LOLDriversTHE DRIVER THREAT CATALOG
← Back to driver explorer
Driver intelligenceMaliciousVerified

windbg.sys

Kernel driver seen in a recent CopperStealer campaign.

UUID / 9c3c6e89-3916-498f-81e5-da057ab3ed42ADDED / 2023-04-22AUTHOR / Michael Haag

Known samples 20

20 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

windbg.sysSample 1 · HVCI TRUE
MD5
88bea56ae9257b40063785cf47546024
SHA1
b5a8e2104d76dbb04cd9ffe86784113585822375
SHA256
e1cb86386757b947b39086cc8639da988f6e8018ca9995dd669bdc03c8d39d7d
Imphash
f8e4844312e81dbdb4e8e95e2ad2c127
Authentihash MD5
265462dbda175886e0c02257f2385753
Authentihash SHA1
0e45b675fec76249e64f8a2d4bd5483886b91169
Authentihash SHA256
37a1a3fa4dc148924c1bfb60c88ffef082ee58cd0ee804d2de0f1d22c1e7802c
Machine
I386
Version
10.0.19041.685 (WinBuild.160101.0800)
Publisher
Microsoft Corporation
Download malicious sampleView on VirusTotal
windbg.sysSample 2 · HVCI TRUE
MD5
b6b530dd25c5eb66499968ec82e8791e
SHA1
9c1c9032aa1e33461f35dbf79b6f2d061bfc6774
SHA256
fa9abb3e7e06f857be191a1e049dd37642ec41fb2520c105df2227fcac3de5d5
Imphash
f8e4844312e81dbdb4e8e95e2ad2c127
Authentihash MD5
dbc72430b48b0ca636a84b9e5ed0d534
Authentihash SHA1
58ca196bfd54c6166aae0f8000fa8a1a66a0073e
Authentihash SHA256
45b969ae1b381716a29cd509622470b5b20b70c7efe4c9b7c0568faa298605ff
Machine
I386
Version
10.0.19041.685 (WinBuild.160101.0800)
Publisher
Microsoft Corporation
Download malicious sampleView on VirusTotal
windbg.sysSample 3 · HVCI TRUE
MD5
40b968ecdbe9e967d92c5da51c390eee
SHA1
b8b123a413b7bccfa8433deba4f88669c969b543
SHA256
06c5ebd0371342d18bc81a96f5e5ce28de64101e3c2fd0161d0b54d8368d2f1f
Imphash
3db9de43d5d530c10d0cd2d43c7a0771
Authentihash MD5
98a3ab2b723de48256701b417ff87a65
Authentihash SHA1
ff80d6663a92ff454526e88847cbb4d9bd00e21e
Authentihash SHA256
79278979d9300670d1084493bbc03ae374efc5ab02850941e85753885fa88e47
Machine
AMD64
Version
10.0.19041.685 (WinBuild.160101.0800)
Publisher
Microsoft Corporation
Download malicious sampleView on VirusTotal
windbg.sysSample 4 · HVCI TRUE
MD5
40f35792e7565aa047796758a3ce1b77
SHA1
6df35a0c2f6d7d39d24277137ea840078dafb812
SHA256
139f8412a7c6fdc43dcfbbcdba256ee55654eb36a40f338249d5162a1f69b988
Imphash
63fd1582ac2edee50f7ec7eedde38ee8
Authentihash MD5
3a2404b8c4c87facf5316e4ff16bd603
Authentihash SHA1
ff3d240cf0faeafb37f176b71151dd83b2177a0e
Authentihash SHA256
e307ebe2d43cc8e290e5ade032a6e38bc6961439f92d6e99b954bf1368a975ef
Machine
AMD64
Version
10.0.19041.685 (WinBuild.160101.0800)
Publisher
Microsoft Corporation
Download malicious sampleView on VirusTotal
windbg.sysSample 5 · HVCI TRUE
MD5
093a2a635c3a27aac50efd6463f4efa1
SHA1
b34a012887ddab761b2298f882858fa1ff4d99f1
SHA256
5b932eab6c67f62f097a3249477ac46d80ddccdc52654f8674060b4ddf638e5d
Imphash
f8e4844312e81dbdb4e8e95e2ad2c127
Authentihash MD5
dab51577c44fda1574532847f4deb56c
Authentihash SHA1
c7cb92f60ffe07d1c9bfa43ea1213f8c8f766022
Authentihash SHA256
