Analysis
- max time kernel
142s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
16/09/2026, 18:53
General
- Target 2026-09-16_9bc9f730f8e9ed4b8f0aea189108371b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_poet-rat_ryuk.exe
- Size 37.9MB
- Sample260916-xjsvbasyfx
- SHA256 05d1651bb0e2fc5a071ac347c988a2385fc725d9eaa4f527189f0afdf59e0d40
Malware Config
Signatures
- Downloads MZ/PE file 19 IoCs
- Executes dropped EXE 1 IoCs
- Enumerates system info in registry 2 TTPs 4 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-16_9bc9f730f8e9ed4b8f0aea189108371b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_poet-rat_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-16_9bc9f730f8e9ed4b8f0aea189108371b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_poet-rat_ryuk.exe"1⤵
- Downloads MZ/PE file
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\revival_launcher.exeC:\Users\Admin\AppData\Local\Temp\revival_launcher.exe2⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
0CA52F84AA22863CEDA8F675B44B34F9
8B2B9A00839EED1DFDCCC3BFC2F5DF12
B46811C17859FFB409CF0E904A4AA8F8
E79ACA28BF1B928826447D60186C1F1D
0CA52F84AA22863CEDA8F675B44B34F9
8B2B9A00839EED1DFDCCC3BFC2F5DF12
B46811C17859FFB409CF0E904A4AA8F8
E79ACA28BF1B928826447D60186C1F1D
2269da1129b1cc2d04ba8f904947ed9ce9e43a79.qmlc
39ec586142c26040122de6a7f062acb19b619eea.qmlc
409dfcae27e899a5023be3cd84e752caa2301ba6.qmlc
49ec827f853cbf34884ae43990c5d36c5e2d4a03.qmlc
935d09fbb09ec87fdae011d147a1d9c0d5f1a26f.qmlc
b24fa691a05346b204fc7e74619a49d60535fd1d.qmlc
c1558e5972531e069eb31f77cb266503181439d7.qmlc
c36ae9c3ab7f5cf04eb1200a362a142f0f6f2da4.qmlc
cff1d099fe3668a71b891c7a783c8a9261ac6222.qmlc
revival_launcher.exe
memory/4444-91-0x000001C3AE430000-0x000001C3AE431000-memory.dmp
memory/4444-99-0x000001C3C6E90000-0x000001C3C6E91000-memory.dmp
memory/4444-107-0x000001C3CC2D0000-0x000001C3CC2D2000-memory.dmp
memory/4444-102-0x000001C3C6E90000-0x000001C3C6E91000-memory.dmp
memory/4444-103-0x000001C3C6E90000-0x000001C3C6E91000-memory.dmp
memory/4444-104-0x000001C3C6E90000-0x000001C3C6E91000-memory.dmp
memory/4444-105-0x000001C3C6E90000-0x000001C3C6E91000-memory.dmp
memory/4444-93-0x000001C3AE430000-0x000001C3AE431000-memory.dmp
memory/4444-94-0x000001C3C6A00000-0x000001C3C6A01000-memory.dmp
memory/4444-95-0x000001C3C6A00000-0x000001C3C6A01000-memory.dmp
memory/4444-96-0x000001C3C6A00000-0x000001C3C6A01000-memory.dmp
memory/4444-97-0x000001C3C6A00000-0x000001C3C6A01000-memory.dmp
memory/4444-100-0x000001C3C6E90000-0x000001C3C6E91000-memory.dmp
memory/4444-101-0x000001C3C6E90000-0x000001C3C6E91000-memory.dmp
memory/4444-90-0x000001C3C6A00000-0x000001C3C6A01000-memory.dmp
memory/4444-89-0x000001C3AE430000-0x000001C3AE431000-memory.dmp
memory/4444-88-0x000001C3C6A00000-0x000001C3C6A01000-memory.dmp
memory/4444-86-0x000001C3AE430000-0x000001C3AE431000-memory.dmp
memory/4444-85-0x000001C3AE430000-0x000001C3AE431000-memory.dmp
memory/4444-84-0x000001C3AE430000-0x000001C3AE431000-memory.dmp
memory/4444-83-0x000001C3AE430000-0x000001C3AE431000-memory.dmp
memory/5200-36-0x00000295EE230000-0x00000295EE231000-memory.dmp
memory/5200-75-0x00000295D3B20000-0x00000295D3B30000-memory.dmp
memory/5200-24-0x00000295D5C10000-0x00000295D5C11000-memory.dmp
memory/5200-27-0x00000295D5C10000-0x00000295D5C11000-memory.dmp
memory/5200-32-0x00000295D5C10000-0x00000295D5C11000-memory.dmp
memory/5200-0-0x00000295D4A80000-0x00000295D4EC2000-memory.dmp
memory/5200-30-0x00000295D5C10000-0x00000295D5C11000-memory.dmp
memory/5200-35-0x00000295D5C10000-0x00000295D5C11000-memory.dmp
memory/5200-31-0x00000295EE230000-0x00000295EE231000-memory.dmp
memory/5200-29-0x00000295EE230000-0x00000295EE231000-memory.dmp
memory/5200-21-0x00000295D5C10000-0x00000295D5C11000-memory.dmp
memory/5200-22-0x00000295D5C10000-0x00000295D5C11000-memory.dmp
memory/5200-23-0x00000295D5C10000-0x00000295D5C11000-memory.dmp
memory/5200-43-0x00000295EE6C0000-0x00000295EE6C1000-memory.dmp
memory/5200-42-0x00000295EE6C0000-0x00000295EE6C1000-memory.dmp
memory/5200-41-0x00000295EE6C0000-0x00000295EE6C1000-memory.dmp
memory/5200-39-0x00000295EE230000-0x00000295EE231000-memory.dmp
memory/5200-38-0x00000295EE230000-0x00000295EE231000-memory.dmp
memory/5200-37-0x00000295EE230000-0x00000295EE231000-memory.dmp
memory/5200-54-0x00000295F2B00000-0x00000295F2B02000-memory.dmp
memory/5200-53-0x00000295F2B00000-0x00000295F2B02000-memory.dmp
memory/5200-4-0x00000295D3B20000-0x00000295D3B30000-memory.dmp
memory/5200-2-0x00000295D4ED0000-0x00000295D50D2000-memory.dmp