butldsk[.]sys | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

butldsk.sys
Size

187KB
MD5

af745afaab59d48074a479d6a65024c7
SHA1

3e4572da1729c2fe9ac18ecccf8cb7a7e232307d
SHA256

1b59d4a0e6bebf7f6db66749cefc8280937a5f0851b918c7e3320a742166915c
SHA512

bfa7bc468561ac4beb8c6428c4842314b1f7cd2788edc0a250f81d7a5aaa6e1d1bd974a798c7972565ca2bf13d81bbc04c15a89cb48daa46aad405406f0fce96
SSDEEP

3072:jisENQxXX9Ehr+i9Ms7eFpUwW3uKyMPYMqqDL2/0w3VNQL5p6d6p:HgqhpguETqqDL6peTn

Score

1^/10

Malware Config

Signatures

Files

butldsk.sys
.sys windows:6 windows x64 arch:x64

387f72d1ffe6ecf7c2842bcfd1b636e1

Code Sign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

67:2b:8e:1e:4d:a3:3c:58:e1:bd:43:f2:5f:cf:3e:d9
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

02/03/2018, 00:00

Not After

02/03/2019, 23:59

Subject

CN=Harmaton Limited,OU=IT,O=Harmaton Limited,L=London,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:1f:b0:a4:00:00:00:00:00:1d
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:31

Not After

22/02/2021, 19:41

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

f0:99:68:ad:4e:88:ea:42:81:33:23:47:aa:3e:ee:9a:c9:db:00:33:0b:89:b7:16:e3:36:13:55:c0:97:3a:5b
Signer

Actual PE Digest

f0:99:68:ad:4e:88:ea:42:81:33:23:47:aa:3e:ee:9a:c9:db:00:33:0b:89:b7:16:e3:36:13:55:c0:97:3a:5b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\pdb\butldsk.pdb

Imports

ntoskrnl.exe

ZwFsControlFile
ZwReadFile
KeSetPriorityThread
IoGetRelatedDeviceObject
RtlInitUnicodeString
IoDeleteDevice
KeSetEvent
KeInitializeEvent
wcsncat
ZwOpenProcessToken
ZwAdjustPrivilegesToken
ZwSetInformationFile
KeSetTimerEx
SeCreateClientSecurity
ZwCreateFile
PsCreateSystemThread
MmMapLockedPagesSpecifyCache
ExInterlockedInsertTailList
PsTerminateSystemThread
ZwClose
IofCompleteRequest
ObReferenceObjectByHandle
KeWaitForSingleObject
SeImpersonateClientEx
PsRevertToSelf
ExInterlockedRemoveHeadList
IoIsWdmVersionAvailable
PsDereferenceImpersonationToken
IoCreateSymbolicLink
ObfDereferenceObject
KeInitializeTimerEx
ExFreePoolWithTag
ZwWriteFile
ObOpenObjectByPointer
DbgPrint
PsDereferencePrimaryToken
IofCallDriver
SeTokenType
KeBugCheckEx
MmGetSystemRoutineAddress
IoCreateDevice
ZwSetSecurityObject
IoDeviceObjectType
_snwprintf
RtlLengthSecurityDescriptor
SeCaptureSecurityDescriptor
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlAbsoluteToSelfRelativeSD
SeExports
wcschr
_wcsnicmp
RtlLengthSid
RtlAddAccessAllowedAce
RtlGetSaclSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
ZwOpenKey
ZwCreateKey
ZwQueryValueKey
ZwSetValueKey
RtlFreeUnicodeString
IoDeleteSymbolicLink
IoBuildDeviceIoControlRequest
ZwQueryInformationFile
ExAllocatePoolWithTag
ProbeForRead
ProbeForWrite
RtlAppendUnicodeToString
MmProtectMdlSystemAddress
IoFreeMdl
ExEventObjectType
MmProbeAndLockPages
RtlCompareMemory
MmUnlockPages
PsGetCurrentProcessId
IoAllocateMdl
RtlTimeToSecondsSince1970
ZwWaitForSingleObject
RtlAnsiStringToUnicodeString
RtlInitAnsiString
RtlUnicodeStringToAnsiString
RtlCompareString
_vsnprintf
ZwMapViewOfSection
RtlGetVersion
ExSystemTimeToLocalTime
ZwSetEvent
_vsnwprintf
RtlTimeToTimeFields
RtlFreeAnsiString
RtlCompareUnicodeString
ZwCreateSection
ZwOpenSection
ZwEnumerateKey
KeInitializeMutex
isspace
strstr
strchr
KeReleaseMutex
ExInitializeNPagedLookasideList
ExpInterlockedPushEntrySList
ExpInterlockedPopEntrySList
KeDelayExecutionThread
IoFileObjectType
ExDeletePagedLookasideList
ZwFreeVirtualMemory
ExQueryDepthSList
ZwOpenProcess
ZwQueryInformationProcess
RtlCopyUnicodeString
ExInitializePagedLookasideList
ZwOpenFile
IoQueryFileDosDeviceName
ExDeleteNPagedLookasideList
ZwAllocateVirtualMemory
RtlAppendUnicodeStringToString
ExDeleteResourceLite
ExInitializeResourceLite
ZwDeleteKey
RtlRandomEx
ZwOpenEvent
ZwCreateEvent
IoWMIQueryAllData
IoWMIOpenBlock
RtlUnicodeStringToInteger
IoReuseIrp
KeResetEvent
KeReadStateEvent
KeReleaseInStackQueuedSpinLock
KeAcquireInStackQueuedSpinLock
IoCancelIrp
IoFreeIrp
IoAllocateIrp
KeWaitForMultipleObjects
IoDriverObjectType
wcsstr
ObReferenceObjectByName
IoGetDeviceProperty
__C_specific_handler