6ee267fc3d0ac2662a9cfdb0ed5a2354ee09ef4c218303f20350177cae125cf7
Machine
I386
Version
10.0.19041.685 (WinBuild.160101.0800)
Publisher
Microsoft Corporation
Download malicious sampleView on VirusTotal
windbg.sysSample 6 · HVCI TRUE
MD5
844af8c877f5da723c1b82cf6e213fc1
SHA1
4f2d9a70ea24121ae01df8a76ffba1f9cc0fde4a
SHA256
6994b32e3f3357f4a1d0abe81e8b62dd54e36b17816f2f1a80018584200a1b77
Imphash
3db9de43d5d530c10d0cd2d43c7a0771
Authentihash MD5
98a3ab2b723de48256701b417ff87a65
Authentihash SHA1
ff80d6663a92ff454526e88847cbb4d9bd00e21e
Authentihash SHA256
79278979d9300670d1084493bbc03ae374efc5ab02850941e85753885fa88e47
Machine
AMD64
Version
10.0.19041.685 (WinBuild.160101.0800)
Publisher
Microsoft Corporation
Download malicious sampleView on VirusTotal
windbg.sysSample 7 · HVCI TRUE
MD5
2ec877e425bd7eddb663627216e3491e
SHA1
d4f5323da704ff2f25d6b97f38763c147f2a0e6f
SHA256
32882949ea084434a376451ff8364243a50485a3b4af2f2240bb5f20c164543d
Imphash
63fd1582ac2edee50f7ec7eedde38ee8
Authentihash MD5
75c70824590d4db183418c7fd9e47d2d
Authentihash SHA1
1ccd8bc3104fe1654806752e1e6730d3ee0b4ee4
Authentihash SHA256
e7e7824d611527b67fc36128da1b35d9b8ce3ffdab3fb96e3dbabd6e9c9570c0
Machine
AMD64
Version
10.0.19041.685 (WinBuild.160101.0800)
Publisher
Microsoft Corporation
Download malicious sampleView on VirusTotal
windbg.sysSample 8 · HVCI TRUE
MD5
0023ca0ca16a62d93ef51f3df98b2f94
SHA1
97812f334a077c40e8e642bb9872ac2c49ddb9a2
SHA256
50819a1add4c81c0d53203592d6803f022443440935ff8260ff3b6d5253c0c76
Imphash
6b387c029257f024a43a73f38afb2629
Authentihash MD5
c12f9f4027088d2ca69b2d2fec33131b
Authentihash SHA1
f73aa876791246fb7486214e4d3f81a0d375e649
Authentihash SHA256
88b901ce8ee199bc371e9cf39ab5375d31c6881a25ba5827e9b32ba7946ecda1
Machine
AMD64
Version
10.0.19041.685 (WinBuild.160101.0800)
Publisher
Microsoft Corporation
Download malicious sampleView on VirusTotal
windbg.sysSample 9 · HVCI TRUE
MD5
f69b06ca7c34d16f26ea1c6861edf62a
SHA1
fdbcebb6cafda927d384d7be2e8063a4377d884f
SHA256
770f33259d6fb10f4a32d8a57d0d12953e8455c72bb7b60cb39ce505c507013a
Imphash
3db9de43d5d530c10d0cd2d43c7a0771
Authentihash MD5
5d9b4ff04047d06a76354c7f7caa1e9e
Authentihash SHA1
6230645a707228e023d7fc9c5c86c340be05f9c3
Authentihash SHA256
28d3a5a85eef4561c4ad08fd83aca4f7a946f8dca8bfb7958a855a80197f68a6
Machine
AMD64
Version
10.0.19041.685 (WinBuild.160101.0800)
Publisher
Microsoft Corporation
Download malicious sampleView on VirusTotal
windbg.sysSample 10 · HVCI TRUE
MD5
e8eac6642b882a6196555539149c73f2
SHA1
3825ebb0b0664b5f0789371240f65231693be37d
SHA256
86047bb1969d1db455493955fd450d18c62a3f36294d0a6c3732c88dfbcc4f62
Imphash
3db9de43d5d530c10d0cd2d43c7a0771
Authentihash MD5
1584b06241f08d74434a452e798b2809
Authentihash SHA1
8eca36d54d04736f61f54285bcee8c30ed892553
Authentihash SHA256
ff6108dd2017f9bc7ea93c43c1afbda0f1cc7b00f5afafb4ce3cf0a193e9598b
Machine
AMD64
Version
10.0.19041.685 (WinBuild.160101.0800)
Publisher
