{"DetectionScope":"context-only","ResearchEvidence":{"Id":"33a9c9ae-5ca3-442d-9f0f-2615637c1c57","Tags":["ntbios_2.sys"],"Verified":"TRUE","Author":"Michael Haag","Created":"2023-02-28","MitreID":"T1068","Category":"malicious","Commands":{"Command":"sc.exe create ntbios_2.sys binPath=C:\\windows\\temp \\n \\n \\n  tbios_2.sys type=kernel && sc.exe start ntbios_2.sys","Description":"Driver used in the Daxin malware campaign.","OperatingSystem":"Windows 10","Privileges":"kernel","Usecase":"Elevate privileges"},"Resources":["https://gist.github.com/MHaggis/9ab3bb795a6018d70fb11fa7c31f8f48","https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/daxin-backdoor-espionage",""],"Detection":[{"type":"yara_signature","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/c0d88db11d0f529754d290ed5f4c34b4dba8c4f2e5c4148866daabeab0d25f9c.yara"},{"type":"sigma_hash","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"},{"type":"sigma_names","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"},{"type":"sysmon_hash_detect","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"},{"type":"sysmon_hash_block","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"},{"type":"yara_signature","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_mal_drivers_strict.yar"},{"type":"sigma_hash","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"},{"type":"sigma_names","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"},{"type":"sysmon_hash_detect","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"},{"type":"sysmon_hash_block","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"}],"Acknowledgement":{"Handle":"","Person":""},"KnownVulnerableSamples":[{"Authentihash":{"MD5":"a8e3b56b72814a842b557bfb6638b484","SHA1":"50231e21b8d8b2916d0fd53f3f58c6314473de1f","SHA256":"59177fb7a0b11837368af1cc115f0d011ea19551070bd153795204ae1bd12e52"},"Company":"Microsoft Corporation","Copyright":"版权所有 (C) 2003","CreationTimestamp":"2009-05-17 23:04:06","Date":"","Description":"ntbios driver","ExportedFunctions":"","FileVersion":"5, 0, 2, 1","Filename":"ntbios_2.sys","ImportedFunctions":["MmUnlockPages","MmProbeAndLockPages","IoAllocateMdl","IoQueueWorkItem","IoAllocateWorkItem","IoGetCurrentProcess","_stricmp","IoFreeWorkItem","RtlFreeUnicodeString","ZwClose","ZwWriteFile","ZwCreateFile","RtlAnsiStringToUnicodeString","_strnicmp","RtlUnwind","RtlCopyUnicodeString","wcsncmp","swprintf","IoCreateDevice","IoCreateSymbolicLink","KeInitializeSpinLock","ExfInterlockedInsertTailList","RtlInitUnicodeString","MmMapLockedPagesSpecifyCache","IoFreeMdl","InterlockedDecrement","InterlockedIncrement","InterlockedExchange","IoDeleteSymbolicLink","IoDeleteDevice","ExfInterlockedRemoveHeadList","IofCompleteRequest","ExAllocatePoolWithTag","strncmp","ExFreePool","KfAcquireSpinLock","KfReleaseSpinLock","KeInitializeApc","KeInsertQueueApc","KeAttachProcess","KeDetachProcess","NtQuerySystemInformation","NdisAllocatePacket","NdisCopyFromPacketToPacket","NdisAllocateMemory","NdisFreePacket","NdisAllocateBuffer","NdisSetEvent","NdisResetEvent","NdisFreeBufferPool","NdisFreePacketPool","NdisFreeMemory","NdisWaitEvent","NdisQueryAdapterInstanceName","NdisOpenAdapter","NdisInitializeEvent","NdisAllocatePacketPool","NdisRegisterProtocol","NdisAllocateBufferPool","NdisCloseAdapter","NdisDeregisterProtocol"],"Imports":["NTOSKRNL.EXE","HAL.DLL","ntoskrnl.exe","NDIS.SYS"],"InternalName":"ntbio.sys","MD5":"50b39072d0ee9af5ef4824eca34be6e3","MachineType":"I386","MagicHeader":"50 45 0 0","OriginalFilename":"ntbios.sys","Product":" Microsoft(R) Windows (R) NT Operating System","ProductVersion":"5, 0, 2, 1","Publisher":"n/a","RichPEHeaderHash":{"MD5":"ebd225fe8cf34907033d6b6123047339","SHA1":"642936e6d95c6231c8427a1c7a76dd99910fc635","SHA256":"b04e0a7d507b0838174bb9df686e4ce60c5b81e183867441ed5951a5d3555510"},"SHA1":"064de88dbbea67c149e779aac05228e5405985c7","SHA256":"c0d88db11d0f529754d290ed5f4c34b4dba8c4f2e5c4148866daabeab0d25f9c","Sections":{".text":{"Entropy":6.39712903422247,"Virtual Size":"0x39c8"},".rdata":{"Entropy":4.150368588724922,"Virtual Size":"0x221"},".data":{"Entropy":1.9267671732967222,"Virtual Size":"0x4eb9c"},"INIT":{"Entropy":5.1775498523671,"Virtual Size":"0x67c"},".rsrc":{"Entropy":3.325586936369158,"Virtual Size":"0x370"},".reloc":{"Entropy":4.179231503019422,"Virtual Size":"0x774"}},"Signature":"Unsigned","Signatures":{},"Imphash":"a7bd820fa5b895fab06f20739c9f24b8","LoadsDespiteHVCI":"TRUE"}]}}