LOLDriversTHE DRIVER THREAT CATALOG
← Back to driver explorer
Driver intelligenceMaliciousVerified

idmtdi.sys

Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.

UUID / c2e98102-2055-48f0-9449-3e7a7f2c0ffeADDED / 2024-08-28AUTHOR / Michael Haag

Known samples 9

9 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.

idmtdi.sysSample 1 · HVCI TRUE
MD5
44a0db8d9ea165b2ae5e84b72550a4e7
SHA1
3dc2887dbb227d780bf05fd25235d7314a67e9ed
SHA256
44ebb0f534e7cdfec06d5234358d219798a313219b214d72aa23afc5a57d7ea9
Imphash
ce10082e1aa4c1c2bd953b4a7208e56a
Authentihash MD5
f706fa9c39f2ac707988e849963c5195
Authentihash SHA1
6639afb03930b08009eb7e60d9557b2130cd0421
Authentihash SHA256
af5a2122b55ee9d8cd3dd49c4ac41bfc9b354912480f06fa7de19829c00c2720
Machine
AMD64
Version
6.32.3.80
Publisher
Tonec Inc.
Download malicious sampleView on VirusTotal
idmtdi.sysSample 2 · HVCI TRUE
MD5
66d0f20927a7acc0f6821d73f468c647
SHA1
e179f62fb4f074284945f3ab90406d2d3f19ee73
SHA256
08c4b75a9b715647a60b946f3743c4e49a6f5c36c1bc889e741d658508dc50c0
Imphash
5961803e998a48ab6f2322c35124b67b
Authentihash MD5
d7548fde7f3b5958b096876578154dbc
Authentihash SHA1
5934b4583513046dbb5c5dd56e56dafaf2162af7
Authentihash SHA256
2e6b039e10d2b93fbce625ecb7bf04b38eac69b96385fc3b28541c8da78fd8ad
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download malicious sampleView on VirusTotal
idmtdi.sysSample 3 · HVCI TRUE
MD5
cf1bc2fb73f82c43e05541100808a217
SHA1
c99b1093d11469729796ab5743c4bb1d16e3b975
SHA256
94b87b1cdaf1d86c2bc4eacef45608d0f16fdd3b981b88cdddc16b6bc64fe25d
Imphash
7d86ef6f47b0f5c432d168eae5b4dfcf
Authentihash MD5
458a279f1f8d6f5d687e2a2a9e31bad2
Authentihash SHA1
a183c6b212bca915e6deb0d4dfae3fe4b970cd52
Authentihash SHA256
289761eef2976b001879181b97324408e849729dbf41403fb73ee85565667012
Machine
AMD64
Version
6.34.14806.0
Publisher
CrowdStrike, Inc.
Download malicious sampleView on VirusTotal
idmtdi.sysSample 4 · HVCI TRUE
MD5
8cf9ec579ba36fc4a4edbc4788b5f209
SHA1
2e96749e78704b8ca13ec84bd047dd271eb12122
SHA256
7af2ff5d405cf9cd1aee2410a969ba22d6df78d98e9d4e60cbe624d8a3bc64a6
Imphash
4859205cb010367bf6f38080900035fb
Authentihash MD5
fc2fd705cecd3993671d50fb4cec1117
Authentihash SHA1
841992de018af75bb70c878146359c19c0753f04
Authentihash SHA256
d40f6a680914df8c6cf8dda62332ad829a91815ad94439b920af986f93939a7d
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download malicious sampleView on VirusTotal
idmtdi.sysSample 5 · HVCI TRUE
MD5
fe499663cd2bf11e0fa3aaead28b05c9
SHA1
2d0d89e275d2ea7a0b40af6bf5f284a9f61bcafe
SHA256
4421ff85aacbcc36695a018c5c47e884d56d62d7d5b8172bb70384ffc4d6a2e4
Imphash
4859205cb010367bf6f38080900035fb
Authentihash MD5
9dfb66394b42acb5709c76bedfd13bd7
Authentihash SHA1
450a9f2f2e8f485f6bef404334b6e52f1c02050a
Authentihash SHA256
e8c5227d8827405e0e13a16bbacc6959edd3de95bc167566f742a6c221a0fe75
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download malicious sampleView on VirusTotal
idmtdi.sysSample 6 · HVCI TRUE
MD5
5200ecb17fb554f13723c9c63145da64
SHA1
dc8211cb76ed434f2f627a440604f7c3f8e04a41
SHA256
2c1b65c2988b337182f1ba57b404793454e30a7fd328d34bc2e79857dc437a4a
Imphash
ce10082e1aa4c1c2bd953b4a7208e56a
Authentihash MD5
754246fcf3f7184f331bbaf89ceab696
Authentihash SHA1
84b404763fd1610970186736c311c61574c2c10e
Authentihash SHA256
fa96eca78a57b779fd398294ae2519b7c4fe9e4369e6e7fa5167aebbe6e0c09a
Machine
AMD64
Version
6.32.3.80
Publisher
Tonec Inc.
Download malicious sampleView on VirusTotal
idmtdi.sysSample 7 · HVCI TRUE
MD5
11cf20a428b8fb81ff20dfe4dc3e28bd
SHA1
55a139fe44e836a1886774d7c89c70796060f1c4
SHA256
ce106afd6a9996ac0150709a30d61ece7d7bfe1f27492c00f4fabab9ec40575d
Imphash
b6839c3b1c51c236429c9dcd0ebce978
Authentihash MD5
fca829a587deffab1fa11f2274f6b5d2
Authentihash SHA1
d31ee4f8934f4a9508a39a02905edca5cdc1faca
Authentihash SHA256
dd41e9a82e7be92a5d77624054a0b9e5e725492bae527f31e878140482ce802f
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download malicious sampleView on VirusTotal
idmtdi.sysSample 8 · HVCI TRUE
MD5
b503cd460a61d303107aa459956781fd
SHA1
a264b74f8ff47ae4fac9d3361508adac82e15c0b
SHA256
2cd7a0c4e8d24404c92e4ed8539b2136028a8ca663f3432e417b00665493e13f
Imphash
ce10082e1aa4c1c2bd953b4a7208e56a
Authentihash MD5
ce05ebdd0c7be7429cb4fb2e963f9181
Authentihash SHA1
699eb6eb826496693a69d479023271bcb29651ba
Authentihash SHA256
dee8dbe00a809e5ecdbea898393dd9ecd32fa0a0de80463cc2b903dcdec2cffe
Machine
AMD64
Version
8.2.2.49708
Publisher
Palo Alto Networks, Inc.
Download malicious sampleView on VirusTotal
idmtdi.sysSample 9 · HVCI TRUE
MD5
a06880ad1efe6b57ca1d59d878dea82a
SHA1
668b0274d350a6d895d140a9700a88156c0db06f
SHA256
3855b2df32e0eedec454b25e6e2da6b3df19c4b0f575e45bc06482d4ebce7551
Imphash
5961803e998a48ab6f2322c35124b67b
Authentihash MD5
9d646db70c57fe3f4be5d62c52fc32a4
Authentihash SHA1
cdf4607b40c6c886368a50f060f10538d93e8719
Authentihash SHA256
4a61add64bbb08af8576aac592fdafe7114b940878babb3ae90bfde26f315187
Machine
AMD64
Version
Not recorded
Publisher
Not recorded
Download malicious sampleView on VirusTotal

Recorded command

sc.exe create idmtdi.sys binPath=C:\windows\temp\idmtdi.sys type=kernel && sc.exe start idmtdi.sys

Elevate privileges · Privileges: kernel · OS: Windows 10

Research & references