bba2d6bfae4be91d6ad87d5ab7791ec443d2b0f07515247d451341fce7eaab40

Resubmissions

31/03/2025, 18:00

31/03/2025, 17:58

28/03/2025, 19:30

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/03/2025, 19:30

Target

Grabberhydra.exe
Size

9.4MB
MD5

1a0e1a239d2d4f4d9f9e2f968eed9f27
SHA1

6e1da96ce51570a3f158500390d1148f2cbc2f77
SHA256

0f3b73e169942ba5ed7d17ad2965f821b8939fe23b6422a1284982b72db2fff8
SHA512

7c48f6ec212b74aa5502cbc612932d56dd02ab9ecbabf9f0c090840e12180a09c31f8d46377157a23c39f568a5f52fba986b1cee0b614191b2a1cc39a11ddc77
SSDEEP

196608:2W2cxg3+cemXyuSyTde8BRHvUWvofhxjno/w3iFCxHQbRpXDugkn:n2N3GtByxjBRHdAxro/w3uCxHQbzu3n

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2696	Grabberhydra.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001a4ab-46.dat	upx
behavioral1/memory/2696-48-0x000007FEF6690000-0x000007FEF6AF5000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2696	2340	Grabberhydra.exe	30
PID 2340 wrote to memory of 2696	2340	Grabberhydra.exe	30
PID 2340 wrote to memory of 2696	2340	Grabberhydra.exe	30

C:\Users\Admin\AppData\Local\Temp\Grabberhydra.exe
"C:\Users\Admin\AppData\Local\Temp\Grabberhydra.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Users\Admin\AppData\Local\Temp\Grabberhydra.exe
  "C:\Users\Admin\AppData\Local\Temp\Grabberhydra.exe"
  2⤵
  - Loads dropped DLL
  PID:2696

C:\Users\Admin\AppData\Local\Temp\_MEI23402\python310.dll

Filesize
1.4MB

MD5
90d5b8ba675bbb23f01048712813c746

SHA1
f2906160f9fc2fa719fea7d37e145156742ea8a7

SHA256
3a7d497d779ff13082835834a1512b0c11185dd499ab86be830858e7f8aaeb3e

SHA512
872c2bf56c3fe180d9b4fb835a92e1dc188822e9d9183aab34b305408bb82fba1ead04711e8ad2bef1534e86cd49f2445d728851206d7899c1a7a83e5a62058e

Download Submit
memory/2696-48-0x000007FEF6690000-0x000007FEF6AF5000-memory.dmp

Filesize
4.4MB

Download