← Back to driver explorer
Driver intelligenceMaliciousVerified
windbg.sys
These samples are related to CopperStealth campaign found by TrendMicro. CopperStealth’s infection chain involves dropping and loading a rootkit, which later injects its payload into explorer.exe and another system process. These payloads are responsible for downloading and running additional tasks. The rootkit also blocks access to blocklisted registry keys and prevents certain executables and drivers from running.
Known samples 17
17 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
windbg.sysSample 1 · HVCI TRUE
- MD5
40f35792e7565aa047796758a3ce1b77- SHA1
6df35a0c2f6d7d39d24277137ea840078dafb812- SHA256
139f8412a7c6fdc43dcfbbcdba256ee55654eb36a40f338249d5162a1f69b988- Imphash
63fd1582ac2edee50f7ec7eedde38ee8- Authentihash MD5
3a2404b8c4c87facf5316e4ff16bd603- Authentihash SHA1
ff3d240cf0faeafb37f176b71151dd83b2177a0e- Authentihash SHA256
e307ebe2d43cc8e290e5ade032a6e38bc6961439f92d6e99b954bf1368a975ef- Machine
- AMD64
- Version
- 10.0.19041.685 (WinBuild.160101.0800)
- Publisher
- Microsoft Corporation
windbg.sysSample 2 · HVCI TRUE
- MD5
093a2a635c3a27aac50efd6463f4efa1- SHA1
b34a012887ddab761b2298f882858fa1ff4d99f1- SHA256
5b932eab6c67f62f097a3249477ac46d80ddccdc52654f8674060b4ddf638e5d- Imphash
f8e4844312e81dbdb4e8e95e2ad2c127- Authentihash MD5
dab51577c44fda1574532847f4deb56c- Authentihash SHA1
c7cb92f60ffe07d1c9bfa43ea1213f8c8f766022- Authentihash SHA256
6ee267fc3d0ac2662a9cfdb0ed5a2354ee09ef4c218303f20350177cae125cf7- Machine
- I386
- Version
- 10.0.19041.685 (WinBuild.160101.0800)
- Publisher
- Microsoft Corporation
windbg.sysSample 3 · HVCI TRUE
- MD5
844af8c877f5da723c1b82cf6e213fc1- SHA1
4f2d9a70ea24121ae01df8a76ffba1f9cc0fde4a- SHA256
6994b32e3f3357f4a1d0abe81e8b62dd54e36b17816f2f1a80018584200a1b77- Imphash
3db9de43d5d530c10d0cd2d43c7a0771- Authentihash MD5
98a3ab2b723de48256701b417ff87a65- Authentihash SHA1
ff80d6663a92ff454526e88847cbb4d9bd00e21e- Authentihash SHA256
79278979d9300670d1084493bbc03ae374efc5ab02850941e85753885fa88e47- Machine
- AMD64
- Version
- 10.0.19041.685 (WinBuild.160101.0800)
- Publisher
- Microsoft Corporation
windbg.sysSample 4 · HVCI TRUE
- MD5
2ec877e425bd7eddb663627216e3491e- SHA1
d4f5323da704ff2f25d6b97f38763c147f2a0e6f- SHA256
32882949ea084434a376451ff8364243a50485a3b4af2f2240bb5f20c164543d- Imphash
63fd1582ac2edee50f7ec7eedde38ee8- Authentihash MD5
75c70824590d4db183418c7fd9e47d2d- Authentihash SHA1
1ccd8bc3104fe1654806752e1e6730d3ee0b4ee4- Authentihash SHA256
e7e7824d611527b67fc36128da1b35d9b8ce3ffdab3fb96e3dbabd6e9c9570c0- Machine
- AMD64
- Version
- 10.0.19041.685 (WinBuild.160101.0800)
- Publisher
- Microsoft Corporation
windbg.sysSample 5 · HVCI TRUE
- MD5
0023ca0ca16a62d93ef51f3df98b2f94- SHA1
97812f334a077c40e8e642bb9872ac2c49ddb9a2- SHA256
50819a1add4c81c0d53203592d6803f022443440935ff8260ff3b6d5253c0c76- Imphash
6b387c029257f024a43a73f38afb2629- Authentihash MD5
c12f9f4027088d2ca69b2d2fec33131b- Authentihash SHA1
f73aa876791246fb7486214e4d3f81a0d375e649- Authentihash SHA256
88b901ce8ee199bc371e9cf39ab5375d31c6881a25ba5827e9b32ba7946ecda1- Machine
- AMD64
- Version
- 10.0.19041.685 (WinBuild.160101.0800)
- Publisher
- Microsoft Corporation
windbg.sysSample 6 · HVCI TRUE
