木马从网上下载WHQL ROOTKIT加载，国内基本全过

秋日之殇

wwwab 发表于 2022-6-13 19:37
996737ccaad6877bed0170e2b12373a8e00e365a93e825d416033d912aaaed5c这个是downloader/dropper exe

目前 ...

那驱动就是这个帖子了的那个了https://bbs.kafan.cn/thread-2236936-1-1.html

wwwab

Greetings,
  

Your submission has been processed by Automatic System. This threat is already familiar to us. A corresponding record will be added to the Dr.Web virus database in the near future.


Threat: Trojan.Siggen18.7210


Thank you for the cooperation.

心心相印

md miss

wwwab

Hello,

Thank you for contacting Bitdefender Enterprise Support team.

The file is malicious and detection will be added in the next couple of updates.
File 996737ccaad6877bed0170e2b12373a8e00e365a93e825d416033d912aa[4ff26d46fb313dfb5ff8b547e12a2eff] declared INFECTED

Please let us know if there is anything else we can assist you with or if we may close this case.

Looking forward to your reply.

herofrederick

稍微看了下就是个iqvw64e驱动利用，map了个黑驱动，然后黑驱动里面内嵌了两个驱动，然后去加载（这两个驱动好像是一样的）

dropper tcp请求一段shellcode+dll
shellcode内存加载后面的dll，dll经过一些特殊的操作又tcp请求一段内核shellcode+黑sys
然后利用前面的iqvw64e执行内核shellcode，load黑sys

这个iqvw64e是个老洞了

tdsskiller

herofrederick 发表于 2022-6-13 23:36
稍微看了下就是个iqvw64e驱动利用，map了个黑驱动，然后黑驱动里面内嵌了两个驱动，然后去加载（这两个驱动 ...

我看到iqvw我就已经知道了结局，懒得看了，whql国人特技，也看不了啥
总之挂壁的手段比这种要强

herofrederick

tdsskiller 发表于 2022-6-14 09:56
我看到iqvw我就已经知道了结局，懒得看了，whql国人特技，也看不了啥
总之挂壁的手段比这种要强

确实一眼顶真，看到dump下载的iqvw64e驱动基本就能猜到后面了

LSPD

Kaspersky 双击vt样本 miss

firewave

LSPD 发表于 2022-6-14 14:42
Kaspersky 双击vt样本 miss

我那个VT样本扫描miss 改为exe运行杀了。名称: PDM:Exploit.Win32.Generic.nblk

LSPD

firewave 发表于 2022-6-14 15:43
我那个VT样本扫描miss 改为exe运行杀了。名称: PDM:Exploit.Win32.Generic.nblk

我这里没触发pdm