0000013944311000-memory.dmp
memory/2216-93-0x00000139308E0000-0x00000139308E1000-memory.dmp
memory/2216-77-0x000001392D000000-0x000001392D001000-memory.dmp
memory/2216-78-0x000001392D000000-0x000001392D001000-memory.dmp
memory/2216-79-0x000001392D000000-0x000001392D001000-memory.dmp
memory/2216-82-0x0000013944310000-0x0000013944311000-memory.dmp
memory/2216-80-0x000001392D000000-0x000001392D001000-memory.dmp
memory/2216-84-0x0000013944310000-0x0000013944311000-memory.dmp
memory/2216-85-0x000001392D000000-0x000001392D001000-memory.dmp
memory/2216-83-0x000001392D000000-0x000001392D001000-memory.dmp
memory/2216-94-0x00000139308E0000-0x00000139308E1000-memory.dmp
memory/4720-40-0x000001997FC90000-0x000001997FC91000-memory.dmp
memory/4720-23-0x0000019967880000-0x0000019967881000-memory.dmp
memory/4720-75-0x0000019967830000-0x0000019967840000-memory.dmp
memory/4720-44-0x0000019967880000-0x0000019967881000-memory.dmp
memory/4720-41-0x0000019967880000-0x0000019967881000-memory.dmp
memory/4720-45-0x000001997FC90000-0x000001997FC91000-memory.dmp
memory/4720-2-0x0000019968050000-0x0000019968252000-memory.dmp
memory/4720-52-0x0000019900510000-0x0000019900511000-memory.dmp
memory/4720-36-0x0000019967880000-0x0000019967881000-memory.dmp
memory/4720-38-0x000001997FC90000-0x000001997FC91000-memory.dmp
memory/4720-22-0x0000019967880000-0x0000019967881000-memory.dmp
memory/4720-39-0x0000019967880000-0x0000019967881000-memory.dmp
memory/4720-24-0x0000019967880000-0x0000019967881000-memory.dmp
memory/4720-21-0x0000019967880000-0x0000019967881000-memory.dmp
memory/4720-51-0x0000019900510000-0x0000019900511000-memory.dmp
memory/4720-50-0x0000019900510000-0x0000019900511000-memory.dmp
memory/4720-48-0x000001997FC90000-0x000001997FC91000-memory.dmp
memory/4720-47-0x000001997FC90000-0x000001997FC91000-memory.dmp
memory/4720-46-0x000001997FC90000-0x000001997FC91000-memory.dmp
memory/4720-20-0x0000019967830000-0x0000019967840000-memory.dmp
memory/4720-0-0x0000019967C00000-0x0000019968042000-memory.dmp
memory/4720-53-0x00000199046E0000-0x00000199046E2000-memory.dmp
memory/4720-54-0x00000199046E0000-0x00000199046E2000-memory.dmp