5fb86651-c152-404a-9a2f-0f54b0d2bb55

driver_77225a99.sys

Description

Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.

UUID: 5fb86651-c152-404a-9a2f-0f54b0d2bb55
Created: 2024-09-10
Author: Michael Haag
Acknowledgement: |

Download Block

This download link contains the malicious driver!

Commands

sc.exe create driver_c3d48ddd.sys binPath=C:\windows\temp\driver_c3d48ddd.sys type=kernel &amp;&amp; sc.exe start driver_c3d48ddd.sys

Use Case	Privileges	Operating System
Elevate privileges	kernel	Windows 10

Detections

YARA 🏹

Expand

Exact Match

with header and size limitation

Threat Hunting

without header and size limitation

Sigma 🛡️

Expand

Names

detects loading using name only

Hashes

detects loading using hashes only

Sysmon 🔎

Expand

Block

on hashes

Alert

on hashes

Resources

https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/

Known Vulnerable Samples

Property	Value
Filename
Creation Timestamp	2022-12-21 06:07:48
MD5	41d7ebdb73b4bf2a063ae430e33bc164
SHA1	4ebbaa7e0820e453ca82dab25bf8acde4ba87df2
SHA256	77225a99b2e0e2b4007fb2f5a96d356e13deab45b9ef54c175d5452de8a211a7
Authentihash MD5	539c14f9f300778263bade546b1ec50e
Authentihash SHA1	d0b992a144c184a51a8d1463c12975eb62fc84b5
Authentihash SHA256	8e681ed97f08f8dc269c85b75160a508e59ba3045ddb14f99d64dd767dc556ba
RichPEHeaderHash MD5	ffdf660eb1ebf020a1d0a55a90712dfb
RichPEHeaderHash SHA1	3e905e3d061d0d59de61fcf39c994fcb0ec1bab3
RichPEHeaderHash SHA256	2b3f99a94b7a7132854be769e27b331419c53989ef42f686d6f5ba09ddefefd6
Company	Tonec Inc.
Description	Internet Download Manager TDI Driver
Product	Internet Download Manager
OriginalFilename	idmtdi.sys

Download

Certificates

Expand

Certificate 10a9caf34c8b7f963f76eb131ec8b9f4

Field	Value
ToBeSigned (TBS) MD5	c8dafabce58e752c0b7c585f23af68e5
ToBeSigned (TBS) SHA1	06243f2dfe31293c25ba25bff90be09531921924
ToBeSigned (TBS) SHA256	96b4f4626a4a0ef8b8d47790eb711bfa2751a5876dfc12fd5e0fb269417bea96
Subject	C=CN, ST=Fujian, L=Fuzhou, O=Pinchins Technology Company Limited, OU=IT Dept, CN=Pinchins Technology Company Limited
ValidFrom	2016-11-10 00:00:00
ValidTo	2018-11-02 23:59:59
Signature	a2ab11c7fe4cad3467cc2eb970cbba204b6b36ad7a95c6448fd7ef116976ddfc1d7394b4f22a2b81a65dda1a1d8b06ef3aa1b15a3f89d58d297e93ff5ab02122b221944213b3a7c62d180bcdd2ddcb9199fb3cd5522d5a1a302e3aac778ac8cb76d29afcc302b543fb10dc3ccc47aba81bbaf777fffeb68aff39fc5d66a83c3358318b7562b3eaf99fc4b55dbf3881d8fa852547cad332b60b7b0199c392a63827c8a0c74670203ada61e325c9948772cfab5ca0d51435dd436b96a30d9b0e164396a3579b2cb249b862d4c23ff567366677a3142efb4fb3bfaf87a037d3e0f8bc0caaed45e8b15598490b0b71d12a440834e3ba257f1efb1ac995697065e680
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	10a9caf34c8b7f963f76eb131ec8b9f4
Version	3

Certificate 611993e400000000001c

Field	Value
ToBeSigned (TBS) MD5	78a717e082dcc1cda3458d917e677d14
ToBeSigned (TBS) SHA1	4a872e0e51f9b304469cd1dedb496ee9b8b983a4
ToBeSigned (TBS) SHA256	317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5
ValidFrom	2011-02-22 19:25:17
ValidTo	2021-02-22 19:35:17
Signature	812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	611993e400000000001c
Version	3

