j �aK���wJ�u� ���d���!)H^.�֗� Mi���)Fe �FY#H�rnf��?���L���2g�{)��e7�@n�-2�L��-N�擱,6y�5���F�zUO�s<��;(5����N��}]����?���[��s8����b�鿝����Ms���a`4�V���!�Q�adP�U_q����E`�8nx��!�T=j���������]!}Jp��r�Da ��������}�Ԅ�B������-2}�(V�e1�QC��)��[N�̃_[�>�����!�4�Z�4�=*I>_�켹Yk��iҰ�:>Ι�_W�'�wB���+y�հLj�n^RT(�7}�r�K@�m����m��*�'�Ҵu�wir���?����������*͜�B��rx����`\f|��B�k�\�8��9� �7}ʋ~�a�|w�hP���L ��^Sd�S9���ǩ�ݓr6i��~�b|�\修QP��X�]]E�@����q�p@>$�ʼq�b�y���@��m}�(� H{l�Q���0r�@%�����'6~sZ {��@lo[��R�a��xc��&/�eI�|�{��˕״䧢hB��B *\.�{���Us����=��Ӄ��1B������7��d��ݑ8He�^��?�4�����Ϸ!��o�"�-Xs��)L�3+�����5����b��XDY����_"���l�XV@�x�r��ռ�z�mH����7h�5<�Z���Q�x$4#��t���,�ڤ\�s�����s��x���JѴ���"��[6��Wzg�!sAUq���j��t;{�zC�(3e�8�����@ʴ��$n��P���Ҷ[y�m���6�,�R��&�Z��o��!�H�|<�~[��̧zY���k2��ic>�4��a%α����0���0V���Y��z���2��z"RY�1'"}��5Q3?J6��x��Jx���6�]�o��J|��;`oE$�Z}��"8x����vw��hյV���]���^�b���P�DNn�'Jbn������X�@���d�^B��Y؈�D7i��n�{��U������&�X3L����/���y%t'��I3N�QJ�m�@t�99,�f%��r�^ѧb%L�HV�T�a+������Cã�f�J\q{;3�ѧ�S�Z�D������M��煡�ѭ9��+G��ۏ�tzk�:siDb;z"|$?�U� +r��a���D��h�=[6Tf�[�le��Fr�R���X#��؛>U��=���w��`i�F�.b�I�!>����`Q����tSW%80����V,E�%�"����f.�C�0د�x�B1��}���(=�C3�MS8MX�� �U��<;�{�����lm�V��n^��9��u�7��L�o��ٚ���F�dV���i�a�'�Ɍ��d�3�݆^-�ec�9���;��ʵ8�LB9��e�ҕu��/r3�*���7*gMd^�����7qjn#��z�K�6� P�誋}#�30S�^@^wݠ�\S��68��8SJ��b�2�/������l��"٘��S�/��Mݬ�a?SsoO��EI\�-D,0k#A��S�)B��l*���49,y\����O�]$��p���D���+h��{�0��^7�(�P�0"@�xdk��:Q�ӷ g���*� /x�Ib,�h��@K@_�p�b�Y��]?����P� ek�VS�D�����<�Ӑ5�&�=:�3��p��<����$ë�W�Q�m���f��X������!ο���]�(�(�vQ����@�(q��L|`7��2��?���L��Β�N�]�A��(��LT�8<˄*�Ǩנ��dN��sl �x����q|Ư7Mi�"4_H�vz�%���jI2DkRev<�[D��')~ �B~ ��H���<�j�,���t1�?j)dW5M=�"��������n7��($9rbuM�����{���`bM�w^�g?�!���x�3N���Fe����XX��N����A7MdSl#��[..us8?<���`���3�rS�����u%��H�����ރ�'j��!-��-�}��avY�3�Xp��b��IǾ�f�u6+n����M������~$�D����b��Zjv�-tx�`Zֆ��n�����]=�?�B5��H�P4�ut�w��>fH�G^P`�mQ1���ȶ��g�8Р0�2li�Ւ��ݫ:B �ɑ,Sw�s]Ƚփ��¿Wr���� � ݼV�%���y�n?P�2hf_9�c� .�҉ s#��ᓍ�1<ۆ8�=cI@�&�J���g��.lt\�b�JB�p//2e���HA��&�Q�2~M��d�����&�\�[8�ti@h<�Fp�e���0�=F�τ<��V�aN��ƶ"��*`0�d��]���C�҈�N����l�O�3���`���#,aH?�T��E���"��w����6�������jO���D����c(:o�9���ʏ�?W4ӘO �Bl��L;��Nn��]�$�w��`����_��1nn�^I d��O�u�Z��c9��Wr3;l�1�$�뼚E����Uw���d��%����^��PYM�����yl%6ĸ �}�����)X����O4y�� 4!s�ϊv�\��ـ�@!:�@tE�r 8�<ַ�h�9�"A�C(�����C�G�����4\Q�_u�-x��u������(C����c��cp%��t��"X�E�=s2�[�������x?��ۖ�ò�9�=�L �6�0�!�L�-3G���s�J�Io���H��YX�Kk�T@�HA����K��ڧu�DP�g���@���a��ljKD��<nZαe1�2Y(t� ���9�H������ ���H_r������h������~�AG��$��S��m@�ԩ,K�{Ѐ[f+Oh2�B7���"��N�?X�B�4����#8?�$�}c�9�4M��//���I�i^>�^�Ҵ@ۤ��i^��W��9����gZ\6�j=��Ԉ: [%��f*����W�y4�qq/Z%E��r~o_Ƞh��b~��b& ����A�D�R�%��j��*:
Static task
static1
Behavioral task
behavioral1
Sample
DotWareFN.exe
Resource
win10v2004-20240802-en
General
-
Target
DotWareFN.exe
-
Size
8.2MB
-
MD5
7c3ada006e972dbd31d49c66bce948d5
-
SHA1
32cfface49feaf0dd3c11520b038dc6c6d52d64b
-
SHA256
cee4081e54525bcb4315e54794c3e4fb5cadc4b363e4c5e471029fcbb0627776
-
SHA512
e324b8bab0744743de262f3eaf732895e226ca39114f09ddad5aa393eb349be1316bb1c061449bcbcb08eff7d8d6c1576a7c9b0d744f5fdff8d7fa4aaa394cdb
-
SSDEEP
196608:IgPwIp9XgEK2XqjpeL27nQ2j+wBU+vyqLsqTn2sVLhWdF5TzFQ:xPVp9XgReqjpa0QwzBkgsq72AL0pB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource DotWareFN.exe
Files
-
DotWareFN.exe.exe windows:6 windows x64 arch:x64
5ee1e926cf0c7a8d6f6df6ed3efe1dc4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
listen
wldap32
ord26
crypt32
CertGetCertificateContextProperty
advapi32
CryptAcquireContextA
ntdll
RtlCreateRegistryKey
kernel32
WaitForMultipleObjects
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DispatchMessageA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
shlwapi
SHDeleteKeyW
msvcp140
_Xtime_get_ticks
userenv
UnloadUserProfile
d3d11
D3D11CreateDeviceAndSwapChain
imm32
ImmSetCompositionWindow
d3dcompiler_47
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
bcrypt
BCryptGenRandom
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memmove
api-ms-win-crt-runtime-l1-1-0
_cexit
api-ms-win-crt-stdio-l1-1-0
fgetc
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-string-l1-1-0
_strnicmp
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-math-l1-1-0
_dclass
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 780KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.dot0 Size: - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vlizer Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.dot1 Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.dot2 Size: 8.2MB - Virtual size: 8.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