dwagent[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

dwagent.exe
Size

13.4MB
MD5

c5dd9f933fa61419e0a528a47e518ff6
SHA1

c3c03874588d19df4a1652b829dc82b088b69bba
SHA256

fb6058303a2c97f2ed84f44436efbd94df29b1f3b61d639c93ec0b005ed675e8
SHA512

63de21f0f410f8f26528640ee2706124ec7687091cc236c7b83f2140362357d893a42b380fdb30f4f1bad30dd2771c2bbf6ba654ed7966a5d62893b5693d0c51
SSDEEP

393216:EqSBp3r7vCViriwSCUa9iXRq+sozptgfBgPJ3O6:KBpr7vCVU7zUZ+oltgWp

Score

1^/10

Malware Config

Signatures

Files

dwagent.exe
.exe windows:4 windows x86 arch:x86

5b43c6ba7f7073e19a5848932ff96076

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

af:bd:d3:be:b2:4e:1d:e7:37:82:e9:f8:34:7c:f1:53
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

08/05/2023, 00:00

Not After

07/08/2026, 23:59

Subject

CN=DWSNET srl,O=DWSNET srl,ST=Napoli,C=IT

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

af:bd:d3:be:b2:4e:1d:e7:37:82:e9:f8:34:7c:f1:53
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

08/05/2023, 00:00

Not After

07/08/2026, 23:59

Subject

CN=DWSNET srl,O=DWSNET srl,ST=Napoli,C=IT

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ba:da:5d:77:c2:d4:a2:bb:a0:f7:a4:8f:8e:2f:75:1d:86:9e:54:2b:2e:c5:3b:f8:3d:a2:be:c4:d7:d4:17:5c
Signer

Actual PE Digest

ba:da:5d:77:c2:d4:a2:bb:a0:f7:a4:8f:8e:2f:75:1d:86:9e:54:2b:2e:c5:3b:f8:3d:a2:be:c4:d7:d4:17:5c

Digest Algorithm

sha256

PE Digest Matches

true

f5:a0:10:f9:3d:ab:87:04:ec:a0:61:24:5e:a5:ae:53:23:e6:90:7c
Signer

Actual PE Digest

f5:a0:10:f9:3d:ab:87:04:ec:a0:61:24:5e:a5:ae:53:23:e6:90:7c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

AllocateAndInitializeSid
CheckTokenMembership
CreateWellKnownSid
DuplicateToken
FreeSid
GetTokenInformation
OpenProcessToken

gdi32

BitBlt
CreateCompatibleDC
CreateFontA
CreatePen
CreateRectRgn
CreateSolidBrush
DeleteDC
DeleteObject
Ellipse
GetObjectA
GetStockObject
GetTextMetricsA
LineTo
MoveToEx
SelectClipRgn
SelectObject
SetBkMode
SetDCBrushColor
SetTextColor

kernel32

CloseHandle
CopyFileW
CreateDirectoryW
CreateEventA
CreateFileA
CreateFileW
CreateSemaphoreA
CreateSemaphoreW
CreateThread
DeleteCriticalSection
DeleteFileW
EnterCriticalSection
FindClose
FindFirstFileW
FindNextFileW
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetFileAttributesW
GetFileSize
GetLastError
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
GetStartupInfoW
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetTempPathW
GetTickCount
GetVersionExA
GlobalAlloc
GlobalLock
GlobalUnlock
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
LoadLibraryExW
MoveFileExW
MultiByteToWideChar
OpenProcess
QueryPerformanceCounter
ReadFile
ReleaseSemaphore
RemoveDirectoryW
ResetEvent
SetCurrentDirectoryW
SetEnvironmentVariableW
SetEvent
SetFileAttributesW
SetFilePointer
SetLastError
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForSingleObject
WriteFile
lstrcatW
lstrlenW

msvcrt

__lconv_init
__p__fmode
__p__wcmdln
__set_app_type
__setusermatherr
__wgetmainargs
__winitenv
_amsg_exit
_beginthreadex
_cexit
_initterm
_iob
_onexit
_write
abort
calloc
exit
fopen
fprintf
fputc
fputs
free
gmtime
fwrite
malloc
memchr
memcmp
memcpy
memmove
memset
realloc
signal
sprintf
strcmp
strlen
strncmp
strtoul
time
tolower
vfprintf
wcscat
wcscmp
wcscpy
wcsftime
wcslen

shell32

ShellExecuteExW
Shell_NotifyIconW

user32

BeginPaint
CloseClipboard
CreateWindowExW
DefWindowProcA
DefWindowProcW
DestroyIcon
DestroyWindow
DispatchMessageW
DrawTextExW
EmptyClipboard
EndPaint
FillRect
GetClientRect
GetClipboardData
GetCursorPos
GetDC
GetKeyState
GetMessageW
GetSystemMetrics
GetWindowRect
InvalidateRect
IsWindowUnicode
KillTimer
LoadCursorA
LoadImageW
MessageBoxW
OpenClipboard
PostMessageW
PostQuitMessage
RegisterClassExW
SetClipboardData
SetForegroundWindow
SetTimer
SetWindowPos
SetWindowTextW
ShowWindow
TranslateMessage
UnregisterClassW
UpdateWindow
wsprintfW

Sections

.text
Size: 284KB - Virtual size: 284KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 172B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 25KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

5b43c6ba7f7073e19a5848932ff96076

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

af:bd:d3:be:b2:4e:1d:e7:37:82:e9:f8:34:7c:f1:53Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

af:bd:d3:be:b2:4e:1d:e7:37:82:e9:f8:34:7c:f1:53Certificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

ba:da:5d:77:c2:d4:a2:bb:a0:f7:a4:8f:8e:2f:75:1d:86:9e:54:2b:2e:c5:3b:f8:3d:a2:be:c4:d7:d4:17:5cSigner

f5:a0:10:f9:3d:ab:87:04:ec:a0:61:24:5e:a5:ae:53:23:e6:90:7cSigner

Headers

File Characteristics

Imports

advapi32

gdi32

kernel32

msvcrt

shell32

user32

Sections

.text Size: 284KB - Virtual size: 284KB

.data Size: 512B - Virtual size: 172B

.rdata Size: 17KB - Virtual size: 16KB

.bss Size: - Virtual size: 25KB

.idata Size: 5KB - Virtual size: 5KB

.CRT Size: 512B - Virtual size: 52B

.tls Size: 512B - Virtual size: 8B

.rsrc Size: 38KB - Virtual size: 38KB

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

af:bd:d3:be:b2:4e:1d:e7:37:82:e9:f8:34:7c:f1:53
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

af:bd:d3:be:b2:4e:1d:e7:37:82:e9:f8:34:7c:f1:53
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

ba:da:5d:77:c2:d4:a2:bb:a0:f7:a4:8f:8e:2f:75:1d:86:9e:54:2b:2e:c5:3b:f8:3d:a2:be:c4:d7:d4:17:5c
Signer

f5:a0:10:f9:3d:ab:87:04:ec:a0:61:24:5e:a5:ae:53:23:e6:90:7c
Signer

.text
Size: 284KB - Virtual size: 284KB

.data
Size: 512B - Virtual size: 172B

.rdata
Size: 17KB - Virtual size: 16KB

.bss
Size: - Virtual size: 25KB

.idata
Size: 5KB - Virtual size: 5KB

.CRT
Size: 512B - Virtual size: 52B

.tls
Size: 512B - Virtual size: 8B

.rsrc
Size: 38KB - Virtual size: 38KB