← Back to driver explorer
Driver intelligenceMaliciousVerified
kernel_utility_driver64.sys
Huorong Security identified these WHCP-signed kernel drivers in Vaultify rogueware. After a challenge-response exchange, the driver accepts a target driver name and removes process-creation callbacks registered by that driver. This strips callback-based antivirus and EDR visibility from kernel context. Public analysis reproduced the behavior in both the 32-bit and 64-bit builds.
Known samples 2
0 recorded TRUE · 0 recorded FALSE · 2 unknown for loading despite HVCI. Results apply to individual samples.
kernel_utility_driver64.sysSample 1 · HVCI unknown
- MD5
180d0b565d76d7e47cc3c9a2901ac2ec- SHA1
e11e7ee8824e45c25ab638fec6d6e7d4ab89cffa- SHA256
501ea082774f29adc752887402af6df0edf49bf7b3816b93f6e52c06a79685bc- Imphash
df691992834a38d3116d3b2a5bd39e29- Authentihash MD5
1aec6940e814dadb6b348bd31ef12e2e- Authentihash SHA1
b88989e61d2de030376b546c400ac6f57a6ada66- Authentihash SHA256
52b2a30279b3849123e5eb42ab883372aa807c67b7ffb7f221e6e052ad29e8dc- Machine
- AMD64
- Version
- 1,5026,1000,127
- Publisher
- Not recorded
kernel_utility_driver32.sysSample 2 · HVCI unknown
- MD5
1ffa4841ee616cf49b4e439fe131f001- SHA1
71ab9bd0a43754b1a87cd05a1188cbf27b95b96f- SHA256
962fb670510807fd5cab3a6e6f886aeb2b925c42054c29fa02f67011be935954- Imphash
3df5f109bc00887b8230282740059e26- Authentihash MD5
7641ea013e9045027e6e4d3fd5c091b0- Authentihash SHA1
915d533a8ecb1c13fef384dc63845f874084758c- Authentihash SHA256
8a9a9e4276f947cfd188fd28daa35bdfae62a2620e90fdd2311096ee1a905fee- Machine
- I386
- Version
- 1,5026,1000,127
- Publisher
- Not recorded
Recorded command
sc.exe create kernel_utility_driver binPath= C:\windows\temp\kernel_utility_driver64.sys type= kernel && sc.exe start kernel_utility_driverRemove process-creation callbacks registered by antivirus and EDR drivers. · Privileges: kernel · OS: Windows 10, Windows 11
Research & references
Acknowledgement: wwwab @wwwab123