Watchman[.]exe | Triage™

Resubmissions

30/10/2026, 01:37

261030-b1yk8sgv5v6

30/10/2026, 01:20

261030-bqb99ada236

Sharing

Copy URL Twitter E-mail

General

Target
Watchman.exe
Size 5.5MB
Sample261030-bqb99ada23
SHA256 002ab74c4e96566918960354813dd595e7a2cb35e5a10a586b941e62b387cab1
MD5 466260174ca4449959bdcb08b96e7ba6
SHA1 27dfaacefb58a527031cf300f49c11a0ca3e8fca
SHA512 acef2f35f1f4f21338d496402083fc231dcb05890b10191b0a0299d7302aa4578ee804c33edd9a67082a67a09cbb31aa6c081c210dedb57de8f7bade20a86256
SSDEEP 49152:8bko45dCk9EUn2XuUDTZRTUbHjpZK5kAECgH6y7PfQ6neDaNVvm+y:8pqcjUba5kAECgH6y7PfQ6neDyVvm/
TLSH
T10546BF03F755C39DD5134E3486A297A2A372BC612F26C3CB24947A29DE931E40EBB3D5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Watchman.exe

File Explorer

Watchman.exe

.exe 5.5MB

Watchman.exe

IMPHASH 0efb29dceba9d5264b4373cb62afbe1c
SHA256 002ab74c4e96566918960354813dd595e7a2cb35e5a10a586b941e62b387cab1
MD5 466260174ca4449959bdcb08b96e7ba6
SHA1 27dfaacefb58a527031cf300f49c11a0ca3e8fca
SHA512 acef2f35f1f4f21338d496402083fc231dcb05890b10191b0a0299d7302aa4578ee804c33edd9a67082a67a09cbb31aa6c081c210dedb57de8f7bade20a86256
SSDEEP 49152:8bko45dCk9EUn2XuUDTZRTUbHjpZK5kAECgH6y7PfQ6neDaNVvm+y:8pqcjUba5kAECgH6y7PfQ6neDyVvm/
TLSH
T10546BF03F755C39DD5134E3486A297A2A372BC612F26C3CB24947A29DE931E40EBB3D5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1392496

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d2d1

ord1

dwrite

DWriteCreateFactory

dwmapi

DwmDefWindowProc DwmSetWindowAttribute

iphlpapi

IcmpSendEcho IcmpCloseHandle IcmpCreateFile GetBestRoute2 ConvertInterfaceLuidToAlias GetExtendedUdpTable GetExtendedTcpTable ConvertLengthToIpv4Mask FreeMibTable GetIfTable2 GetIfEntry2 GetAdaptersAddresses GetBestInterface GetIpAddrTable

ws2_32

FreeAddrInfoW GetAddrInfoW InetNtopW WSAStartup WSACleanup InetPtonW inet_ntop

api-ms-win-core-processenvironment-l1-1-0

FreeEnvironmentStringsW GetEnvironmentStringsW ExpandEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetCommandLineA GetCommandLineW GetStdHandle

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-debug-l1-1-0

OutputDebugStringA OutputDebugStringW IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter GetLastError RaiseException SetLastError UnhandledExceptionFilter

api-ms-win-core-synch-l1-1-0

TryAcquireSRWLockExclusive CreateMutexExW TryEnterCriticalSection DeleteCriticalSection ReleaseSRWLockExclusive CreateMutexW InitializeCriticalSectionEx OpenMutexW LeaveCriticalSection EnterCriticalSection WaitForSingleObjectEx WaitForSingleObject ReleaseMutex AcquireSRWLockExclusive InitializeCriticalSection InitializeCriticalSectionAndSpinCount

api-ms-win-core-processthreads-l1-1-0

TlsAlloc CreateThread GetExitCodeThread ExitProcess GetExitCodeProcess GetCurrentThreadId TlsGetValue TerminateProcess OpenProcessToken CreateProcessW GetCurrentProcessId GetCurrentProcess ExitThread TlsSetValue TlsFree GetStartupInfoW