Microsoft Corporation
Download malicious sampleView on VirusTotal
windbg.sysSample 11 · HVCI TRUE
MD5
5ebfc0af031130ba9de1d5d3275734b3
SHA1
48f03a13b0f6d3d929a86514ce48a9352ffef5ad
SHA256
bb2422e96ea993007f25c71d55b2eddfa1e940c89e895abb50dd07d7c17ca1df
Imphash
3db9de43d5d530c10d0cd2d43c7a0771
Authentihash MD5
1959eac3bb98c3032791b0dc6d662281
Authentihash SHA1
f8df5fd765770a56c227c66b47edcf38f868ef33
Authentihash SHA256
a0801ade5de44b65afb8c275e11e4d766ae64af1a5740ad4f1db1acc4e088774
Machine
AMD64
Version
10.0.19041.685 (WinBuild.160101.0800)
Publisher
Microsoft Corporation
Download malicious sampleView on VirusTotal
windbg.sysSample 12 · HVCI TRUE
MD5
40b968ecdbe9e967d92c5da51c390eee
SHA1
b8b123a413b7bccfa8433deba4f88669c969b543
SHA256
06c5ebd0371342d18bc81a96f5e5ce28de64101e3c2fd0161d0b54d8368d2f1f
Imphash
3db9de43d5d530c10d0cd2d43c7a0771
Authentihash MD5
98a3ab2b723de48256701b417ff87a65
Authentihash SHA1
ff80d6663a92ff454526e88847cbb4d9bd00e21e
Authentihash SHA256
79278979d9300670d1084493bbc03ae374efc5ab02850941e85753885fa88e47
Machine
AMD64
Version
10.0.19041.685 (WinBuild.160101.0800)
Publisher
Microsoft Corporation
Download malicious sampleView on VirusTotal
windbg.sysSample 13 · HVCI TRUE
MD5
c71be7b112059d2dc84c0f952e04e6cc
SHA1
9ee31f1f25f675a12b7bad386244a9fbfa786a87
SHA256
6661320f779337b95bbbe1943ee64afb2101c92f92f3d1571c1bf4201c38c724
Imphash
cf0eb2dce2ba2c9ff5dd0da794b8b372
Authentihash MD5
01788e7162863cfe7aeba0f040a6cc08
Authentihash SHA1
ded2c02db6b5addf9d521361fd3657b2b6894a48
Authentihash SHA256
223b320fb86cd4a1019ce31ac6901ce6bc41792810bd995db232dad790398852
Machine
I386
Version
10.0.19041.685 (WinBuild.160101.0800)
Publisher
Microsoft Corporation
Download malicious sampleView on VirusTotal
windbg.sysSample 14 · HVCI TRUE
MD5
0ea8389589c603a8b05146bd06020597
SHA1
3c1c3f5f5081127229ba0019fbf0efc2a9c1d677
SHA256
f9f2091fccb289bcf6a945f6b38676ec71dedb32f3674262928ccaf840ca131a
Imphash
cf0eb2dce2ba2c9ff5dd0da794b8b372
Authentihash MD5
0318de365e28ee38442c92b03747b088
Authentihash SHA1
ff0497dbd779bd65bbb7302b360dc0738a464e9b
Authentihash SHA256
dd759c6b9c4222c7b19e8b0ba7288d7395594d6884b9bcdf0ccfada3e6b7a8d5
Machine
I386
Version
10.0.19041.685 (WinBuild.160101.0800)
Publisher
Microsoft Corporation
Download malicious sampleView on VirusTotal
windbg.sysSample 15 · HVCI TRUE
MD5
19bdd9b799e3c2c54c0d7fff68b31c20
SHA1
ea4a405445bb6e58c16b81f6d5d2c9a9edde419b
SHA256
e6f764c3b5580cd1675cbf184938ad5a201a8c096607857869bd7c3399df0d12
Imphash
514298d18002920ee5a917fc34426417
Authentihash MD5
619b74b682d2abd190cb3e0ac5ecd6f7
Authentihash SHA1
ed5e61e534550b1f286d0801d4464d45f38d2739
Authentihash SHA256
40e0be2ed5d07d5ecf14232fe64a95c7ad6fd942a60b4a6e21fda69c75bbb78d
Machine
I386
Version
10.0.19041.685 (WinBuild.160101.0800)
Publisher
Microsoft Corporation
Download malicious sampleView on VirusTotal
windbg.sysSample 16 · HVCI TRUE
MD5
88bea56ae9257b40063785cf47546024
