2e1531b2-d370-4543-9e2e-5319a1c13c22

daxin_blank2.sys

Description

Driver used in the Daxin malware campaign.

UUID: 2e1531b2-d370-4543-9e2e-5319a1c13c22
Created: 2023-02-28
Author: Michael Haag
Acknowledgement: |

This download link contains the malicious driver!

Commands

sc.exe create daxin_blank2.sys binPath=C:\windows\temp\daxin_blank2.sys     type=kernel &amp;&amp; sc.exe start daxin_blank2.sys

Use Case	Privileges	Operating System
Elevate privileges	kernel	Windows 10

Detections

YARA 🏹

Expand

Exact Match

with header and size limitation

Threat Hunting

without header and size limitation

Sigma 🛡️

Expand

Names

detects loading using name only

Hashes

detects loading using hashes only

Sysmon 🔎

Expand

Block

on hashes

Alert

on hashes

Resources

https://gist.github.com/MHaggis/9ab3bb795a6018d70fb11fa7c31f8f48

https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/daxin-backdoor-espionage

Known Vulnerable Samples

Property	Value
Filename	daxin_blank2.sys
Creation Timestamp	2021-02-05 21:05:26
MD5	1cd158a64f3d886357535382a6fdad75
SHA1	a48aa80942fc8e0699f518de4fd6512e341d4196
SHA256	5c1585b1a1c956c7755429544f3596515dfdf928373620c51b0606a520c6245a
Authentihash MD5	9853eedacdfe3384f34b8eaa771f4f70
Authentihash SHA1	d7254e751cd3a49176a547a5bb70f8a0662d8d28
Authentihash SHA256	4b10f4f03eaa545d2fdb3b88890917a6fa24142689d3c43a7c39fc5bed5725bf
RichPEHeaderHash MD5	986c450e6ee0c98c62235a1d3066a54a
RichPEHeaderHash SHA1	988baae29accb89b13a742369f020dfa40511225
RichPEHeaderHash SHA256	4a5f8a3aefca29bce6b45b59661fee1d9196a19825396d1315620b7d49de7b81
Publisher	Fuqing Yuntan Network Tech Co.,Ltd.

Download

Certificates

Expand

Certificate 516ceb03f17e10c24b45ffb6336e5915

Field	Value
ToBeSigned (TBS) MD5	fe2cc3b135dc2f887e620d33a02ef639
ToBeSigned (TBS) SHA1	a92b0a710c038b8556fb3d74742118f75c5c3d57
ToBeSigned (TBS) SHA256	4b98540e377559d976ea0a9e40920f4a308a060fd16b27665fc7a8f2273df483
Subject	C=CN, ST=Fuzhou, L=Fuqing, O=Fuqing Yuntan Network Tech Co.,Ltd., OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=Fuqing Yuntan Network Tech Co.,Ltd.
ValidFrom	2013-04-09 00:00:00
ValidTo	2014-04-09 23:59:59
Signature	6946a8e63d6d38e19d41b4b5f4a71715c2c03ea0f9775b97dd3bf2d343be21049f4b78a351a0b1b8d30121393af537dfee0828f051ea2a87bed271ccc0e85e7ed9911d1d36d35da6e1141edc77520be857cf00bf3ac9b7e80722dd3580dd9eb7fab6f4134e4f1f1b794f1c28bc521ee4abbf5be4b6f2b149fca0f2beb4ba69616a0a442b06093c04ece1b42b0c121b0703c6a7d7af421a880bf3e45bfe28bcc4da347397d3aa67c89e3656062e9397dec782863abe49df79527e06388885b9d28c4bd078cc002a41206a266bfbe584b35748d6d0526fef478931c7527be7095fc9c7ee088f1c889834bb2533c3f45cfe41d1b19d0b80863ed52bc8a9d1b1d2ea
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	516ceb03f17e10c24b45ffb6336e5915
Version	3

Certificate 611993e400000000001c

Field	Value
ToBeSigned (TBS) MD5	78a717e082dcc1cda3458d917e677d14
ToBeSigned (TBS) SHA1	4a872e0e51f9b304469cd1dedb496ee9b8b983a4
ToBeSigned (TBS) SHA256	317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5
ValidFrom	2011-02-22 19:25:17
ValidTo	2021-02-22 19:35:17
Signature	812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	611993e400000000001c
Version	3

Certificate 5200e5aa2556fc1a86ed96c9d44b33c7

Field	Value
ToBeSigned (TBS) MD5	b30c31a572b0409383ed3fbe17e56e81
ToBeSigned (TBS) SHA1	4843a82ed3b1f2bfbee9671960e1940c942f688d
ToBeSigned (TBS) SHA256	03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
ValidFrom	2010-02-08 00:00:00
ValidTo	2020-02-07 23:59:59
Signature	5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	5200e5aa2556fc1a86ed96c9d44b33c7
Version	3

Imports

Expand

ntoskrnl.exe
NDIS.SYS
ntoskrnl.exe
hal.dll

Imported Functions

Expand

vsprintf
NdisMSendNetBufferListsComplete
IoAllocateMdl
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
MmUnlockPages
IoFreeMdl
ExAllocatePool
ExFreePool
NtQuerySystemInformation
HalMakeBeep

Exported Functions

Expand

Sections

Expand

.text
.rdata
.data
.pdata
INIT
.vmp0
.vmp1
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "516ceb03f17e10c24b45ffb6336e5915",
      "Signature": "6946a8e63d6d38e19d41b4b5f4a71715c2c03ea0f9775b97dd3bf2d343be21049f4b78a351a0b1b8d30121393af537dfee0828f051ea2a87bed271ccc0e85e7ed9911d1d36d35da6e1141edc77520be857cf00bf3ac9b7e80722dd3580dd9eb7fab6f4134e4f1f1b794f1c28bc521ee4abbf5be4b6f2b149fca0f2beb4ba69616a0a442b06093c04ece1b42b0c121b0703c6a7d7af421a880bf3e45bfe28bcc4da347397d3aa67c89e3656062e9397dec782863abe49df79527e06388885b9d28c4bd078cc002a41206a266bfbe584b35748d6d0526fef478931c7527be7095fc9c7ee088f1c889834bb2533c3f45cfe41d1b19d0b80863ed52bc8a9d1b1d2ea",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=CN, ST=Fuzhou, L=Fuqing, O=Fuqing Yuntan Network Tech Co.,Ltd., OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=Fuqing Yuntan Network Tech Co.,Ltd.",
      "TBS": {
        "MD5": "fe2cc3b135dc2f887e620d33a02ef639",
        "SHA1": "a92b0a710c038b8556fb3d74742118f75c5c3d57",
        "SHA256": "4b98540e377559d976ea0a9e40920f4a308a060fd16b27665fc7a8f2273df483",
        "SHA384": "a713c1f2d1fb5bd88108f0241683b012083946779e31971206eef1a580f5813b26a2aae376162ac2193509ff8ce675fe"
      },
      "ValidFrom": "2013-04-09 00:00:00",
      "ValidTo": "2014-04-09 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "516ceb03f17e10c24b45ffb6336e5915",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

source

last_updated: 2024-09-26