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent OpenProcess

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo GetTickCount GetSystemTimeAsFileTime GlobalMemoryStatusEx GetSystemTime GetTickCount64

api-ms-win-core-libraryloader-l1-2-0

LoadResource LoadLibraryExW GetProcAddress LockResource SizeofResource GetModuleHandleExW GetModuleFileNameW FreeLibraryAndExitThread FreeLibrary GetModuleHandleW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW LoadLibraryA FindResourceW

api-ms-win-security-base-l1-1-0

CheckTokenMembership AllocateAndInitializeSid GetTokenInformation FreeSid

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-ntuser-sysparams-l1-1-0

GetMonitorInfoW EnumDisplayMonitors GetSystemMetrics SystemParametersInfoW

api-ms-win-core-registry-l1-1-0

RegDeleteValueW RegQueryValueExW RegGetValueW RegOpenKeyExW RegSetValueExW RegCreateKeyExW RegCloseKey

api-ms-win-core-com-l1-1-0

CoTaskMemFree CoUninitialize CoInitializeEx CoSetProxyBlanket CoCreateInstance

api-ms-win-shcore-obsolete-l1-1-0

CommandLineToArgvW

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

api-ms-win-core-file-l1-1-0

GetFullPathNameA GetDiskFreeSpaceExW FindClose FindFirstFileW FindFirstFileExW GetDiskFreeSpaceA FindNextFileW SetFilePointerEx SetEndOfFile CreateFileW ReadFile GetFileType GetFullPathNameW WriteFile UnlockFileEx GetFileSizeEx GetFileAttributesW SetFilePointer GetDiskFreeSpaceW CreateDirectoryW GetFileAttributesA GetFileAttributesExW LockFile CreateFileA FlushFileBuffers DeleteFileA DeleteFileW GetFileSize LockFileEx UnlockFile

api-ms-win-core-processthreads-l1-1-2

GetSystemTimes

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo

api-ms-win-core-kernel32-legacy-l1-1-0

GetComputerNameW

oleaut32

SysFreeString VariantClear SysAllocString

api-ms-win-power-base-l1-1-0

CallNtPowerInformation

ext-ms-win-networking-wlanapi-l1-1-0

WlanOpenHandle WlanQueryInterface WlanCloseHandle WlanEnumInterfaces WlanFreeMemory

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-eventing-controller-l1-1-0

ControlTraceW EnableTraceEx2 StartTraceW

api-ms-win-eventing-consumer-l1-1-0

ProcessTrace OpenTraceW CloseTrace

api-ms-win-core-toolhelp-l1-1-0

Process32FirstW CreateToolhelp32Snapshot Process32NextW

winhttp

WinHttpOpenRequest WinHttpReceiveResponse WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpSetTimeouts WinHttpSendRequest WinHttpQueryHeaders WinHttpWebSocketQueryCloseStatus WinHttpWebSocketShutdown WinHttpWebSocketReceive WinHttpWebSocketSend WinHttpWebSocketCompleteUpgrade WinHttpAddRequestHeaders WinHttpSetOption WinHttpQueryDataAvailable WinHttpReadData

api-ms-win-core-string-l1-1-0

GetStringTypeW MultiByteToWideChar WideCharToMultiByte CompareStringW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW lstrcmpW

d3d11

D3D11CreateDevice

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency QueryPerformanceCounter

api-ms-win-core-memory-l1-1-0

MapViewOfFile VirtualProtect UnmapViewOfFile FlushViewOfFile CreateFileMappingW

api-ms-win-core-localization-l1-2-0

GetACP IsValidCodePage FormatMessageA EnumSystemLocalesW IsValidLocale GetLocaleInfoW LCMapStringW GetOEMCP GetCPInfo FormatMessageW GetLocaleInfoEx GetUserDefaultLCID LCMapStringEx

