adf27819-c7a0-4476-8632-5ca759202542

RzDev_00X10.sys :inline

Description

Nextron Systems identifies this exact sample as a kernel communication and memory-access component with a covert user-to-kernel channel and privileged memory read/write. Static analysis confirms MDL-backed kernel mappings and a transfer path that probes a caller buffer and maps supplied virtual ranges in page-sized chunks. The obfuscated transfer callback was not fully resolved; the covert channel and privileged memory read/write semantics are source-reported, not independently demonstrated. The observed RzDev_00X10.sys filename does not establish vendor ownership.

  • UUID: adf27819-c7a0-4476-8632-5ca759202542
  • Created: 2026-09-08
  • Author: Michael Haag
  • Acknowledgement: Nextron Systems Research | @nextronresearch

Download

This download link contains the malicious driver!

Block RzDev_00X10.sys across your endpoints

Add this driver to your block policy in minutes with MagicSword, threat-driven application control. Free for up to 100 endpoints.

Start Blocking for Free
Use CasePrivilegesOperating System
Provide a privileged kernel memory-transfer component.kernelWindows x64

Detections

YARA 🏹

Expand

Exact Match

with header and size limitation

Threat Hunting

without header and size limitation

Sigma 🛡️

Expand

Names

detects loading using name only

Hashes

detects loading using hashes only

Sysmon 🔎

Expand

Block

on hashes

Alert

on hashes

Resources


  • https://github.com/NextronSystems/iocs/blob/89038fb97602153f20dadb9ba7e9fcaeac9af148/reports/whql-signed/readme.md

    • Known Vulnerable Samples

    PropertyValue
    FilenameRzDev_00X10.sys
    Creation Timestamp2025-10-05 05:50:27
    MD5e96522a7b9b55917a01f953018116d18
    SHA122921d8c47579b8bd0a513e6e052e4a5cf50068a
    SHA25680f97dabef128a391e3ad10e4521dd0a28adc01a97e1cef980f535ac23bd0847
    Authentihash MD5230ac8e5ae21258d4af9007027ffe99e
    Authentihash SHA1bd8609c22fd2f655e7831cc7eb1bce1e44f66896
    Authentihash SHA256afba0119386ba096b576328f20a8a6e5539c018057c5ac4c0376f03f0b1f6c90
    RichPEHeaderHash MD5
    RichPEHeaderHash SHA1
    RichPEHeaderHash SHA256

