dwm.exe

Desktop Window Manager file version info

Program on Windows LOLRMM Teramind 8 known copies with hashes 4 Sigma rules name it

A file of Teramind

a remote management tool, from LOLRMM

LOLRMM lists a file named dwm.exe as Teramind’s. Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS.

Its sitehttps://www.teramind.co/

From LOLRMM (Apache 2.0), which lists the remote management tools intruders are known to use as well as administrators. It goes by the file’s name: a copy that is the file above is not necessarily Teramind’s.

Is it the real dwm.exe?

file version info and known copies

Installed inC:\Windows\system32\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionDesktop Window Manager

8 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\dwm.exe · signed by Microsoft Windows

ee57340c0229cc5b6eaa06aaea526b79d899288b643817dff79121fb633fcc7e

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\dwm.exe · signed by Microsoft Windows

0ac827c9e35cdaa492ddd435079415805dcc276352112b040bcd34ef122cf565

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\dwm.exe · signed by Microsoft Windows

153bf1424fe62ceca16461e43343753c22ebadaaba2966f1e6b457944fb3d7db

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\dwm.exe · signed by Microsoft Windows

18b84df6110f4a23660a256e558bce4f5fc0d47678e4d1f9f8188dd490e5b293

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\dwm.exe · signed by Microsoft Windows

b39d76814ba92435f5dd5bcccd7faabcc814e1c51d92cdaff4fc011f0415812b

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\dwm.exe · signed by Microsoft Windows

5954a267c8f271798ec0ac18d5f67f21a70b47258b10601511ca2109fffdcf71

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\dwm.exe · signed by Microsoft Windows

b3e37997c1c62dd90d69ef83d6a6fc782bf9a5b8ad04a0d1528a8b7fa31aa408

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\dwm.exe · not signed

e30953278af244cbf40991a1002f82783add42ec13a583c51864c0d8cabd8005

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name dwm.exe

highScheduled Task Creation Masquerading as System ProcessesSwachchhanda Shrawan Poudel (Nextron Systems)

highSystem File Execution Location AnomalyFlorian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)

Sigma names dwm.exe in 4 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.