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime GetTimeZoneInformation

api-ms-win-core-heap-l1-1-0

HeapCreate HeapFree HeapReAlloc HeapSize HeapValidate HeapAlloc HeapCompact HeapDestroy GetProcessHeap

api-ms-win-core-file-l1-2-2

AreFileApisANSI GetTempPathA

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW Sleep WakeAllConditionVariable

comdlg32

ChooseColorW

shlwapi

PathFindFileNameW

user32

WindowFromPoint MapWindowPoints SetLayeredWindowAttributes IsChild GetDoubleClickTime CallWindowProcW DispatchMessageW GetMessageW OffsetRect FillRect GetClientRect GetWindowTextW SetWindowTextW ReleaseDC GetDC DrawTextW UpdateLayeredWindow IsWindow ChangeWindowMessageFilterEx GetDpiForWindow MonitorFromWindow IntersectRect GetParent SetParent MonitorFromPoint LoadImageW LoadIconW LoadCursorA CheckMenuRadioItem GetWindowThreadProcessId FindWindowW SetWindowLongPtrW GetWindowLongPtrW ScreenToClient ClientToScreen GetCursorPos MessageBoxW GetWindowRect GetPropW SetPropW RedrawWindow InvalidateRect SetWindowRgn EndPaint BeginPaint FindWindowExW GetClassNameW SetWindowsHookExW UnhookWindowsHookEx CallNextHookEx MonitorFromRect EqualRect RegisterWindowMessageW AllowSetForegroundWindow SetForegroundWindow GetForegroundWindow UpdateWindow EndMenu TrackPopupMenu AppendMenuW DestroyMenu CreatePopupMenu GetSystemMetricsForDpi KillTimer SetTimer ReleaseCapture SetCapture GetCapture SetFocus IsZoomed IsIconic IsWindowVisible SetWindowPos ShowWindow DestroyWindow RegisterClassExW PostQuitMessage DefWindowProcW DefWindowProcA PostMessageW SendMessageW DispatchMessageA TranslateMessage GetMessageA TrackMouseEvent CreateWindowExW

dxgi

CreateDXGIFactory

dcomp

DCompositionCreateDevice

pdh

PdhExpandWildCardPathW PdhCollectQueryData PdhAddEnglishCounterW PdhOpenQueryW PdhGetFormattedCounterValue PdhCloseQuery

shell32

ShellExecuteW SHGetKnownFolderPath Shell_NotifyIconW

gdi32

CreateRoundRectRgn GetStockObject AddFontResourceExW RemoveFontResourceExW SetBkColor SetDCBrushColor SetTextColor CreateCompatibleDC CreateFontW DeleteDC DeleteObject RoundRect SelectObject SetBkMode CreateDIBSection GdiFlush GetTextExtentPoint32W

kernel32

GetActiveProcessorCount

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

api-ms-win-core-util-l1-1-0

DecodePointer EncodePointer

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind RtlCaptureContext RtlUnwind RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-fibers-l1-1-0

FlsAlloc FlsSetValue FlsFree FlsGetValue

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW GetDateFormatW

api-ms-win-core-console-l1-1-0

ReadConsoleW GetConsoleOutputCP GetConsoleMode WriteConsoleW

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

277KB

Virtual Size

276KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

23KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

60KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3.6MB

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

Watchman.exe

d2d1

dwrite

dwmapi

iphlpapi

ws2_32

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-security-base-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-ntuser-sysparams-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-shcore-obsolete-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-kernel32-legacy-l1-1-0

oleaut32

api-ms-win-power-base-l1-1-0

ext-ms-win-networking-wlanapi-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-eventing-controller-l1-1-0

api-ms-win-eventing-consumer-l1-1-0

api-ms-win-core-toolhelp-l1-1-0

winhttp

api-ms-win-core-string-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

d3d11

api-ms-win-core-profile-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-file-l1-2-2

api-ms-win-core-synch-l1-2-0

comdlg32

shlwapi

user32

dxgi

dcomp

pdh

shell32

gdi32

kernel32

api-ms-win-core-file-l2-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-console-l1-1-0

generic