Teledyne Digital Imaging CorMem.sys (Sapera Memory Manager) exposes physical memory read/write, contiguous memory allocation, and I/O port access to user-mode processes via CorMem.dll wrapper functions. The driver provides 36 exported functions including CorMemGetPhysMemory, CorMemMapPhysMemory, CorMemAllocPhysMemory, CorMemReadIo, and CorMemWriteIo. Actively abused for BYOVD with 0/71 VT detection. Execution parents include Cobalt Strike/IcedID malware and game cheat kernel loaders.
sc.exe create CorMem.sys binPath=C:\windows\temp\CorMem.sys type=kernel && sc.exe start CorMem.syssc.exe create CorMem.sys binPath=C:\windows\temp\CorMem.sys type=kernel && sc.exe start CorMem.sysSandbox: execFile · Timeout: 30s
security.privilegeescalation.kernel-exploit examples:
Teledyne Digital Imaging CorMem.sys (Sapera Memory Manager) exposes physical memory read/write, contiguous memory allocation, and I/O port access to user-mode processes via CorMem.dll wrapper functions. The driver provides 36 exported functions including CorMemGetPhysMemory, CorMemMapPhysMemory, CorMemAllocPhysMemory, CorMemReadIo, and CorMemWriteIo. Actively abused for BYOVD with 0/71 VT detection. Execution parents include Cobalt Strike/IcedID malware and game cheat kernel loaders.
Use Case: Elevate privileges
Required Privileges: kernel
MITRE ATT&CK: T1068