- MD5
f69b06ca7c34d16f26ea1c6861edf62a- SHA1
fdbcebb6cafda927d384d7be2e8063a4377d884f- SHA256
770f33259d6fb10f4a32d8a57d0d12953e8455c72bb7b60cb39ce505c507013a- Imphash
3db9de43d5d530c10d0cd2d43c7a0771- Authentihash MD5
5d9b4ff04047d06a76354c7f7caa1e9e- Authentihash SHA1
6230645a707228e023d7fc9c5c86c340be05f9c3- Authentihash SHA256
28d3a5a85eef4561c4ad08fd83aca4f7a946f8dca8bfb7958a855a80197f68a6- Machine
- AMD64
- Version
- 10.0.19041.685 (WinBuild.160101.0800)
- Publisher
- Microsoft Corporation
windbg.sysSample 7 · HVCI TRUE
- MD5
e8eac6642b882a6196555539149c73f2- SHA1
3825ebb0b0664b5f0789371240f65231693be37d- SHA256
86047bb1969d1db455493955fd450d18c62a3f36294d0a6c3732c88dfbcc4f62- Imphash
3db9de43d5d530c10d0cd2d43c7a0771- Authentihash MD5
1584b06241f08d74434a452e798b2809- Authentihash SHA1
8eca36d54d04736f61f54285bcee8c30ed892553- Authentihash SHA256
ff6108dd2017f9bc7ea93c43c1afbda0f1cc7b00f5afafb4ce3cf0a193e9598b- Machine
- AMD64
- Version
- 10.0.19041.685 (WinBuild.160101.0800)
- Publisher
- Microsoft Corporation
windbg.sysSample 8 · HVCI TRUE
- MD5
5ebfc0af031130ba9de1d5d3275734b3- SHA1
48f03a13b0f6d3d929a86514ce48a9352ffef5ad- SHA256
bb2422e96ea993007f25c71d55b2eddfa1e940c89e895abb50dd07d7c17ca1df- Imphash
3db9de43d5d530c10d0cd2d43c7a0771- Authentihash MD5
1959eac3bb98c3032791b0dc6d662281- Authentihash SHA1
f8df5fd765770a56c227c66b47edcf38f868ef33- Authentihash SHA256
a0801ade5de44b65afb8c275e11e4d766ae64af1a5740ad4f1db1acc4e088774- Machine
- AMD64
- Version
- 10.0.19041.685 (WinBuild.160101.0800)
- Publisher
- Microsoft Corporation
windbg.sysSample 9 · HVCI TRUE
- MD5
40b968ecdbe9e967d92c5da51c390eee- SHA1
b8b123a413b7bccfa8433deba4f88669c969b543- SHA256
06c5ebd0371342d18bc81a96f5e5ce28de64101e3c2fd0161d0b54d8368d2f1f- Imphash
3db9de43d5d530c10d0cd2d43c7a0771- Authentihash MD5
98a3ab2b723de48256701b417ff87a65- Authentihash SHA1
ff80d6663a92ff454526e88847cbb4d9bd00e21e- Authentihash SHA256
79278979d9300670d1084493bbc03ae374efc5ab02850941e85753885fa88e47- Machine
- AMD64
- Version
- 10.0.19041.685 (WinBuild.160101.0800)
- Publisher
- Microsoft Corporation
windbg.sysSample 10 · HVCI TRUE
- MD5
c71be7b112059d2dc84c0f952e04e6cc- SHA1
9ee31f1f25f675a12b7bad386244a9fbfa786a87- SHA256
6661320f779337b95bbbe1943ee64afb2101c92f92f3d1571c1bf4201c38c724- Imphash
cf0eb2dce2ba2c9ff5dd0da794b8b372- Authentihash MD5
01788e7162863cfe7aeba0f040a6cc08- Authentihash SHA1
ded2c02db6b5addf9d521361fd3657b2b6894a48- Authentihash SHA256
223b320fb86cd4a1019ce31ac6901ce6bc41792810bd995db232dad790398852- Machine
- I386
- Version
- 10.0.19041.685 (WinBuild.160101.0800)
- Publisher
- Microsoft Corporation
windbg.sysSample 11 · HVCI TRUE
- MD5
0ea8389589c603a8b05146bd06020597- SHA1
3c1c3f5f5081127229ba0019fbf0efc2a9c1d677- SHA256
f9f2091fccb289bcf6a945f6b38676ec71dedb32f3674262928ccaf840ca131a- Imphash
cf0eb2dce2ba2c9ff5dd0da794b8b372- Authentihash MD5
0318de365e28ee38442c92b03747b088- Authentihash SHA1
ff0497dbd779bd65bbb7302b360dc0738a464e9b- Authentihash SHA256
dd759c6b9c4222c7b19e8b0ba7288d7395594d6884b9bcdf0ccfada3e6b7a8d5- Machine
- I386
- Version
- 10.0.19041.685 (WinBuild.160101.0800)
- Publisher
- Microsoft Corporation
windbg.sysSample 12 · HVCI TRUE
- MD5
19bdd9b799e3c2c54c0d7fff68b31c20- SHA1
ea4a405445bb6e58c16b81f6d5d2c9a9edde419b- SHA256
