89643454-e38b-41cb-853d-abf649a104a5

DCRCVDrv.sys :inline

Description

DCRCVDrv.sys exposes IOCTL 0x2205C0 which allows user-mode applications to terminate arbitrary processes from the kernel via ZwTerminateProcess. The IOCTL input buffer contains the PID to terminate. Abused by the Cruciferra MaaS loader, which writes the driver to C:\Windows\Temp\DCRCVDrv.sys, creates a service for it, and opens a handle via the symbolic link \.\DCRCVDRV_U to kill AV/EDR processes.

  • UUID: 89643454-e38b-41cb-853d-abf649a104a5
  • Created: 2026-08-27
  • Author: Jose Hernandez
  • Acknowledgement: eSentire Threat Response Unit (TRU) | @eSentire_TRU

Download

This download link contains the vulnerable driver!

Block DCRCVDrv.sys across your endpoints

Add this driver to your block policy in minutes with MagicSword, threat-driven application control. Free for up to 100 endpoints.

Start Blocking for Free
Use CasePrivilegesOperating System
Terminate AV/EDR processes from kernel mode (BYOVD)kernelWindows

Detections

YARA 🏹

Expand

Exact Match

with header and size limitation

Threat Hunting

without header and size limitation

Renamed

for renamed driver files

Sigma 🛡️

Expand

Names

detects loading using name only

Hashes

detects loading using hashes only

Sysmon 🔎

Expand

Block

on hashes

Alert

on hashes

Resources


  • https://www.esentire.com/blog/malware-as-a-service-cocktail-errtraffic-and-cruciferra-killing-your-edr-since-2025
  • https://github.com/magicsword-io/LOLDrivers/issues/412

    • CVE

    • Known Vulnerable Samples

    PropertyValue
    FilenameDCRCVDrv.sys
    Creation Timestamp2022-12-15 20:19:37
    MD5567c158ee0858f8e941d4ab7a6c18dbc
    SHA147d922b0fd5d704025d14ef98ded46e74830a423
    SHA25687e8d39db624f37d3e77aedf487a2dfd197f71a4730ea74f4e7a4341deaec2ff
    Authentihash MD5d6f560a8e5f5476a632e83814ded5a7f
    Authentihash SHA15b129c6f9669f1b33a42b9c0d5c970d5b4925bf6
    Authentihash SHA2562a7ed8d0be70e0667aa14e161ae1dc6b7daaeb1438b534d73b1093c0b44d78a2
    RichPEHeaderHash MD5bc65325e8b3839fa906e179124755b07
    RichPEHeaderHash SHA1ed0e7b8ec6ed7bb3b100a17a9b4cad6ed59a7de0
    RichPEHeaderHash SHA256e159e3a544aad40e47177ad1944598d8b621ab9333b226f59dfe1736bf3ea0c1
    CompanyMOCOMSYS & DCRC
    DescriptionDCRCV_U Driver (for SCM)
    ProductDCRCV_U
    OriginalFilenameDCRCVDrv.sys