Certificate 5200e5aa2556fc1a86ed96c9d44b33c7

Field	Value
ToBeSigned (TBS) MD5	b30c31a572b0409383ed3fbe17e56e81
ToBeSigned (TBS) SHA1	4843a82ed3b1f2bfbee9671960e1940c942f688d
ToBeSigned (TBS) SHA256	03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
ValidFrom	2010-02-08 00:00:00
ValidTo	2020-02-07 23:59:59
Signature	5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	5200e5aa2556fc1a86ed96c9d44b33c7
Version	3

Imports

Expand

ntoskrnl.exe
HAL.dll
ntoskrnl.exe
HAL.dll

Imported Functions

Expand

KeInitializeEvent
KeSetEvent
KeWaitForSingleObject
KeBugCheckEx
ExAllocatePool
ExAllocatePoolWithTag
ExFreePoolWithTag
MmBuildMdlForNonPagedPool
PsCreateSystemThread
PsTerminateSystemThread
IoAllocateIrp
IoAllocateMdl
IofCompleteRequest
IoCreateDevice
IoCreateFile
IoCreateSymbolicLink
IoDeleteDevice
RtlInitUnicodeString
ObReferenceObjectByHandle
ObCloseHandle
ObfReferenceObject
ObfDereferenceObject
ObRegisterCallbacks
ObUnRegisterCallbacks
IoGetFileObjectGenericMapping
ZwTerminateProcess
PsLookupProcessByProcessId
ObOpenObjectByPointer
ObQueryNameString
_vsnwprintf
ObSetHandleAttributes
ObCreateObject
SeCreateAccessState
__C_specific_handler
__chkstk
IoFileObjectType
PsProcessType
PsThreadType
IoFreeIrp
wcsrchr
HalReturnToFirmware
ExAllocatePool
NtQuerySystemInformation
ExFreePoolWithTag
IoAllocateMdl
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
MmUnlockPages
IoFreeMdl
KeQueryActiveProcessors
KeSetSystemAffinityThread
KeRevertToUserAffinityThread
DbgPrint
KeQueryPerformanceCounter

Exported Functions

Expand

Sections

Expand

.text
.rdata
.data
.pdata
INIT
.uNV
.]'.
.UGx
.reloc
.rsrc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "10a9caf34c8b7f963f76eb131ec8b9f4",
      "Signature": "a2ab11c7fe4cad3467cc2eb970cbba204b6b36ad7a95c6448fd7ef116976ddfc1d7394b4f22a2b81a65dda1a1d8b06ef3aa1b15a3f89d58d297e93ff5ab02122b221944213b3a7c62d180bcdd2ddcb9199fb3cd5522d5a1a302e3aac778ac8cb76d29afcc302b543fb10dc3ccc47aba81bbaf777fffeb68aff39fc5d66a83c3358318b7562b3eaf99fc4b55dbf3881d8fa852547cad332b60b7b0199c392a63827c8a0c74670203ada61e325c9948772cfab5ca0d51435dd436b96a30d9b0e164396a3579b2cb249b862d4c23ff567366677a3142efb4fb3bfaf87a037d3e0f8bc0caaed45e8b15598490b0b71d12a440834e3ba257f1efb1ac995697065e680",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=CN, ST=Fujian, L=Fuzhou, O=Pinchins Technology Company Limited, OU=IT Dept, CN=Pinchins Technology Company Limited",
      "TBS": {
        "MD5": "c8dafabce58e752c0b7c585f23af68e5",
        "SHA1": "06243f2dfe31293c25ba25bff90be09531921924",
        "SHA256": "96b4f4626a4a0ef8b8d47790eb711bfa2751a5876dfc12fd5e0fb269417bea96",
        "SHA384": "cc0c8ad8cb2e3bd3c4b8bee057d6c60475c84f31dc38a8b4cac8ad21ed44eb1c973f0d51d13fff8361e791e6ada7e548"
      },
      "ValidFrom": "2016-11-10 00:00:00",
      "ValidTo": "2018-11-02 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "10a9caf34c8b7f963f76eb131ec8b9f4",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

source

last_updated: 2025-01-13