Overview
overview
7Static
static
3PetHack2.5...I2.dll
windows7-x64
1PetHack2.5...I2.dll
windows10-2004-x64
1PetHack2.5...2.5.py
windows7-x64
3PetHack2.5...2.5.py
windows10-2004-x64
3PetHack2.5...or.exe
windows7-x64
7PetHack2.5...or.exe
windows10-2004-x64
7PetHack2.5...ox.dll
windows7-x64
1PetHack2.5...ox.dll
windows10-2004-x64
1Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/01/2025, 12:23
Behavioral task
behavioral1
Sample
PetHack2.5/Guna.UI2.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
PetHack2.5/Guna.UI2.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
PetHack2.5/PetHack2.5.py
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
PetHack2.5/PetHack2.5.py
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
PetHack2.5/injector.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
PetHack2.5/injector.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
PetHack2.5/luaroblox.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
PetHack2.5/luaroblox.dll
Resource
win10v2004-20241007-en
General
-
Target
PetHack2.5/PetHack2.5.py
-
Size
7KB
-
MD5
b35d28dbd8259704c32a390614f54d62
-
SHA1
c373fcb64d88d3656fdc26be6db46aca905d062a
-
SHA256
c8655d26f4746ca06725fea37c41567ab1afe076d07cd72cefc6663244a1334a
-
SHA512
f063f7c3295bfb1c6aa0dfd2484991535c785893ce9950e01fde5101b57398580ba822196bef2664f5a519c3e1de45f944b4218f682a601ec463cdf14bc28581
-
SSDEEP
96:HA2yyb3/+brN/W2rtFy1F0CQa/jWP0Q9wbqdsd/dH0qJ:/pb3/+brNOeFy1Fka/KV9CVd90qJ
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2820 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2648 wrote to memory of 2820 2648 cmd.exe 31 PID 2648 wrote to memory of 2820 2648 cmd.exe 31 PID 2648 wrote to memory of 2820 2648 cmd.exe 31
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\PetHack2.5\PetHack2.5.py1⤵
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\PetHack2.5\PetHack2.5.py2⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:2820
-