BEDaisy[.]sys | Triage

Sharing

Copy URL Twitter E-mail

General

Target

BEDaisy.sys
Size

3.2MB
MD5

e00e5b9b0e95ce7673c0e35fe84d17bd
SHA1

92fd0776ac33b71972c80357ee9a5c1af04a7e5a
SHA256

49d7c335b19b6b6ba58619583567dbca4c4d0ec22e96eb74106aae5aa3b631c9
SHA512

44664e7be3f5612481a1bb2f60039d07c6259adbbd7fa2d5468bb7aa4a513bca4985ddd0ae799785d4a848efc348dbad2ff12a5200358f073fa12ccacb34b80d
SSDEEP

98304:iZpdCsSHC4A9wURxmmoJZuB1wHl+6OLbrsJMLh3:iZkdA99xAubwFpzMN3

Score

1^/10

Malware Config

Signatures

Files

BEDaisy.sys
.sys windows:10 windows x64

6bc24a83943ce059ec35e19bee177eb6

Code Sign

33:00:00:00:4e:59:56:10:83:2b:4e:0c:6c:00:00:00:00:00:4e
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

09/09/2021, 19:16

Not After

01/09/2022, 19:16

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:68:3e:6a:d0:cd:a9:b4:47:5c:f8:ae:1d:7d:21:33
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

28/10/2021, 00:00

Not After

25/11/2024, 23:59

Subject

CN=BattlEye Innovations e.K.,O=BattlEye Innovations e.K.,L=Reutlingen,ST=Baden-Württemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4d:8c:c9:6d:f5:d8:1b:44:63:f3:43:7f:5b:a2:e6:d0:7c:aa:9a:2a:ae:d9:21:9f:16:4d:01:ce:4b:3d:2d:07
Signer

Actual PE Digest

4d:8c:c9:6d:f5:d8:1b:44:63:f3:43:7f:5b:a2:e6:d0:7c:aa:9a:2a:ae:d9:21:9f:16:4d:01:ce:4b:3d:2d:07

Digest Algorithm

sha256

PE Digest Matches

true

4d:8c:c9:6d:f5:d8:1b:44:63:f3:43:7f:5b:a2:e6:d0:7c:aa:9a:2a:ae:d9:21:9f:16:4d:01:ce:4b:3d:2d:07
Signer

Actual PE Digest

4d:8c:c9:6d:f5:d8:1b:44:63:f3:43:7f:5b:a2:e6:d0:7c:aa:9a:2a:ae:d9:21:9f:16:4d:01:ce:4b:3d:2d:07

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

fltmgr.sys

FltGetRoutineAddress

ntoskrnl.exe

MmGetSystemRoutineAddress
__C_specific_handler
__chkstk
MmMapLockedPagesSpecifyCache
KeBugCheckEx

Sections

.text
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 512B - Virtual size: 434B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.be0
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6bc24a83943ce059ec35e19bee177eb6

Code Sign

33:00:00:00:4e:59:56:10:83:2b:4e:0c:6c:00:00:00:00:00:4eCertificate

Extended Key Usages

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0dCertificate

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0d:68:3e:6a:d0:cd:a9:b4:47:5c:f8:ae:1d:7d:21:33Certificate

Extended Key Usages

Key Usages

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9dCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

4d:8c:c9:6d:f5:d8:1b:44:63:f3:43:7f:5b:a2:e6:d0:7c:aa:9a:2a:ae:d9:21:9f:16:4d:01:ce:4b:3d:2d:07Signer

4d:8c:c9:6d:f5:d8:1b:44:63:f3:43:7f:5b:a2:e6:d0:7c:aa:9a:2a:ae:d9:21:9f:16:4d:01:ce:4b:3d:2d:07Signer

Headers

DLL Characteristics

File Characteristics

Imports

fltmgr.sys

ntoskrnl.exe

Sections

.text Size: 75KB - Virtual size: 75KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 512B - Virtual size: 3KB

.pdata Size: 1KB - Virtual size: 1KB

INIT Size: 512B - Virtual size: 434B

.be0 Size: 3.1MB - Virtual size: 3.1MB

.reloc Size: 512B - Virtual size: 192B

33:00:00:00:4e:59:56:10:83:2b:4e:0c:6c:00:00:00:00:00:4e
Certificate

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0d:68:3e:6a:d0:cd:a9:b4:47:5c:f8:ae:1d:7d:21:33
Certificate

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

4d:8c:c9:6d:f5:d8:1b:44:63:f3:43:7f:5b:a2:e6:d0:7c:aa:9a:2a:ae:d9:21:9f:16:4d:01:ce:4b:3d:2d:07
Signer

4d:8c:c9:6d:f5:d8:1b:44:63:f3:43:7f:5b:a2:e6:d0:7c:aa:9a:2a:ae:d9:21:9f:16:4d:01:ce:4b:3d:2d:07
Signer

.text
Size: 75KB - Virtual size: 75KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 3KB

.pdata
Size: 1KB - Virtual size: 1KB

INIT
Size: 512B - Virtual size: 434B

.be0
Size: 3.1MB - Virtual size: 3.1MB

.reloc
Size: 512B - Virtual size: 192B