DCRCVDrv[.]sys | Triage™

General

Target
DCRCVDrv.sys
Size 137KB
Sample260809-th4cwabc45
SHA256 87e8d39db624f37d3e77aedf487a2dfd197f71a4730ea74f4e7a4341deaec2ff
MD5 567c158ee0858f8e941d4ab7a6c18dbc
SHA1 47d922b0fd5d704025d14ef98ded46e74830a423
SHA512 f976cb8e9a2f0fc769e2e4345d18e1e9f01fdb1c4303eb20d94b625467e60ce20dd120e77a96d9ba498361dd6dc0066535404cb22cf99fc49607d1f35eaed2ab
SSDEEP 3072:6pEFTp46B6ETbeP/ItLK9Di8/4BQaeJzP:Y8Tp46B6EOLgBQX
TLSH
T10CD33A12A36550A4E977E2B8C6B65263EFF37861133547CF03608A654F23BE4B93A3D1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

DCRCVDrv.sys

.sys 137KB

DCRCVDrv.sys

IMPHASH 45cd0d715c29e77c1b7a5cc6041914e7
SHA256 87e8d39db624f37d3e77aedf487a2dfd197f71a4730ea74f4e7a4341deaec2ff
MD5 567c158ee0858f8e941d4ab7a6c18dbc
SHA1 47d922b0fd5d704025d14ef98ded46e74830a423
SHA512 f976cb8e9a2f0fc769e2e4345d18e1e9f01fdb1c4303eb20d94b625467e60ce20dd120e77a96d9ba498361dd6dc0066535404cb22cf99fc49607d1f35eaed2ab
SSDEEP 3072:6pEFTp46B6ETbeP/ItLK9Di8/4BQaeJzP:Y8Tp46B6EOLgBQX
TLSH
T10CD33A12A36550A4E977E2B8C6B65263EFF37861133547CF03608A654F23BE4B93A3D1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

2a:7e:d8:d0:be:70:e0:66:7a:a1:4e:16:1a:e1:dc:6b:7d:aa:eb:14:38:b5:34:d7:3b:10:93:c0:b4:4d:78:a2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Dec 16, 2022

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 10, 2022 - Mar 8, 2023

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0b:aa:c1:00:00:00:00:00:09

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:179E-4BB0-8246,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:b5:ad:1a:df:d7:85:70:6d:13:00:01:00:00:01:b5

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 20, 2022 - Dec 14, 2023

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

6

Entry point

172040

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\svn\neovmscm64project\trunk\dcrcvproject\neovmdrv\objfre_wlh_amd64\amd64\DCRCVDrv64.pdb

ntoskrnl.exe

PsLookupProcessByProcessId ZwQuerySymbolicLinkObject IoGetRelatedDeviceObject RtlInitUnicodeString IoDeleteDevice ExpInterlockedPushEntrySList MmGetSystemRoutineAddress ExpInterlockedPopEntrySList ZwOpenSymbolicLinkObject IoAllocateErrorLogEntry ObQueryNameString strncpy IoFileObjectType ZwCreateFile wcsrchr IoGetCurrentProcess ExEventObjectType ZwClose ExQueryDepthSList ObReferenceObjectByHandle IoAttachDeviceToDeviceStack PsGetVersion ZwOpenProcess ObfReferenceObject ObfDereferenceObject IoCreateDevice ZwTerminateProcess ObOpenObjectByPointer DbgPrint ExDeleteNPagedLookasideList IoUnregisterFsRegistrationChange IoRegisterFsRegistrationChange IoDeleteSymbolicLink IoIs32bitProcess IofCompleteRequest IoCreateSymbolicLink _wcsicmp PsSetLoadImageNotifyRoutine _wcsnicmp KeSetEvent PsSetCreateThreadNotifyRoutine ExInitializeNPagedLookasideList PsSetCreateProcessNotifyRoutine KeAcquireSpinLockRaiseToDpc PsGetCurrentProcessId ExReleaseFastMutex ExAcquireFastMutex KeInitializeEvent KeWaitForSingleObject ZwFsControlFile wcsncpy ZwSetInformationFile wcsstr ZwQueryDirectoryFile ZwOpenFile ZwQueryInformationFile ZwReadFile ZwQuerySecurityObject ZwWriteFile ZwCreateKey ZwSetValueKey ZwDeleteKey ZwEnumerateKey ZwOpenKey IoDetachDevice ZwQueryValueKey PoStartNextPowerIrp PoCallDriver RtlCompareMemory IofCallDriver MmBuildMdlForNonPagedPool IoFreeMdl IoFreeIrp IoAttachDevice IoAllocateIrp IoAllocateMdl ZwEnumerateValueKey ExGetPreviousMode PsProcessType KeBugCheckEx IoWriteErrorLogEntry ExFreePoolWithTag ExAllocatePoolWithTag _strnicmp _stricmp KeReleaseSpinLock ZwOpenEvent RtlAnsiCharToUnicodeChar __C_specific_handler

tdi.sys

TdiMapUserRequest

fltmgr.sys

FltSetCallbackDataDirty FltStartFiltering FltRegisterFilter FltGetVolumeName

Name

.text

Size

114KB

Virtual Size

113KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

864B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

132B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

DCRCVDrv.sys

ntoskrnl.exe

tdi.sys

fltmgr.sys

generic