DCRCVDrv.sys
DCRCVDrv.sys exposes IOCTL 0x2205C0 to request kernel-mode process termination for a caller-supplied PID. The handler requires at least four input bytes and reaches ZwTerminateProcess through a process-handle acquisition helper. Access requires the driver to be loaded and its device to be accessible; successful termination of protected processes is not established. Abused by the Cruciferra MaaS loader, which writes the driver to C:\Windows\Temp\DCRCVDrv.sys, creates a service for it, and opens a handle via the symbolic link \\.\DCRCVDRV_U to kill AV/EDR processes.
Known samples 1
0 recorded TRUE · 0 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.
DCRCVDrv.sysSample 1 · HVCI unknown
- MD5
567c158ee0858f8e941d4ab7a6c18dbc- SHA1
47d922b0fd5d704025d14ef98ded46e74830a423- SHA256
87e8d39db624f37d3e77aedf487a2dfd197f71a4730ea74f4e7a4341deaec2ff- Imphash
3be3ab07a4108143e8c2d10beeaa1788- Authentihash MD5
d6f560a8e5f5476a632e83814ded5a7f- Authentihash SHA1
5b129c6f9669f1b33a42b9c0d5c970d5b4925bf6- Authentihash SHA256
2a7ed8d0be70e0667aa14e161ae1dc6b7daaeb1438b534d73b1093c0b44d78a2- Machine
- AMD64
- Version
- 1, 0, 0, 0
- Publisher
- MOCOMSYS & DCRC
Research & references
- https://www.esentire.com/blog/malware-as-a-service-cocktail-errtraffic-and-cruciferra-killing-your-edr-since-2025
- https://github.com/magicsword-io/LOLDrivers/issues/412
- https://www.elastic.co/security-labs/threat-command/dll-search-order-hijacking-elastic-defend
- https://github.com/DeathShotXD/0xCr0ssCrush/blob/main/docs/dcrcv-analysis.md
Acknowledgement: eSentire Threat Response Unit (TRU), DeathShotXD @eSentire_TRU, @0xDeathShotXD