    Download

    Certificates

    Expand
    Certificate 33000000dc341a520fbbcf3d8c0000000000dc
    FieldValue
    ToBeSigned (TBS) MD5a3320406647f4541c4f8e731342ced04
    ToBeSigned (TBS) SHA173f33ada4ceacbc289cffac339cdb36a01773a23
    ToBeSigned (TBS) SHA2564e21391a41bf00d507b1ec6ea2a71fe57c28b022ec0c504b19f9e608c6b2acb5
    SubjectC=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher
    ValidFrom2022-03-10 19:58:05
    ValidTo2023-03-08 19:58:05
    Signature61b21fe5891421228f4bf81ef5a09005d450860e55d2013253f0c9240631c08e1643156b71e60bf9c78b9b116227cece4cf769c69e06b306614cecfb421e11b46f3074bff1e8a57925aa145c7b18b812899908db232437f0f44d4861544a96ee3e40b02935659e281c2ffc5cb04e92eb6db56bd35a919227430ee72019c2d2f0deb3f8d0b66b213367d42311bbd559b20ece3a2f8966c6b76ebfc8452fb4ab79d5c4734cb35d639838a73d65626d0a9bb512eeba084ece0f8deb229cfb98d43bcdec5575792f7af71698c4618db5b2723d39ffee829b00a96b14f74edd560449b040a7611f7e1b16d9d3763501bec9c483a73e63f191d26b2902d879c0612040
    SignatureAlgorithmOID1.2.840.113549.1.1.11
    IsCertificateAuthorityFalse
    SerialNumber33000000dc341a520fbbcf3d8c0000000000dc
    Version3
    Certificate 610baac1000000000009
    FieldValue
    ToBeSigned (TBS) MD5a569061297e8e824767dbc3184a69bea
    ToBeSigned (TBS) SHA1adbb26a587a8f44b4fccaecb306f980d1c55a150
    ToBeSigned (TBS) SHA256cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46
    SubjectC=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012
    ValidFrom2012-04-18 23:48:38
    ValidTo2027-04-18 23:58:38
    Signature5a8a67daccd5fd0d264177bf0a4678b4b3de12692b7723c2652f015fd203f461ba509d2e8c3972f36c3e6ab11e766decb7f382dcccbbc56970287366173f54ebee011648c446d91b80ae813a8d0f796d68b09eea2d3f39d3ca387ebd5e7c086e19dcc6c2f438336861e2524783e1000156d2bacb878205310a418b4ee77f5f5fed5fd3392d45eba213bffd1ec298417161165fc80a70257c59693124e471e70abb0417f79f721ec9d2bb1abe3d02fe090cb243b4591a99539396215fe0d6b72601429536ac27fdbef48577683d18bdf4be98882211865216f345ec0397107087a37043713cdbc98603170cf5735bc67de15c64edd7c548d7ed32e2d1aad3cfa7f6574e61f977eb67f288b3de00da038fd08a34373e1dd862b8d2b1f3e12f8b723b81967c6ffcec667672601b24f2a0896d5b6d002eef28dd868705c2b4b9e5be64c22af24a155c98e2c42785ff52e3627e0fb2020bd766c70ab2d33d200414503259830a7d9bed5a38120152ba2f5e20728e4af1fde771028c3be107bec973f4dd47d8b4efb4a4b330b9893e76cab90098567eabea8ab8a5d038ab6977130b142fe9aa411ff7babd3a2b348aee0aab63e663f788248e200d2b3b9de3c24952ac9f1f0e393b5dd46e506ae67d523aaa7c3315290d265e0158a74ea93d7a846f743f609fe4324f3600af6d71d33ea646655f8174f1fec171da4ca0415a82ddf11f
    SignatureAlgorithmOID1.2.840.113549.1.1.11
    IsCertificateAuthorityTrue
    SerialNumber610baac1000000000009
    Version3

    Imports

    Expand
    • ntoskrnl.exe
    • TDI.SYS
    • FLTMGR.SYS

    Imported Functions

    Expand
    • PsLookupProcessByProcessId
    • ZwQuerySymbolicLinkObject
    • IoGetRelatedDeviceObject
    • RtlInitUnicodeString
    • IoDeleteDevice
    • ExpInterlockedPushEntrySList
    • MmGetSystemRoutineAddress
    • ExpInterlockedPopEntrySList
    • ZwOpenSymbolicLinkObject
    • IoAllocateErrorLogEntry
    • ObQueryNameString
    • strncpy
    • IoFileObjectType
    • ZwCreateFile
    • wcsrchr
    • IoGetCurrentProcess
    • ExEventObjectType
    • ZwClose
    • ExQueryDepthSList
    • ObReferenceObjectByHandle
    • IoAttachDeviceToDeviceStack
    • PsGetVersion
    • ZwOpenProcess
    • ObfReferenceObject
    • ObfDereferenceObject
    • IoCreateDevice
    • ZwTerminateProcess
    • ObOpenObjectByPointer
    • DbgPrint
    • ExDeleteNPagedLookasideList
    • IoUnregisterFsRegistrationChange
    • IoRegisterFsRegistrationChange
    • IoDeleteSymbolicLink
    • IoIs32bitProcess
    • IofCompleteRequest
    • IoCreateSymbolicLink
    • _wcsicmp
    • PsSetLoadImageNotifyRoutine
    • _wcsnicmp
    • KeSetEvent
    • PsSetCreateThreadNotifyRoutine
    • ExInitializeNPagedLookasideList
    • PsSetCreateProcessNotifyRoutine
    • KeAcquireSpinLockRaiseToDpc
    • PsGetCurrentProcessId
    • ExReleaseFastMutex
    • ExAcquireFastMutex
    • KeInitializeEvent
    • KeWaitForSingleObject
    • ZwFsControlFile
    • wcsncpy
    • ZwSetInformationFile
    • wcsstr
    • ZwQueryDirectoryFile
    • ZwOpenFile
    • ZwQueryInformationFile
    • ZwReadFile
    • ZwQuerySecurityObject
    • ZwWriteFile
    • ZwCreateKey
    • ZwSetValueKey
    • ZwDeleteKey
    • ZwEnumerateKey
    • ZwOpenKey
    • IoDetachDevice
    • ZwQueryValueKey
    • PoStartNextPowerIrp
    • PoCallDriver
    • RtlCompareMemory
    • IofCallDriver
    • MmBuildMdlForNonPagedPool
    • IoFreeMdl
    • IoFreeIrp
    • IoAttachDevice
    • IoAllocateIrp
    • IoAllocateMdl
    • ZwEnumerateValueKey
    • ExGetPreviousMode
    • PsProcessType
    • KeBugCheckEx
    • IoWriteErrorLogEntry
    • ExFreePoolWithTag
    • ExAllocatePoolWithTag
    • _strnicmp
    • _stricmp
    • KeReleaseSpinLock
    • ZwOpenEvent
    • RtlAnsiCharToUnicodeChar
    • __C_specific_handler
    • TdiMapUserRequest
    • FltSetCallbackDataDirty
    • FltStartFiltering
    • FltRegisterFilter
    • FltGetVolumeName

