7ac82c97b884b5ff5ae1699d793d7c0101d2484b597cbae9b7516a2bde8091c5

Analysis

max time kernel
127s
max time network
134s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
01/08/2023, 19:38

Target

Newcopperstealer10_browsingExe.exe
Size

3.7MB
MD5

7c7671a948fb42fd70f55432e8a21786
SHA1

b06dab46a30f2f5a38587ce16d4ea9876368f797
SHA256

e69026db820b4aecb17d98bf3cb9f40b78758232a5b45b5b7ba84850bd9f9ec5
SHA512

8d3e20fa94b9ab29ce419d46b572370ba2f0dc9fa7ffdb4aef9c9ad988486ed62324ed95679da9575564330a795582d220616cc12ff3abbb98fce84d13cecc75
SSDEEP

49152:ENTZ0VDVRkP3p8diOcjTvfUwvOnI1ttMOjD647nfxX5Vgx6:ENTZ0VDVRkPGdTuGWtyOjD6e7ig

Score

4^/10

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\shrdp.job	Newcopperstealer10_browsingExe.exe

Kills process with taskkill 5 IoCs

evasion

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2032	Newcopperstealer10_browsingExe.exe
Token: SeDebugPrivilege	1772	taskkill.exe
Token: SeDebugPrivilege	2900	taskkill.exe
Token: SeDebugPrivilege	2888	taskkill.exe
Token: SeDebugPrivilege	2308	taskkill.exe
Token: SeDebugPrivilege	1500	taskkill.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1772	2032	Newcopperstealer10_browsingExe.exe	28
PID 2032 wrote to memory of 1772	2032	Newcopperstealer10_browsingExe.exe	28
PID 2032 wrote to memory of 1772	2032	Newcopperstealer10_browsingExe.exe	28
PID 2032 wrote to memory of 1772	2032	Newcopperstealer10_browsingExe.exe	28
PID 2032 wrote to memory of 2900	2032	Newcopperstealer10_browsingExe.exe	33
PID 2032 wrote to memory of 2900	2032	Newcopperstealer10_browsingExe.exe	33
PID 2032 wrote to memory of 2900	2032	Newcopperstealer10_browsingExe.exe	33
PID 2032 wrote to memory of 2900	2032	Newcopperstealer10_browsingExe.exe	33
PID 2032 wrote to memory of 2888	2032	Newcopperstealer10_browsingExe.exe	35
PID 2032 wrote to memory of 2888	2032	Newcopperstealer10_browsingExe.exe	35
PID 2032 wrote to memory of 2888	2032	Newcopperstealer10_browsingExe.exe	35
PID 2032 wrote to memory of 2888	2032	Newcopperstealer10_browsingExe.exe	35
PID 2032 wrote to memory of 2308	2032	Newcopperstealer10_browsingExe.exe	37
PID 2032 wrote to memory of 2308	2032	Newcopperstealer10_browsingExe.exe	37
PID 2032 wrote to memory of 2308	2032	Newcopperstealer10_browsingExe.exe	37
PID 2032 wrote to memory of 2308	2032	Newcopperstealer10_browsingExe.exe	37
PID 2032 wrote to memory of 1500	2032	Newcopperstealer10_browsingExe.exe	39
PID 2032 wrote to memory of 1500	2032	Newcopperstealer10_browsingExe.exe	39
PID 2032 wrote to memory of 1500	2032	Newcopperstealer10_browsingExe.exe	39
PID 2032 wrote to memory of 1500	2032	Newcopperstealer10_browsingExe.exe	39

memory/2032-54-0x0000000000400000-0x00000000005E7000-memory.dmp

Filesize
1.9MB

Download
memory/2032-55-0x0000000010000000-0x00000000101F2000-memory.dmp

Filesize
1.9MB

Download
memory/2032-61-0x0000000000400000-0x00000000005E7000-memory.dmp

Filesize
1.9MB

Download