7ac82c97b884b5ff5ae1699d793d7c0101d2484b597cbae9b7516a2bde8091c5

Analysis

max time kernel
141s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
01/08/2023, 19:38

Target

Newcopperstealer10_browsingExe.exe
Size

3.7MB
MD5

7c7671a948fb42fd70f55432e8a21786
SHA1

b06dab46a30f2f5a38587ce16d4ea9876368f797
SHA256

e69026db820b4aecb17d98bf3cb9f40b78758232a5b45b5b7ba84850bd9f9ec5
SHA512

8d3e20fa94b9ab29ce419d46b572370ba2f0dc9fa7ffdb4aef9c9ad988486ed62324ed95679da9575564330a795582d220616cc12ff3abbb98fce84d13cecc75
SSDEEP

49152:ENTZ0VDVRkP3p8diOcjTvfUwvOnI1ttMOjD647nfxX5Vgx6:ENTZ0VDVRkPGdTuGWtyOjD6e7ig

Score

4^/10

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\shrdp.job	Newcopperstealer10_browsingExe.exe

Kills process with taskkill 5 IoCs

evasion

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2432	powershell.exe
2432	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3960	Newcopperstealer10_browsingExe.exe
Token: SeDebugPrivilege	2432	powershell.exe
Token: SeDebugPrivilege	1776	taskkill.exe
Token: SeDebugPrivilege	2044	taskkill.exe
Token: SeDebugPrivilege	4640	taskkill.exe
Token: SeDebugPrivilege	940	taskkill.exe
Token: SeDebugPrivilege	2032	taskkill.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3960 wrote to memory of 2432	3960	Newcopperstealer10_browsingExe.exe	85
PID 3960 wrote to memory of 2432	3960	Newcopperstealer10_browsingExe.exe	85
PID 3960 wrote to memory of 1776	3960	Newcopperstealer10_browsingExe.exe	91
PID 3960 wrote to memory of 1776	3960	Newcopperstealer10_browsingExe.exe	91
PID 3960 wrote to memory of 1776	3960	Newcopperstealer10_browsingExe.exe	91
PID 3960 wrote to memory of 2044	3960	Newcopperstealer10_browsingExe.exe	98
PID 3960 wrote to memory of 2044	3960	Newcopperstealer10_browsingExe.exe	98
PID 3960 wrote to memory of 2044	3960	Newcopperstealer10_browsingExe.exe	98
PID 3960 wrote to memory of 4640	3960	Newcopperstealer10_browsingExe.exe	101
PID 3960 wrote to memory of 4640	3960	Newcopperstealer10_browsingExe.exe	101
PID 3960 wrote to memory of 4640	3960	Newcopperstealer10_browsingExe.exe	101
PID 3960 wrote to memory of 940	3960	Newcopperstealer10_browsingExe.exe	103
PID 3960 wrote to memory of 940	3960	Newcopperstealer10_browsingExe.exe	103
PID 3960 wrote to memory of 940	3960	Newcopperstealer10_browsingExe.exe	103
PID 3960 wrote to memory of 2032	3960	Newcopperstealer10_browsingExe.exe	111
PID 3960 wrote to memory of 2032	3960	Newcopperstealer10_browsingExe.exe	111
PID 3960 wrote to memory of 2032	3960	Newcopperstealer10_browsingExe.exe	111

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_arzxxcrs.dn1.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/2432-139-0x000002B260B60000-0x000002B260B82000-memory.dmp

Filesize
136KB

Download
memory/2432-149-0x00007FF84FAB0000-0x00007FF850571000-memory.dmp

Filesize
10.8MB

Download
memory/2432-151-0x000002B260AD0000-0x000002B260AE0000-memory.dmp

Filesize
64KB

Download
memory/2432-150-0x000002B260AD0000-0x000002B260AE0000-memory.dmp

Filesize
64KB

Download
memory/2432-152-0x000002B260AD0000-0x000002B260AE0000-memory.dmp

Filesize
64KB

Download
memory/2432-155-0x00007FF84FAB0000-0x00007FF850571000-memory.dmp

Filesize
10.8MB

Download
memory/3960-133-0x0000000000400000-0x00000000005E7000-memory.dmp

Filesize
1.9MB

Download
memory/3960-134-0x0000000010000000-0x00000000101F2000-memory.dmp

Filesize
1.9MB

Download
memory/3960-157-0x0000000000400000-0x00000000005E7000-memory.dmp

Filesize
1.9MB

Download