What is causing my computer to BSOD at random times?

Hello vivs_lunchtime,

A key question for me is how did this code get loaded? Alex said that he reinstalled Windows and the key applications that he uses (hopefully from trustworthy sources) and the problem persists. Perhaps the virus is outside the Windows partition and loaded at boot time - then contiguous physical pages would be expected...

Gary

* The heap-allocated rwx shellcode is not tiny but large (the cr0 sequence is about somewhere in the middle) and also is contiguous memory, that means that not only the VA is linear but the PA space is, too. I wonder if it is intentional.

* Contains obfuscation and anti-debugging (kernelmode).

ffffd28a`a9e18153 e9ab000000      jmp     ffffd28a`a9e18203 

ffffd28a`a9e18158 0f31            rdtsc ; rdtsc 1 

ffffd28a`a9e1815a 48c1e220        shl     rdx,20h 

ffffd28a`a9e1815e 480bc2          or      rax,rdx 

ffffd28a`a9e18161 488bc8          mov     rcx,rax 

ffffd28a`a9e18164 488bd0          mov     rdx,rax 

ffffd28a`a9e18167 48c1c903        ror     rcx,3 

ffffd28a`a9e1816b 498bc4          mov     rax,r12 

ffffd28a`a9e1816e 4833d1          xor     rdx,rcx 

ffffd28a`a9e18171 48f7e2          mul     rax,rdx 

ffffd28a`a9e18174 488bca          mov     rcx,rdx 

ffffd28a`a9e18177 488995f8070000  mov     qword ptr [rbp+7F8h],rdx 

ffffd28a`a9e1817e 4833c8          xor     rcx,rax 

ffffd28a`a9e18181 48b8fdce61841177ccab mov rax,0ABCC77118461CEFDh ; look here

ffffd28a`a9e1818b 48f7e1          mul     rax,rcx 

ffffd28a`a9e1818e 48c1ea1a        shr     rdx,1Ah 

ffffd28a`a9e18192 4869c200e1f505  imul    rax,rdx,5F5E100h   ; and here

ffffd28a`a9e18199 482bc8          sub     rcx,rax 

ffffd28a`a9e1819c 482bf9          sub     rdi,rcx 

ffffd28a`a9e1819f 0f31            rdtsc  ; rdtsc 2

ffffd28a`a9e181a1 48c1e220        shl     rdx,20h 

ffffd28a`a9e181a5 480bc2          or      rax,rdx

Everything in this is just weird.

Guys, I just partially cancelled by holidays because of you. What is not the case: defect RAM, or other hardware defect. No, your system is working just fine. You are not suffering from hardware defect, sorry. What is the case: sophisticated rootkit, and we should exclude nobody. Motherboard software is not an exception.

It has code polymorphism. That trips me off. Code polymorphism is an EXCEEDINGLY rare technology with very few reported cases of usermode malware, and no reported cases of kernelmode rootkits (right? anyone knows one? I don't.). I am not aware of any, ANY, reported case of a ring0 kernelmode rootkit with true code polymorphism. It was sheer luck to be able to detect this at all and only possible because of multiple minidumps from the same system. The thing certainly has some flaws, but nobody is perfect. Code polymorphism in ring0 is quite a feat. But nobody puts so much work into hiding technologies (shellcode, code polymorphism) if they have benign intentions. Motherboard software is not excluded from the suspicious list. But whoever owns the shellcode is a major threat and continues to disrupt people's life (to say the least). A motherboard OEM does not have to hide and can do things just in plain. For a motherboard OEM, there is zero reason and zero motivation to hide and use code polymorphism in ring 0 shellcode. If it's the motherboard software I doubt I can get it running on a VM.

Being the first reported case of a kernelmode rootkit with shellcode and code polymorphism is, I would say, of a certain scientific interest.

From the more recent readings, it may have either advanced persistence or it's in the motherboard software. To isolate it, we need, in minimum, a better dump at bsod time. In minimum. And it's going to be a hard nut. I am already a bit scared by the list of abilities. You could also suppress it using the Core Isolation and try to live on, that might be a valid choice if it's a gaming PC and there isn't too much personal stuff on it. Core Isolation doesn't suppress the other parts in usermode, and suppressing is not removing. But the BSODs will stop, due to the rootkit being suppressed, which is the worst one.

*If* we can extract it, we can throw it to Virustotal, to the Antivirus vendors and to Microsoft. Microsoft maintains a forbidden driver list, but I am not sure if this can be used for a code-polymorphic driver. In worst case, there is not even an extractable driver at all, I'm already fearing this might be the case. Then it only uses rw primitive and shellcode. Which leads me to the other thing that needs to be done, locating the usermode part. It has one, for certain. The motherboard software, or something else. Given the already seen abilities, it seems to be a worthy opponent.

I'm willing to try, but what is needed is an automatic kernelmode dump. A kernelmode dump contains, more or less, all data in RAM. This includes personal stuff. Files stored on the hard disk are NOT in the RAM. As a general rule of thumb, everything you open might be in the dump. Files lying around passively on the hard disk, not openend, are not in the RAM. Only stuff currently running and not swapped out is in the dump when the BSOD happens. If you were running Edge and watching cat videos, it might be in the dump. But even then, it might be swapped out, because usermode stuff gets swapped out very fastly. (Also, all I care about is getting my hands on the rootkit thing, did I mention that? :-D) Do not just post an automatic dump here, for these reasons. It's also quite large. It would be be put in an encrypted zip with a good password.

You can switch from minidump to automatic dump in the control panel. MSDN explains how to do this here: https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/enabling-a-kernel-mode-dump-file

Also read this: https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/varieties-of-kernel-mode-dump-files

And what I would want would be the automatic dump. That's all for now. Consider that you also have the Core Isolation option, and that I may fail to isolate and locate the thing. I will also try to locate all rw primitive drivers, because they might serve as the current entry point. I'm off till Monday now.

*edit: I see that Gary was faster. I grabbed it already, but the dump contains sensitive data und you must delete the memory dump as soon as possible.

*edit II: Meh, it's a Critical Corruption dump, so a "security breach alert by patchguard" one. Not my favorite, because it's already too late when patchguard detects it, might be unusable.

Hi Gary,

I found that exact MEMORY.DMP file and added it to the google drive folder. Hopefully it yields some answers!

Thank you very much,

Alex J

Hello Alex,

I checked the new dump and it is still the same problem ("mov cr0,rax").

Do you have a larger dump file (\Windows\MEMORY.DMP) corresponding to the crash? It will probably be a few gigabytes large.

Gary