A sophisticated kernel-mode backdoor/implant used to inject and execute shellcode.
The attacker scans a target network for port 445 and verifies if SMBv1 is enabled.
Look for unusual lsass.exe or services.exe behavior, which are common targets for shellcode injection.