zamguard64[.]sys

Resubmissions

10-06-2023 20:18

230610-y3deeafg28 1

10-06-2023 20:18

230610-y28txsfg27 1

10-06-2023 20:17

230610-y2xfwsfg25 1

10-06-2023 19:53

230610-ymgrwsgd8z 1

Sharing

Copy URL

Twitter E-mail

General

Target

zamguard64.sys
Size

198KB
MD5

21e13f2cb269defeae5e1d09887d47bb
SHA1

16d7ecf09fc98798a6170e4cef2745e0bee3f5c7
SHA256

543991ca8d1c65113dff039b85ae3f9a87f503daec30f46929fd454bc57e5a91
SHA512

b1aa515c7b9b8c555815fa66bcb4796d39e38d2d1dc2fe0ed561e04bcd52a26996b85c6237eb966c93f8dbecbbdf6c405f14cf29943b031154113a551b241a6a
SSDEEP

3072:uIYCsz96ZvVJ9b9sJCfShQ0/COLYYfUFtKXFZHOaIKyAYrPcQL9Rsm:uhCS8Bh3SaeCWYE1Oncovsm

Score

1^/10

Malware Config

Signatures

Files

zamguard64.sys
.exe windows x64

1ef6998f22f7e6046b4905d4e21773b7

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

02:10:23:0f:d3:64:b4:69:09:1b:8a:44:40:14:5e:18
Certificate

Issuer

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

16-12-2014 00:00

Not After

20-12-2017 12:00

Subject

CN=Zemana Ltd.,O=Zemana Ltd.,L=Edirne,C=TR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15-04-2011 19:45

Not After

15-04-2021 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-02-2011 12:00

Not After

10-02-2026 12:00

Subject

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:15:b7:de:0f:11:29:b5:40:f4:8d:7a:3c:ba:2c:6b:f5:d4:41:12
Signer

Actual PE Digest

0d:15:b7:de:0f:11:29:b5:40:f4:8d:7a:3c:ba:2c:6b:f5:d4:41:12

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

FsRtlIsNameInExpression
PsGetProcessImageFileName
ZwQueryInformationProcess
__C_specific_handler
strchr
RtlAppendUnicodeToString
KeInitializeSemaphore
KeReleaseSemaphore
KeWaitForSingleObject
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
PsCreateSystemThread
PsTerminateSystemThread
ZwQueryInformationFile
ZwWriteFile
PsGetCurrentThreadId
ZwDeleteFile
_vsnprintf
PsThreadType
PsSetCreateProcessNotifyRoutine
PsGetProcessSessionId
RtlAppendUnicodeStringToString
ZwDeleteValueKey
ZwSetValueKey
towupper
RtlIntegerToUnicodeString
KeInitializeEvent
KeSetEvent
KeAcquireSpinLockAtDpcLevel
KeReleaseSpinLockFromDpcLevel
MmProbeAndLockPages
IoAllocateIrp
IoAllocateMdl
IofCallDriver
IoFreeIrp
IoFreeMdl
IoGetDeviceObjectPointer
IoGetRelatedDeviceObject
ObCloseHandle
ObfReferenceObject
ZwSetInformationFile
ZwReadFile
ZwOpenSymbolicLinkObject
ZwQuerySymbolicLinkObject
IoCreateFileSpecifyDeviceObjectHint
IoGetDeviceAttachmentBaseRef
FsRtlGetFileSize
ObQueryNameString
IoFileObjectType
KeReadStateEvent
ExQueueWorkItem
ExGetPreviousMode
MmGetSystemRoutineAddress
NtOpenProcess
ZwCreateEvent
ZwWaitForSingleObject
ZwSetEvent
NtQuerySystemInformation
ExEventObjectType
NtBuildNumber
ZwDeleteKey
ObReferenceObjectByName
IoDriverObjectType
MmIsDriverVerifying
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
RtlSetDaclSecurityDescriptor
MmMapLockedPagesSpecifyCache
PsGetProcessId
IoThreadToProcess
PsGetCurrentProcessSessionId
ZwTerminateProcess
KeStackAttachProcess
KeUnstackDetachProcess
ZwOpenThread
PsProcessType
ExInterlockedInsertHeadList
ExInterlockedRemoveHeadList
CmRegisterCallback
CmUnRegisterCallback
RtlCreateRegistryKey
ZwOpenKey
ZwEnumerateKey
ZwQueryKey
ZwQueryValueKey
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
ProbeForWrite
PsSetLoadImageNotifyRoutine
PsRemoveLoadImageNotifyRoutine
PsGetProcessSectionBaseAddress
MmSystemRangeStart
KeBugCheckEx
PsLookupProcessByProcessId
ZwOpenProcess
PsGetCurrentProcessId
RtlUpcaseUnicodeString
RtlUpperString
ZwClose
ZwCreateFile
ObfDereferenceObject
ObReferenceObjectByHandle
ProbeForRead
ExFreePoolWithTag
ExAllocatePoolWithTag
KeDelayExecutionThread
RtlGetVersion
DbgPrint
RtlCopyUnicodeString
RtlInitUnicodeString
wcsstr
ZwQuerySystemInformation
strstr

fltmgr.sys

FltSendMessage
FltCloseCommunicationPort
FltCreateCommunicationPort
FltReleaseContext
FltGetStreamHandleContext
FltSetStreamHandleContext
FltAllocateContext
FltCancelFileOpen
FltQueryInformationFile
FltReadFile
FltParseFileNameInformation
FltReleaseFileNameInformation
FltGetFileNameInformation
FltFreePoolAlignedWithTag
FltAllocatePoolAlignedWithTag
FltStartFiltering
FltUnregisterFilter
FltRegisterFilter
FltBuildDefaultSecurityDescriptor

Sections

.text
Size: 134KB - Virtual size: 133KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.hook
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 335KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 616B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

1ef6998f22f7e6046b4905d4e21773b7

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

02:10:23:0f:d3:64:b4:69:09:1b:8a:44:40:14:5e:18Certificate

Extended Key Usages

Key Usages

61:20:4d:b4:00:00:00:00:00:27Certificate

Key Usages

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5fCertificate

Extended Key Usages

Key Usages

0d:15:b7:de:0f:11:29:b5:40:f4:8d:7a:3c:ba:2c:6b:f5:d4:41:12Signer

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

fltmgr.sys

Sections

.text Size: 134KB - Virtual size: 133KB

.hook Size: 2KB - Virtual size: 2KB

.rdata Size: 18KB - Virtual size: 17KB

.data Size: 26KB - Virtual size: 335KB

.pdata Size: 2KB - Virtual size: 2KB

INIT Size: 4KB - Virtual size: 4KB

.rsrc Size: 1024B - Virtual size: 616B

.reloc Size: 512B - Virtual size: 96B

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

02:10:23:0f:d3:64:b4:69:09:1b:8a:44:40:14:5e:18
Certificate

61:20:4d:b4:00:00:00:00:00:27
Certificate

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f
Certificate

0d:15:b7:de:0f:11:29:b5:40:f4:8d:7a:3c:ba:2c:6b:f5:d4:41:12
Signer

.text
Size: 134KB - Virtual size: 133KB

.hook
Size: 2KB - Virtual size: 2KB

.rdata
Size: 18KB - Virtual size: 17KB

.data
Size: 26KB - Virtual size: 335KB

.pdata
Size: 2KB - Virtual size: 2KB

INIT
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 1024B - Virtual size: 616B

.reloc
Size: 512B - Virtual size: 96B