SHA1
b5a8e2104d76dbb04cd9ffe86784113585822375
SHA256
e1cb86386757b947b39086cc8639da988f6e8018ca9995dd669bdc03c8d39d7d
Imphash
f8e4844312e81dbdb4e8e95e2ad2c127
Authentihash MD5
265462dbda175886e0c02257f2385753
Authentihash SHA1
0e45b675fec76249e64f8a2d4bd5483886b91169
Authentihash SHA256
37a1a3fa4dc148924c1bfb60c88ffef082ee58cd0ee804d2de0f1d22c1e7802c
Machine
I386
Version
10.0.19041.685 (WinBuild.160101.0800)
Publisher
Microsoft Corporation
Download malicious sampleView on VirusTotal
windbg.sysSample 17 · HVCI TRUE
MD5
3f11a94f1ac5efdd19767c6976da9ba4
SHA1
f92faed3ef92fa5bc88ebc1725221be5d7425528
SHA256
4734a0a5d88f44a4939b8d812364cab6ca5f611b9b8ceebe27df6c1ed3a6d8a4
Imphash
f8e4844312e81dbdb4e8e95e2ad2c127
Authentihash MD5
096f2e1d163a780fa3cb7f0870fe2b34
Authentihash SHA1
0e4f45b762d5c548322cde3d0e2d5ff2d81c87f1
Authentihash SHA256
948735962436df24baa69e58421345d4a295e0821f4f93fd9f64e11f51a9666f
Machine
I386
Version
10.0.19041.685 (WinBuild.160101.0800)
Publisher
Microsoft Corporation
Download malicious sampleView on VirusTotal
windbg.sysSample 18 · HVCI TRUE
MD5
0bdd51cc33e88b5265dfb7d88c5dc8d6
SHA1
6a6fe0d69e0ea34d695c3b525e6db639f9ad6ac5
SHA256
ea50f22daade04d3ca06dedb497b905215cba31aae7b4cab4b533fda0c5be620
Imphash
f8e4844312e81dbdb4e8e95e2ad2c127
Authentihash MD5
207e5de5c589271ee469dd33442a0bb0
Authentihash SHA1
34e83718226e039ebf28c4ea2284b011701710d0
Authentihash SHA256
aa833c9e3bcdc33eaf64fd913e80f5b9ce60618f6e3ff4c386420fea4a494380
Machine
I386
Version
10.0.19041.685 (WinBuild.160101.0800)
Publisher
Microsoft Corporation
Download malicious sampleView on VirusTotal
windbg.sysSample 19 · HVCI TRUE
MD5
b6b530dd25c5eb66499968ec82e8791e
SHA1
9c1c9032aa1e33461f35dbf79b6f2d061bfc6774
SHA256
fa9abb3e7e06f857be191a1e049dd37642ec41fb2520c105df2227fcac3de5d5
Imphash
f8e4844312e81dbdb4e8e95e2ad2c127
Authentihash MD5
dbc72430b48b0ca636a84b9e5ed0d534
Authentihash SHA1
58ca196bfd54c6166aae0f8000fa8a1a66a0073e
Authentihash SHA256
45b969ae1b381716a29cd509622470b5b20b70c7efe4c9b7c0568faa298605ff
Machine
I386
Version
10.0.19041.685 (WinBuild.160101.0800)
Publisher
Microsoft Corporation
Download malicious sampleView on VirusTotal
windbg.sysSample 20 · HVCI TRUE
MD5
77a7ed4798d02ef6636cd0fd07fc382a
SHA1
76789196eebfd4203f477a5a6c75eefc12d9a837
SHA256
f936ec4c8164cbd31add659b61c16cb3a717eac90e74d89c47afb96b60120280
Imphash
3db9de43d5d530c10d0cd2d43c7a0771
Authentihash MD5
ff65997d5644ff042a7e3a5cb9030af2
Authentihash SHA1
a1c5483d4d29d0cd9edc6e42a21d70f56de12aaf
Authentihash SHA256
9be868eb7e177ee6d762f2a022acf18b6b190fecbe445b3c09fc0494e8244ee8
Machine
AMD64
Version
10.0.19041.685 (WinBuild.160101.0800)
Publisher
Microsoft Corporation
Download malicious sampleView on VirusTotal

Recorded command

sc.exe create windbg.sys binPath=C:\windows\temp\windbg.sys type=kernel && sc.exe start windbg.sys

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references