Static task
static1
Behavioral task
behavioral1
Sample
078SithLM.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
078SithLM.exe
Resource
win10v2004-20230220-en
General
-
Target
078SithLM.exe
-
Size
565KB
-
MD5
9ef3a78e9f39dea38110576f79e2085e
-
SHA1
7bf96d5a9a11cfa18f3341cfc5290fd7577cdaf9
-
SHA256
299e002db099d77db93d3d0d5aac42f666a95c30077090d26eb84a1b6de72480
-
SHA512
f36fa675c2bb837904153e4cc3481ef110dbfdb78f69af54f750a3e5d1e2329c91872a40b3ee75c0ef35fa434a50d7a824118c7dcf7f6ad22fda2117220657d9
-
SSDEEP
12288:0WxhW1CGbjz0hTwfvY2CHNskW7KWsJV6YwdZ4v9:0CC0t+vY2CmkW7KBJQYYZc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 078SithLM.exe
Files
-
078SithLM.exe.exe windows x86
84e4b934930a4a3de022531392bdce11
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
comctl32
ord17
ImageList_SetBkColor
ImageList_ReplaceIcon
ImageList_Create
kernel32
WideCharToMultiByte
MultiByteToWideChar
GetDriveTypeW
GetLogicalDriveStringsW
GetVersionExW
SetErrorMode
LocalFree
LocalAlloc
HeapAlloc
RtlUnwind
GetCurrentProcess
FindResourceW
LoadResource
lstrlenW
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
GetTimeZoneInformation
ReadFile
GetProcessHeap
SetEndOfFile
CreateFileA
LoadLibraryA
InterlockedExchange
FreeLibrary
SetConsoleCtrlHandler
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
LCMapStringA
InitializeCriticalSectionAndSpinCount
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SizeofResource
FlushFileBuffers
SetStdHandle
GetSystemTimeAsFileTime
GetDiskFreeSpaceW
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
LCMapStringW
GetModuleHandleA
HeapSize
GetModuleFileNameA
ExitProcess
Sleep
GetFileType
GetStdHandle
SetHandleCount
VirtualAlloc
VirtualFree
HeapDestroy
HeapCreate
FatalAppExitA
GetCurrentThread
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetConsoleMode
GetConsoleCP
WriteFile
GetStartupInfoA
GetCommandLineA
CreateThread
ResumeThread
ExitThread
HeapFree
RaiseException
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
LockResource
DeviceIoControl
FindNextFileW
CreateFileW
InterlockedDecrement
FormatMessageW
GetLastError
FindFirstFileW
FindClose
LoadLibraryW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
InterlockedIncrement
GetModuleFileNameW
GetFileAttributesW
ExpandEnvironmentStringsW
GetCommandLineW
CreateProcessW
DeleteFileW
GetExitCodeProcess
WaitForSingleObject
CloseHandle
GetModuleHandleW
GetCurrentProcessId
GetProcAddress
SetFilePointer
HeapReAlloc
user32
SendMessageW
ShowWindow
CreatePopupMenu
InsertMenuItemW
GetCursorPos
TrackPopupMenu
LoadImageW
DialogBoxIndirectParamW
SetWindowTextW
SetCursor
InflateRect
LoadIconW
LoadAcceleratorsW
GetMessageW
TranslateAcceleratorW
TranslateMessage
IsDialogMessageW
DispatchMessageW
PostQuitMessage
CheckDlgButton
CreateDialogParamW
GetMenu
CheckMenuItem
GetDlgItemTextW
DialogBoxParamW
LoadCursorW
RegisterClassExW
CreateWindowExW
CallWindowProcW
IsZoomed
PtInRect
DrawFrameControl
GetWindowTextW
GetSysColorBrush
SetWindowLongW
ChildWindowFromPoint
SetCapture
ReleaseCapture
EnableWindow
SetTimer
KillTimer
SetForegroundWindow
DestroyWindow
SetFocus
GetDlgItemInt
SetDlgItemInt
SetDlgItemTextW
GetScrollInfo
IsWindowEnabled
DrawTextW
SetScrollInfo
GetFocus
DrawFocusRect
ScrollWindowEx
UpdateWindow
DefWindowProcW
BeginPaint
GetDlgItem
MapWindowPoints
FillRect
EndPaint
EndDialog
SetPropW
GetPropW
BeginDeferWindowPos
EnumChildWindows
EndDeferWindowPos
GetClientRect
GetSystemMetrics
UnionRect
GetParent
GetClassNameW
GetWindowLongW
InvalidateRect
DeferWindowPos
GetWindowRect
ScreenToClient
GetSysColor
OffsetRect
GetDC
ReleaseDC
MessageBoxW
gdi32
SetMapMode
StartDocW
StartPage
EndPage
EndDoc
GetObjectW
CreateFontIndirectW
GetStockObject
PolyPolygon
SetTextColor
SetBkColor
SetBkMode
CreateCompatibleBitmap
BitBlt
CreateDIBSection
CreateCompatibleDC
SelectObject
DeleteDC
DeleteObject
CreateSolidBrush
GetDeviceCaps
comdlg32
GetOpenFileNameW
GetSaveFileNameW
PrintDlgW
advapi32
RegCloseKey
RegCreateKeyW
RegQueryValueExW
RegSetValueExW
shell32
CommandLineToArgvW
ShellExecuteW
ole32
CreateBindCtx
oleaut32
VariantChangeType
VariantClear
VariantInit
SetErrorInfo
GetErrorInfo
CreateErrorInfo
SysAllocStringByteLen
SysAllocString
SysStringLen
SysFreeString
Sections
.text Size: 201KB - Virtual size: 201KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 322KB - Virtual size: 322KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