General
- Target dwagent.exe
- Size 1.9MB
- Sample260801-pej3lsvaqc
- SHA256 1216d7b68ca3e8789528ca359632eeaa43b6db5bd0ab7575006bac9dd5bcb9fb
- MD5 4837c4ac4957f870290991677363d3e8
- SHA1 c395669a8f000f1353b1290be1e071204fc915e4
- SHA512 2379ceb23225cfbf27024cee21cda050896ed6b2ad1298d53f006615409b147c31ec47fce82a3a7e9cb4e358b392ad4d41d7a629cfd6bdb64c3d56c06f6fc558
- SSDEEP 24576:h+emHOFp0jaxm+4neVbZRX+bYoP1rr5P6/OC27/sBhni8iOIy1UACCfinajPF+mf:chOFpfTiDuLBhifAqaLF0OO3nS7Kd8r
- TLSH T10F957D98EF8754F5FD6398B1828BF37F473066118425EFB3EF4A6946F833612211924A
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dwagent.exe
Resource
win10ltsc2021-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
dwagent.exe
Resource
win11ltsc2024-20260709-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target dwagent.exe
- Size 1.9MB
- SHA256 1216d7b68ca3e8789528ca359632eeaa43b6db5bd0ab7575006bac9dd5bcb9fb
- MD5 4837c4ac4957f870290991677363d3e8
- SHA1 c395669a8f000f1353b1290be1e071204fc915e4
- SHA512 2379ceb23225cfbf27024cee21cda050896ed6b2ad1298d53f006615409b147c31ec47fce82a3a7e9cb4e358b392ad4d41d7a629cfd6bdb64c3d56c06f6fc558
- SSDEEP 24576:h+emHOFp0jaxm+4neVbZRX+bYoP1rr5P6/OC27/sBhni8iOIy1UACCfinajPF+mf:chOFpfTiDuLBhifAqaLF0OO3nS7Kd8r
- TLSH T10F957D98EF8754F5FD6398B1828BF37F473066118425EFB3EF4A6946F833612211924A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops file in System32 directory