    Download

    Certificates

    Expand
    Certificate 330000007519d85191f3c9c589000000000075
    FieldValue
    ToBeSigned (TBS) MD57a4d157c944afbe2ed41646bd8b21737
    ToBeSigned (TBS) SHA1fa2ca700065d08ac6cefbbdc946012dac70870a9
    ToBeSigned (TBS) SHA25625e508fea3297d0c4909dbb6602eb6eb59c5a02304545d6b9e7230ff62cd77cc
    SubjectC=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher
    ValidFrom2025-07-16 20:48:21
    ValidTo2026-07-14 20:48:21
    Signature626376942ddc0149c5a603aec2a00b480a602a03be6b8873d594dc17097f07135342ef09a14a2777fc311d38dd3c86f78fdb82309d222133f22895a570b0189273a438a271b62933f5e2a61f26cbe19c98c8459dea8ef1944a87053221ddf4b189b6ebcf8bc686b892f443f1decaa0f4f806009b462230a9975cb6d63e8c7e540d96c27696161fdc72d4bd57bcaa7edeea40d89943194541e7e27bc7ea2ff05b81755b1721558c3fd5354ac39094c095cbc3c781eed691a3b448905fe48708c8dcad265ab3b739bec759d3beb88764e357dc689da5561e2aa5002041a74c8b847673a3dbeffe043028f10bd3add0ec9a162a7a171bac934da53b6be239d77425293793f42534681517718a6e15ffa982adc1af954c7179454123d859a81a5812faab3398fe6d82de4e23941ca3c324600753eed9279d9c60b75f5f27eb6556b94e2a41b4e3d801d759695e579112e63e86da81c7fb877d4878b967697d950d808d849627bec8a56b6f9291e3688a0128dd28b62891e4fc7282fa62493cbf57f00e8692bf76a2bfcc8cb4fe917492eb5166c1b500de5f2789deeb7e81b82480ff46d917b970800c6a16dc4185b5b789433422ccfc1e37ad44b90400cd1cbcb9a4707a48464cadf7dee0d33d746be61ca8fa23a23019e0f27c4fc73f33b1eef36c48efa027ef8cb972aaa9a33af630d4c5e28c83390f086153ecf9db791581bbd8
    SignatureAlgorithmOID1.2.840.113549.1.1.11
    IsCertificateAuthorityFalse
    SerialNumber330000007519d85191f3c9c589000000000075
    Version3
    Certificate 330000000d690d5d7893d076df00000000000d
    FieldValue
    ToBeSigned (TBS) MD583f69422963f11c3c340b81712eef319
    ToBeSigned (TBS) SHA10c5e5f24590b53bc291e28583acb78e5adc95601
    ToBeSigned (TBS) SHA256d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae
    SubjectC=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014
    ValidFrom2014-10-15 20:31:27
    ValidTo2029-10-15 20:41:27
    Signature96b5c33b31f27b6ba11f59dd742c3764b1bca093f9f33347e9f95df21d89f4579ee33f10a3595018053b142941b6a70e5b81a2ccbd8442c1c4bed184c2c4bd0c8c47bcbd8886fb5a0896ae2c2fdfbf9366a32b20ca848a6945273f732332936a23e9fffdd918edceffbd6b41738d579cf8b46d499805e6a335a9f07e6e86c06ba8086725afc0998cdba7064d4093188ba959e69914b912178144ac57c3ae8eae947bcb3b8edd7ab4715bba2bc3c7d085234b371277a54a2f7f1ab763b94459ed9230cce47c099212111f52f51e0291a4d7d7e58f8047ff189b7fd19c0671dcf376197790d52a0fbc6c12c4c50c2066f50e2f5093d8cafb7fe556ed09d8a753b1c72a6978dcf05fe74b20b6af63b5e1b15c804e9c7aa91d4df72846782106954d32dd6042e4b61ac4f24636de357302c1b5e55fb92b59457a9243d7c4e963dd368f76c728caa8441be8321a66cde5485c4a0a602b469206609698dcd933d721777f886dac4772daa2466eab64682bd24e98fb35cc7fec3f136d11e5db77edc1c37e1f6a4a14f8b4a721c671866770cdd819a35d1fa09b9a7cc55d4d728e74077fa74d00fcdd682412772a557527cda92c1d8e7c19ee692c9f7425338208db38cc7cc74f6c3a6bc237117872fe55596460333e2edfc42de72cd7fb0a82256fb8d70c84a5e1c4746e2a95329ea0fecdb4188fd33bad32b2b19ab86d0543fbff0d0f
    SignatureAlgorithmOID1.2.840.113549.1.1.11
    IsCertificateAuthorityTrue
    SerialNumber330000000d690d5d7893d076df00000000000d
    Version3

    Imports

    Expand
    • ntoskrnl.exe

    Imported Functions

    Expand
    • ExAcquireFastMutex
    • ExAllocatePool
    • ExFreePoolWithTag
    • ExReleaseFastMutex
    • IoAllocateMdl
    • IoCreateDevice
    • IoCreateSymbolicLink
    • IoDeleteDevice
    • IoDeleteSymbolicLink
    • IoFreeMdl
    • IofCompleteRequest
    • KeGetCurrentIrql
    • KeGetCurrentProcessorNumberEx
    • KeInitializeEvent
    • KeQueryActiveProcessors
    • KeRevertToUserAffinityThread
    • KeRevertToUserGroupAffinityThread
    • KeSetSystemAffinityThread
    • KeSetSystemGroupAffinityThread
    • MmGetPhysicalMemoryRanges
    • MmGetVirtualForPhysical
    • MmMapLockedPagesSpecifyCache
    • MmProbeAndLockPages
    • MmUnlockPages
    • NtBuildNumber
    • ProbeForRead
    • ProbeForWrite
    • RtlInitUnicodeString
    • ZwQuerySystemInformation
    • __C_specific_handler
    • __chkstk
    • _vsnwprintf
    • strcmp

    Exported Functions

    Expand

    Sections

    Expand
    • .text
    • .rdata
    • .data
    • .pdata
    • INIT
    • PAGE
    • .reloc

