← Back to driver explorer
Driver intelligenceMaliciousVerified
driver_c3d48ddd.sys
Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.
Known samples 1
1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
driver_c3d48ddd.sysSample 1 · HVCI TRUE
- MD5
193cf8847ff1f35ec8e1ef5e8d27cc82- SHA1
c577b7c3ca617f8496bec5681581c088e0a94fc5- SHA256
c3d48dddef790a45ef9feaa5978ec90c9cd4b2de4746896c446ffa08d488170a- Imphash
624bb416cf7e307d07c40e2450d02cd0- Authentihash MD5
3b238923122fa4b070bec7c36ba6e0d1- Authentihash SHA1
a08d6a5fdab315e138efcaba1064bffc64e2e2a2- Authentihash SHA256
28b39c57628cb12ca1bf2f531055c7d57008be5fd424aa691ecb648efe5768dd- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
Recorded command
sc.exe create driver_c3d48ddd.sys binPath=C:\windows\temp\driver_c3d48ddd.sys type=kernel && sc.exe start driver_c3d48ddd.sysElevate privileges · Privileges: kernel · OS: Windows 10