{"Id":"3d1439e9-9a7d-497a-8c6c-74513f825d6a","Tags":["daxin_blank6.sys"],"Verified":"TRUE","Author":"Michael Haag","Created":"2023-02-28","MitreID":"T1068","Category":"malicious","Commands":{"Command":"sc.exe create daxin_blank6.sys binPath=C:\\windows\\temp\\daxin_blank6.sys     type=kernel && sc.exe start daxin_blank6.sys","Description":"Driver used in the Daxin malware campaign.","OperatingSystem":"Windows 10","Privileges":"kernel","Usecase":"Elevate privileges"},"Resources":["https://gist.github.com/MHaggis/9ab3bb795a6018d70fb11fa7c31f8f48","https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/daxin-backdoor-espionage",""],"Detection":[],"Acknowledgement":{"Handle":"","Person":""},"KnownVulnerableSamples":[{"Authentihash":{"MD5":"d59fbf4aa759286d1dd9abb40733f7b2","SHA1":"3c34c7c5916b987420fbfb4f3e3fef7400471831","SHA256":"a8c558e74ebe35a095a5b79d4bb26c10b18f8ebb449365e742f856d4e032555c"},"Company":"","Copyright":"","CreationTimestamp":"2009-03-25 22:44:42","Date":"","Description":"","ExportedFunctions":"","FileVersion":"","Filename":"daxin_blank6.sys","ImportedFunctions":["MmUnlockPages","MmProbeAndLockPages","IoAllocateMdl","IoQueueWorkItem","IoAllocateWorkItem","IoGetCurrentProcess","_stricmp","IoFreeWorkItem","RtlFreeUnicodeString","ZwClose","ZwWriteFile","ZwCreateFile","RtlAnsiStringToUnicodeString","_strnicmp","RtlUnwind","RtlCopyUnicodeString","wcsncmp","swprintf","IoCreateDevice","IoCreateSymbolicLink","KeInitializeSpinLock","ExfInterlockedInsertTailList","RtlInitUnicodeString","MmMapLockedPagesSpecifyCache","IoFreeMdl","InterlockedDecrement","InterlockedIncrement","InterlockedExchange","IoDeleteSymbolicLink","IoDeleteDevice","ExfInterlockedRemoveHeadList","IofCompleteRequest","ExAllocatePoolWithTag","strncmp","ExFreePool","KfAcquireSpinLock","KfReleaseSpinLock","KeInitializeApc","KeInsertQueueApc","KeAttachProcess","KeDetachProcess","NtQuerySystemInformation","NdisAllocatePacket","NdisCopyFromPacketToPacket","NdisAllocateMemory","NdisFreePacket","NdisAllocateBuffer","NdisSetEvent","NdisResetEvent","NdisFreeBufferPool","NdisFreePacketPool","NdisFreeMemory","NdisWaitEvent","NdisQueryAdapterInstanceName","NdisOpenAdapter","NdisInitializeEvent","NdisAllocatePacketPool","NdisRegisterProtocol","NdisAllocateBufferPool","NdisCloseAdapter","NdisDeregisterProtocol"],"Imports":["NTOSKRNL.EXE","HAL.DLL","ntoskrnl.exe","NDIS.SYS"],"InternalName":"","MD5":"0ae30291c6cbfa7be39320badd6e8de0","MachineType":"I386","MagicHeader":"50 45 0 0","OriginalFilename":"","Product":"","ProductVersion":"","Publisher":"n/a","RichPEHeaderHash":{"MD5":"909f63d34ab6d10273023d528b1722a0","SHA1":"2e7dbeb35bb60bf672f840375926888760d4ad58","SHA256":"64d9f0289f8d52b49a1beb95e9248e2e08d06e94c9d2fc86b3b85536cf7697c1"},"SHA1":"c257aa4094539719a3c7b7950598ef872dbf9518","SHA256":"e6a7b0bc01a627a7d0ffb07faddb3a4dd96b6f5208ac26107bdaeb3ab1ec8217","Sections":{".text":{"Entropy":6.395124735617589,"Virtual Size":"0x3968"},".rdata":{"Entropy":4.136188883876631,"Virtual Size":"0x221"},".data":{"Entropy":1.9267671732967222,"Virtual Size":"0x4eb9c"},"INIT":{"Entropy":5.1775498523671,"Virtual Size":"0x67c"},".reloc":{"Entropy":4.179055975760782,"Virtual Size":"0x752"}},"Signature":"Unsigned","Signatures":{},"Imphash":"a7bd820fa5b895fab06f20739c9f24b8","LoadsDespiteHVCI":"TRUE"}]}