    Signature

    Expand
    {
  "Certificates": [
    {
      "CertificateType": "Leaf (Code Signing)",
      "IsCA": false,
      "IsCertificateAuthority": false,
      "IsCodeSigning": true,
      "SerialNumber": "330000007519d85191f3c9c589000000000075",
      "Signature": "626376942ddc0149c5a603aec2a00b480a602a03be6b8873d594dc17097f07135342ef09a14a2777fc311d38dd3c86f78fdb82309d222133f22895a570b0189273a438a271b62933f5e2a61f26cbe19c98c8459dea8ef1944a87053221ddf4b189b6ebcf8bc686b892f443f1decaa0f4f806009b462230a9975cb6d63e8c7e540d96c27696161fdc72d4bd57bcaa7edeea40d89943194541e7e27bc7ea2ff05b81755b1721558c3fd5354ac39094c095cbc3c781eed691a3b448905fe48708c8dcad265ab3b739bec759d3beb88764e357dc689da5561e2aa5002041a74c8b847673a3dbeffe043028f10bd3add0ec9a162a7a171bac934da53b6be239d77425293793f42534681517718a6e15ffa982adc1af954c7179454123d859a81a5812faab3398fe6d82de4e23941ca3c324600753eed9279d9c60b75f5f27eb6556b94e2a41b4e3d801d759695e579112e63e86da81c7fb877d4878b967697d950d808d849627bec8a56b6f9291e3688a0128dd28b62891e4fc7282fa62493cbf57f00e8692bf76a2bfcc8cb4fe917492eb5166c1b500de5f2789deeb7e81b82480ff46d917b970800c6a16dc4185b5b789433422ccfc1e37ad44b90400cd1cbcb9a4707a48464cadf7dee0d33d746be61ca8fa23a23019e0f27c4fc73f33b1eef36c48efa027ef8cb972aaa9a33af630d4c5e28c83390f086153ecf9db791581bbd8",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher",
      "TBS": {
        "MD5": "7a4d157c944afbe2ed41646bd8b21737",
        "SHA1": "fa2ca700065d08ac6cefbbdc946012dac70870a9",
        "SHA256": "25e508fea3297d0c4909dbb6602eb6eb59c5a02304545d6b9e7230ff62cd77cc",
        "SHA384": "6e71ff106abdcfbdf669350bde4f8d7758109a39f1f5fc3a9088a82d1e822871d9038c0b7b046ddec4643ec9807468c8"
      },
      "ValidFrom": "2025-07-16 20:48:21",
      "ValidTo": "2026-07-14 20:48:21",
      "Version": 3
    },
    {
      "CertificateType": "CA",
      "IsCA": true,
      "IsCertificateAuthority": true,
      "IsCodeSigning": false,
      "SerialNumber": "330000000d690d5d7893d076df00000000000d",
      "Signature": "96b5c33b31f27b6ba11f59dd742c3764b1bca093f9f33347e9f95df21d89f4579ee33f10a3595018053b142941b6a70e5b81a2ccbd8442c1c4bed184c2c4bd0c8c47bcbd8886fb5a0896ae2c2fdfbf9366a32b20ca848a6945273f732332936a23e9fffdd918edceffbd6b41738d579cf8b46d499805e6a335a9f07e6e86c06ba8086725afc0998cdba7064d4093188ba959e69914b912178144ac57c3ae8eae947bcb3b8edd7ab4715bba2bc3c7d085234b371277a54a2f7f1ab763b94459ed9230cce47c099212111f52f51e0291a4d7d7e58f8047ff189b7fd19c0671dcf376197790d52a0fbc6c12c4c50c2066f50e2f5093d8cafb7fe556ed09d8a753b1c72a6978dcf05fe74b20b6af63b5e1b15c804e9c7aa91d4df72846782106954d32dd6042e4b61ac4f24636de357302c1b5e55fb92b59457a9243d7c4e963dd368f76c728caa8441be8321a66cde5485c4a0a602b469206609698dcd933d721777f886dac4772daa2466eab64682bd24e98fb35cc7fec3f136d11e5db77edc1c37e1f6a4a14f8b4a721c671866770cdd819a35d1fa09b9a7cc55d4d728e74077fa74d00fcdd682412772a557527cda92c1d8e7c19ee692c9f7425338208db38cc7cc74f6c3a6bc237117872fe55596460333e2edfc42de72cd7fb0a82256fb8d70c84a5e1c4746e2a95329ea0fecdb4188fd33bad32b2b19ab86d0543fbff0d0f",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014",
      "TBS": {
        "MD5": "83f69422963f11c3c340b81712eef319",
        "SHA1": "0c5e5f24590b53bc291e28583acb78e5adc95601",
        "SHA256": "d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae",
        "SHA384": "260ad59ba706420f68ba212931153bd89f760c464b21be55fba9d014fff322407859d4ebfb78ea9a3330f60dc9821a63"
      },
      "ValidFrom": "2014-10-15 20:31:27",
      "ValidTo": "2029-10-15 20:41:27",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014",
      "SerialNumber": "330000007519d85191f3c9c589000000000075",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

    source

    last_updated: 2026-09-08