{"Id":"adf27819-c7a0-4476-8632-5ca759202542","Tags":["RzDev_00X10.sys"],"Author":"Michael Haag","Created":"2026-09-08","MitreID":"T1014","Category":"malicious","Verified":"TRUE","Commands":{"Command":"","Description":"Nextron Systems identifies this exact sample as a kernel communication and memory-access component with a covert user-to-kernel channel and privileged memory read/write. Static analysis confirms MDL-backed kernel mappings and a transfer path that probes a caller buffer and maps supplied virtual ranges in page-sized chunks. The obfuscated transfer callback was not fully resolved; the covert channel and privileged memory read/write semantics are source-reported, not independently demonstrated. The observed RzDev_00X10.sys filename does not establish vendor ownership.","Usecase":"Provide a privileged kernel memory-transfer component.","Privileges":"kernel","OperatingSystem":"Windows x64"},"Resources":["https://github.com/NextronSystems/iocs/blob/89038fb97602153f20dadb9ba7e9fcaeac9af148/reports/whql-signed/readme.md"],"Acknowledgement":{"Person":"Nextron Systems Research","Handle":"@nextronresearch"},"Detection":[],"KnownVulnerableSamples":[{"Filename":"RzDev_00X10.sys","MD5":"e96522a7b9b55917a01f953018116d18","SHA1":"22921d8c47579b8bd0a513e6e052e4a5cf50068a","SHA256":"80f97dabef128a391e3ad10e4521dd0a28adc01a97e1cef980f535ac23bd0847","Imphash":"663aaaf0575ac1d44d8fc39b03d2c62d","Authentihash":{"MD5":"230ac8e5ae21258d4af9007027ffe99e","SHA1":"bd8609c22fd2f655e7831cc7eb1bce1e44f66896","SHA256":"afba0119386ba096b576328f20a8a6e5539c018057c5ac4c0376f03f0b1f6c90"},"RichPEHeaderHash":{"MD5":"","SHA1":"","SHA256":""},"Sections":{".text":{"Entropy":6.339323026478322,"Virtual Size":"0x30b6"},".rdata":{"Entropy":4.660200530422985,"Virtual Size":"0x998"},".data":{"Entropy":6.70903480791166,"Virtual Size":"0x4490"},".pdata":{"Entropy":3.8748140524830763,"Virtual Size":"0x180"},"INIT":{"Entropy":5.802729517353881,"Virtual Size":"0xa29"},"PAGE":{"Entropy":6.265388992771286,"Virtual Size":"0x1eab"},".reloc":{"Entropy":5.3812920310584635,"Virtual Size":"0x524"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2025-10-05 05:50:27","Description":"","Company":"","InternalName":"","OriginalFilename":"","FileVersion":"","Product":"","ProductVersion":"","Copyright":"","MachineType":"AMD64","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["ExAcquireFastMutex","ExAllocatePool","ExFreePoolWithTag","ExReleaseFastMutex","IoAllocateMdl","IoCreateDevice","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","IoFreeMdl","IofCompleteRequest","KeGetCurrentIrql","KeGetCurrentProcessorNumberEx","KeInitializeEvent","KeQueryActiveProcessors","KeRevertToUserAffinityThread","KeRevertToUserGroupAffinityThread","KeSetSystemAffinityThread","KeSetSystemGroupAffinityThread","MmGetPhysicalMemoryRanges","MmGetVirtualForPhysical","MmMapLockedPagesSpecifyCache","MmProbeAndLockPages","MmUnlockPages","NtBuildNumber","ProbeForRead","ProbeForWrite","RtlInitUnicodeString","ZwQuerySystemInformation","__C_specific_handler","__chkstk","_vsnwprintf","strcmp"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2025-07-16 20:48:21","ValidTo":"2026-07-14 