    Exported Functions

    Expand

    Sections

    Expand
    • .text
    • .rdata
    • .data
    • .pdata
    • INIT
    • .rsrc
    • .reloc

    Signature

    Expand
    {
  "Certificates": [
    {
      "CertificateType": "Leaf (Code Signing)",
      "IsCA": false,
      "IsCertificateAuthority": false,
      "IsCodeSigning": true,
      "SerialNumber": "33000000dc341a520fbbcf3d8c0000000000dc",
      "Signature": "61b21fe5891421228f4bf81ef5a09005d450860e55d2013253f0c9240631c08e1643156b71e60bf9c78b9b116227cece4cf769c69e06b306614cecfb421e11b46f3074bff1e8a57925aa145c7b18b812899908db232437f0f44d4861544a96ee3e40b02935659e281c2ffc5cb04e92eb6db56bd35a919227430ee72019c2d2f0deb3f8d0b66b213367d42311bbd559b20ece3a2f8966c6b76ebfc8452fb4ab79d5c4734cb35d639838a73d65626d0a9bb512eeba084ece0f8deb229cfb98d43bcdec5575792f7af71698c4618db5b2723d39ffee829b00a96b14f74edd560449b040a7611f7e1b16d9d3763501bec9c483a73e63f191d26b2902d879c0612040",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher",
      "TBS": {
        "MD5": "a3320406647f4541c4f8e731342ced04",
        "SHA1": "73f33ada4ceacbc289cffac339cdb36a01773a23",
        "SHA256": "4e21391a41bf00d507b1ec6ea2a71fe57c28b022ec0c504b19f9e608c6b2acb5",
        "SHA384": "e7f40fafff666298c5154ba64cdd1060454547233fb1d8a7982d4927d46e6e4038a40e581f33963401d6553f3ab97499"
      },
      "ValidFrom": "2022-03-10 19:58:05",
      "ValidTo": "2023-03-08 19:58:05",
      "Version": 3
    },
    {
      "CertificateType": "CA",
      "IsCA": true,
      "IsCertificateAuthority": true,
      "IsCodeSigning": false,
      "SerialNumber": "610baac1000000000009",
      "Signature": "5a8a67daccd5fd0d264177bf0a4678b4b3de12692b7723c2652f015fd203f461ba509d2e8c3972f36c3e6ab11e766decb7f382dcccbbc56970287366173f54ebee011648c446d91b80ae813a8d0f796d68b09eea2d3f39d3ca387ebd5e7c086e19dcc6c2f438336861e2524783e1000156d2bacb878205310a418b4ee77f5f5fed5fd3392d45eba213bffd1ec298417161165fc80a70257c59693124e471e70abb0417f79f721ec9d2bb1abe3d02fe090cb243b4591a99539396215fe0d6b72601429536ac27fdbef48577683d18bdf4be98882211865216f345ec0397107087a37043713cdbc98603170cf5735bc67de15c64edd7c548d7ed32e2d1aad3cfa7f6574e61f977eb67f288b3de00da038fd08a34373e1dd862b8d2b1f3e12f8b723b81967c6ffcec667672601b24f2a0896d5b6d002eef28dd868705c2b4b9e5be64c22af24a155c98e2c42785ff52e3627e0fb2020bd766c70ab2d33d200414503259830a7d9bed5a38120152ba2f5e20728e4af1fde771028c3be107bec973f4dd47d8b4efb4a4b330b9893e76cab90098567eabea8ab8a5d038ab6977130b142fe9aa411ff7babd3a2b348aee0aab63e663f788248e200d2b3b9de3c24952ac9f1f0e393b5dd46e506ae67d523aaa7c3315290d265e0158a74ea93d7a846f743f609fe4324f3600af6d71d33ea646655f8174f1fec171da4ca0415a82ddf11f",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012",
      "TBS": {
        "MD5": "a569061297e8e824767dbc3184a69bea",
        "SHA1": "adbb26a587a8f44b4fccaecb306f980d1c55a150",
        "SHA256": "cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46",
        "SHA384": "e947cac936803f5683196e4ff1b259096073395d0b908522ddce90d57597c9f7b57f7ddcdbe021ba863d843c340da8ba"
      },
      "ValidFrom": "2012-04-18 23:48:38",
      "ValidTo": "2027-04-18 23:58:38",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012",
      "SerialNumber": "33000000dc341a520fbbcf3d8c0000000000dc",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

    source

    last_updated: 2026-08-28