AsIO3[.]sys | Triage

Sharing

Copy URL Twitter E-mail

General

Target

AsIO3.sys
Size

42KB
MD5

370a4ca29a7cf1d6bc0744afc12b236c
SHA1

cfa85a19d9a2f7f687b0decdc4a5480b6e30cb8c
SHA256

c344e92a6d06155a217a9af7b4b35e6653665eec6569292e7b2e70f3a3027646
SHA512

21f87b259ed563dfe06f93c11dc0a5faae68de3fbda64f14cc7005df0abcd4ea75c4645ec3fe9af118c9efb77ee1e5cbe430a09c829a2ea9e00b94eab6e4c0a7
SSDEEP

384:uWrgLEFy9gnMU7EqKeVT8ywEixFhxKAjpFX/LVbxp8G4bWi8N1kNpEZUXSL+3Lyg:SLIKxXy9g1zVr8RplX5BPKgUp33vL4

Score

1^/10

Malware Config

Signatures

Files

AsIO3.sys
.exe windows x64

f0cd7cce1d03cf9df1b8266701f92b46

Code Sign

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:45

Not After

15/04/2021, 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:64:96:2e:44:67:ed:cc:15:79:64:6b:73:37:ec:8c
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/04/2019, 00:00

Not After

11/01/2022, 12:00

Subject

SERIALNUMBER=23638777,CN=ASUSTeK Computer Inc.,O=ASUSTeK Computer Inc.,L=Taipei City,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:3a:6a:e3:33:70:8f:da:7a:7b:00:00:00:00:00:3a
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/03/2020, 17:31

Not After

05/03/2021, 17:31

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9b:1a:f0:50:48:1b:da:27:0a:08:ae:87:32:24:a1:42:c8:b2:11:9e:ed:a5:9d:3a:04:b1:f6:d6:67:15:a8:c8
Signer

Actual PE Digest

9b:1a:f0:50:48:1b:da:27:0a:08:ae:87:32:24:a1:42:c8:b2:11:9e:ed:a5:9d:3a:04:b1:f6:d6:67:15:a8:c8

Digest Algorithm

sha256

PE Digest Matches

true

9b:1a:f0:50:48:1b:da:27:0a:08:ae:87:32:24:a1:42:c8:b2:11:9e:ed:a5:9d:3a:04:b1:f6:d6:67:15:a8:c8
Signer

Actual PE Digest

9b:1a:f0:50:48:1b:da:27:0a:08:ae:87:32:24:a1:42:c8:b2:11:9e:ed:a5:9d:3a:04:b1:f6:d6:67:15:a8:c8

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

DbgPrint
RtlGetVersion
KeDelayExecutionThread
ExAllocatePoolWithTag
ExFreePoolWithTag
MmGetSystemRoutineAddress
MmAllocateContiguousMemory
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
RtlCopyUnicodeString
ObReferenceObjectByHandle
ObfDereferenceObject
ZwClose
ZwOpenSection
ZwMapViewOfSection
ZwUnmapViewOfSection
MmGetPhysicalAddress
ZwOpenFile
ZwQueryInformationFile
ZwReadFile
__C_specific_handler
KeBugCheckEx
IoIs32bitProcess
RtlInitUnicodeString

hal

HalTranslateBusAddress

Sections

.text
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 656B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 360B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f0cd7cce1d03cf9df1b8266701f92b46

Code Sign

61:20:4d:b4:00:00:00:00:00:27Certificate

Key Usages

0c:64:96:2e:44:67:ed:cc:15:79:64:6b:73:37:ec:8cCertificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

33:00:00:00:3a:6a:e3:33:70:8f:da:7a:7b:00:00:00:00:00:3aCertificate

Extended Key Usages

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0dCertificate

Key Usages

9b:1a:f0:50:48:1b:da:27:0a:08:ae:87:32:24:a1:42:c8:b2:11:9e:ed:a5:9d:3a:04:b1:f6:d6:67:15:a8:c8Signer

9b:1a:f0:50:48:1b:da:27:0a:08:ae:87:32:24:a1:42:c8:b2:11:9e:ed:a5:9d:3a:04:b1:f6:d6:67:15:a8:c8Signer

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 18KB - Virtual size: 17KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 512B - Virtual size: 656B

.pdata Size: 512B - Virtual size: 360B

INIT Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 20B

61:20:4d:b4:00:00:00:00:00:27
Certificate

0c:64:96:2e:44:67:ed:cc:15:79:64:6b:73:37:ec:8c
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

33:00:00:00:3a:6a:e3:33:70:8f:da:7a:7b:00:00:00:00:00:3a
Certificate

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

9b:1a:f0:50:48:1b:da:27:0a:08:ae:87:32:24:a1:42:c8:b2:11:9e:ed:a5:9d:3a:04:b1:f6:d6:67:15:a8:c8
Signer

9b:1a:f0:50:48:1b:da:27:0a:08:ae:87:32:24:a1:42:c8:b2:11:9e:ed:a5:9d:3a:04:b1:f6:d6:67:15:a8:c8
Signer

.text
Size: 18KB - Virtual size: 17KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 656B

.pdata
Size: 512B - Virtual size: 360B

INIT
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 20B