e6f764c3b5580cd1675cbf184938ad5a201a8c096607857869bd7c3399df0d12- Imphash
514298d18002920ee5a917fc34426417- Authentihash MD5
619b74b682d2abd190cb3e0ac5ecd6f7- Authentihash SHA1
ed5e61e534550b1f286d0801d4464d45f38d2739- Authentihash SHA256
40e0be2ed5d07d5ecf14232fe64a95c7ad6fd942a60b4a6e21fda69c75bbb78d- Machine
- I386
- Version
- 10.0.19041.685 (WinBuild.160101.0800)
- Publisher
- Microsoft Corporation
windbg.sysSample 13 · HVCI TRUE
- MD5
88bea56ae9257b40063785cf47546024- SHA1
b5a8e2104d76dbb04cd9ffe86784113585822375- SHA256
e1cb86386757b947b39086cc8639da988f6e8018ca9995dd669bdc03c8d39d7d- Imphash
f8e4844312e81dbdb4e8e95e2ad2c127- Authentihash MD5
265462dbda175886e0c02257f2385753- Authentihash SHA1
0e45b675fec76249e64f8a2d4bd5483886b91169- Authentihash SHA256
37a1a3fa4dc148924c1bfb60c88ffef082ee58cd0ee804d2de0f1d22c1e7802c- Machine
- I386
- Version
- 10.0.19041.685 (WinBuild.160101.0800)
- Publisher
- Microsoft Corporation
windbg.sysSample 14 · HVCI TRUE
- MD5
3f11a94f1ac5efdd19767c6976da9ba4- SHA1
f92faed3ef92fa5bc88ebc1725221be5d7425528- SHA256
4734a0a5d88f44a4939b8d812364cab6ca5f611b9b8ceebe27df6c1ed3a6d8a4- Imphash
f8e4844312e81dbdb4e8e95e2ad2c127- Authentihash MD5
096f2e1d163a780fa3cb7f0870fe2b34- Authentihash SHA1
0e4f45b762d5c548322cde3d0e2d5ff2d81c87f1- Authentihash SHA256
948735962436df24baa69e58421345d4a295e0821f4f93fd9f64e11f51a9666f- Machine
- I386
- Version
- 10.0.19041.685 (WinBuild.160101.0800)
- Publisher
- Microsoft Corporation
windbg.sysSample 15 · HVCI TRUE
- MD5
0bdd51cc33e88b5265dfb7d88c5dc8d6- SHA1
6a6fe0d69e0ea34d695c3b525e6db639f9ad6ac5- SHA256
ea50f22daade04d3ca06dedb497b905215cba31aae7b4cab4b533fda0c5be620- Imphash
f8e4844312e81dbdb4e8e95e2ad2c127- Authentihash MD5
207e5de5c589271ee469dd33442a0bb0- Authentihash SHA1
34e83718226e039ebf28c4ea2284b011701710d0- Authentihash SHA256
aa833c9e3bcdc33eaf64fd913e80f5b9ce60618f6e3ff4c386420fea4a494380- Machine
- I386
- Version
- 10.0.19041.685 (WinBuild.160101.0800)
- Publisher
- Microsoft Corporation
windbg.sysSample 16 · HVCI TRUE
- MD5
b6b530dd25c5eb66499968ec82e8791e- SHA1
9c1c9032aa1e33461f35dbf79b6f2d061bfc6774- SHA256
fa9abb3e7e06f857be191a1e049dd37642ec41fb2520c105df2227fcac3de5d5- Imphash
f8e4844312e81dbdb4e8e95e2ad2c127- Authentihash MD5
dbc72430b48b0ca636a84b9e5ed0d534- Authentihash SHA1
58ca196bfd54c6166aae0f8000fa8a1a66a0073e- Authentihash SHA256
45b969ae1b381716a29cd509622470b5b20b70c7efe4c9b7c0568faa298605ff- Machine
- I386
- Version
- 10.0.19041.685 (WinBuild.160101.0800)
- Publisher
- Microsoft Corporation
windbg.sysSample 17 · HVCI TRUE
- MD5
77a7ed4798d02ef6636cd0fd07fc382a- SHA1
76789196eebfd4203f477a5a6c75eefc12d9a837- SHA256
f936ec4c8164cbd31add659b61c16cb3a717eac90e74d89c47afb96b60120280- Imphash
3db9de43d5d530c10d0cd2d43c7a0771- Authentihash MD5
ff65997d5644ff042a7e3a5cb9030af2- Authentihash SHA1
a1c5483d4d29d0cd9edc6e42a21d70f56de12aaf- Authentihash SHA256
9be868eb7e177ee6d762f2a022acf18b6b190fecbe445b3c09fc0494e8244ee8- Machine
- AMD64
- Version
- 10.0.19041.685 (WinBuild.160101.0800)
- Publisher
- Microsoft Corporation
Recorded command
sc.exe create windbg.sys binPath=C:\windows\temp\windbg.sys type=kernel && sc.exe start windbg.sysElevate privileges · Privileges: kernel · OS: Windows 10