← Back to driver explorer
Driver intelligenceMaliciousVerified
driver_e1123b59.sys
Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.
Known samples 1
1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
driver_e1123b59.sysSample 1 · HVCI TRUE
- MD5
d96cbcec39b96ba813e317958d74d1b9- SHA1
23d66b87c8ea22e08db1c010ec5e5499cb94ffc0- SHA256
e1123b59a801e243a64270d0c6ab1277e5e3afba9c19023807409f53c1b0204b- Imphash
c5b5294afddf5831c39471a323019e4e- Authentihash MD5
20c4b0fa2c72cbcb23c60dce08b27d0f- Authentihash SHA1
8edab5d7b94f551309a25f49687534ce1ba036b0- Authentihash SHA256
4eaf2205cdd189cc96806bd5364a505f77ad5dbb622558cd374044965fd20658- Machine
- AMD64
- Version
- 2022.1.16.1000
- Publisher
- 湖北盾网网络科技有限公司
Recorded command
sc.exe create driver_d9f15d91.sys binPath=C:\windows\temp\driver_d9f15d91.sys type=kernel && sc.exe start driver_d9f15d91.sysElevate privileges · Privileges: kernel · OS: Windows 10