20:48:21","Signature":"626376942ddc0149c5a603aec2a00b480a602a03be6b8873d594dc17097f07135342ef09a14a2777fc311d38dd3c86f78fdb82309d222133f22895a570b0189273a438a271b62933f5e2a61f26cbe19c98c8459dea8ef1944a87053221ddf4b189b6ebcf8bc686b892f443f1decaa0f4f806009b462230a9975cb6d63e8c7e540d96c27696161fdc72d4bd57bcaa7edeea40d89943194541e7e27bc7ea2ff05b81755b1721558c3fd5354ac39094c095cbc3c781eed691a3b448905fe48708c8dcad265ab3b739bec759d3beb88764e357dc689da5561e2aa5002041a74c8b847673a3dbeffe043028f10bd3add0ec9a162a7a171bac934da53b6be239d77425293793f42534681517718a6e15ffa982adc1af954c7179454123d859a81a5812faab3398fe6d82de4e23941ca3c324600753eed9279d9c60b75f5f27eb6556b94e2a41b4e3d801d759695e579112e63e86da81c7fb877d4878b967697d950d808d849627bec8a56b6f9291e3688a0128dd28b62891e4fc7282fa62493cbf57f00e8692bf76a2bfcc8cb4fe917492eb5166c1b500de5f2789deeb7e81b82480ff46d917b970800c6a16dc4185b5b789433422ccfc1e37ad44b90400cd1cbcb9a4707a48464cadf7dee0d33d746be61ca8fa23a23019e0f27c4fc73f33b1eef36c48efa027ef8cb972aaa9a33af630d4c5e28c83390f086153ecf9db791581bbd8","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"330000007519d85191f3c9c589000000000075","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"7a4d157c944afbe2ed41646bd8b21737","SHA1":"fa2ca700065d08ac6cefbbdc946012dac70870a9","SHA256":"25e508fea3297d0c4909dbb6602eb6eb59c5a02304545d6b9e7230ff62cd77cc","SHA384":"6e71ff106abdcfbdf669350bde4f8d7758109a39f1f5fc3a9088a82d1e822871d9038c0b7b046ddec4643ec9807468c8"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","ValidFrom":"2014-10-15 20:31:27","ValidTo":"2029-10-15 20:41:27","Signature":"96b5c33b31f27b6ba11f59dd742c3764b1bca093f9f33347e9f95df21d89f4579ee33f10a3595018053b142941b6a70e5b81a2ccbd8442c1c4bed184c2c4bd0c8c47bcbd8886fb5a0896ae2c2fdfbf9366a32b20ca848a6945273f732332936a23e9fffdd918edceffbd6b41738d579cf8b46d499805e6a335a9f07e6e86c06ba8086725afc0998cdba7064d4093188ba959e69914b912178144ac57c3ae8eae947bcb3b8edd7ab4715bba2bc3c7d085234b371277a54a2f7f1ab763b94459ed9230cce47c099212111f52f51e0291a4d7d7e58f8047ff189b7fd19c0671dcf376197790d52a0fbc6c12c4c50c2066f50e2f5093d8cafb7fe556ed09d8a753b1c72a6978dcf05fe74b20b6af63b5e1b15c804e9c7aa91d4df72846782106954d32dd6042e4b61ac4f24636de357302c1b5e55fb92b59457a9243d7c4e963dd368f76c728caa8441be8321a66cde5485c4a0a602b469206609698dcd933d721777f886dac4772daa2466eab64682bd24e98fb35cc7fec3f136d11e5db77edc1c37e1f6a4a14f8b4a721c671866770cdd819a35d1fa09b9a7cc55d4d728e74077fa74d00fcdd682412772a557527cda92c1d8e7c19ee692c9f7425338208db38cc7cc74f6c3a6bc237117872fe55596460333e2edfc42de72cd7fb0a82256fb8d70c84a5e1c4746e2a95329ea0fecdb4188fd33bad32b2b19ab86d0543fbff0d0f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"330000000d690d5d7893d076df00000000000d","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"83f69422963f11c3c340b81712eef319","SHA1":"0c5e5f24590b53bc291e28583acb78e5adc95601","SHA256":"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae","SHA384":"260ad59ba706420f68ba212931153bd89f760c464b21be55fba9d014fff322407859d4ebfb78ea9a3330f60dc9821a63"}}],"Signer":[{"SerialNumber":"330000007519d85191f3c9c589000000000075","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","Version":1}]}]}]}