netio.sys

WskDeregister
WskCaptureProviderNPI
WskRegister
WskReleaseProviderNPI

Sections

.text
Size: 102KB - Virtual size: 102KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

387f72d1ffe6ecf7c2842bcfd1b636e1

Code Sign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cbCertificate

Extended Key Usages

Key Usages

67:2b:8e:1e:4d:a3:3c:58:e1:bd:43:f2:5f:cf:3e:d9Certificate

Extended Key Usages

Key Usages

61:1f:b0:a4:00:00:00:00:00:1dCertificate

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6Certificate

Extended Key Usages

Key Usages

f0:99:68:ad:4e:88:ea:42:81:33:23:47:aa:3e:ee:9a:c9:db:00:33:0b:89:b7:16:e3:36:13:55:c0:97:3a:5bSigner

Headers

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

netio.sys

Sections

.text Size: 102KB - Virtual size: 102KB

.rdata Size: 42KB - Virtual size: 41KB

.data Size: 10KB - Virtual size: 14KB

.pdata Size: 4KB - Virtual size: 4KB

PAGE Size: 14KB - Virtual size: 14KB

INIT Size: 5KB - Virtual size: 4KB

.reloc Size: 512B - Virtual size: 120B

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

67:2b:8e:1e:4d:a3:3c:58:e1:bd:43:f2:5f:cf:3e:d9
Certificate

61:1f:b0:a4:00:00:00:00:00:1d
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

f0:99:68:ad:4e:88:ea:42:81:33:23:47:aa:3e:ee:9a:c9:db:00:33:0b:89:b7:16:e3:36:13:55:c0:97:3a:5b
Signer

.text
Size: 102KB - Virtual size: 102KB

.rdata
Size: 42KB - Virtual size: 41KB

.data
Size: 10KB - Virtual size: 14KB

.pdata
Size: 4KB - Virtual size: 4KB

PAGE
Size: 14KB - Virtual size: 14KB

INIT
Size: 5KB - Virtual size: 4KB

.reloc
Size: 512B - Virtual size: 120B