Overview

overview

7

Static

static

3

PBCCRCPass...ge.exe

windows7-x64

4

PBCCRCPass...ge.exe

windows10-2004-x64

4

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...er.dll

windows7-x64

3

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$TEMP/certmgr.exe

windows7-x64

1

$TEMP/certmgr.exe

windows10-2004-x64

1

$TEMP/certutil.exe

windows7-x64

4

$TEMP/certutil.exe

windows10-2004-x64

4

PBCCRCPassGuardX.exe

windows7-x64

1

PBCCRCPassGuardX.exe

windows10-2004-x64

1

PBCCRCPass...ut.exe

windows7-x64

7

PBCCRCPass...ut.exe

windows10-2004-x64

7

PBCCRCPass...ce.exe

windows7-x64

5

PBCCRCPass...ce.exe

windows10-2004-x64

5

Resubmissions

12-11-2024 19:49

241112-yjspzssrcq 8

30-04-2024 18:17

240430-ww4lxacg3v 7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PBCCRCPassGuardEdge.exe

  • Size

    2.7MB

  • Sample

    240430-ww4lxacg3v

  • MD5

    c0568331b9984599f57d7bbe11e17cd9

  • SHA1

    4860334bc492832586a10f28aaa4c1e9c59ed847

  • SHA256

    57a1929e2863a92d4e1dfdc5c0f34edfd28e7b7a8995a5afb5da3653d1ca4856

  • SHA512

    cb58825cef114ca73eac6bbf5995077c5b34a627a36b5557c1be591aec5312b2ce1708b01cfe7db665f8586e3e5181e2ff455a487a2ea6718784ae8cbbd226f6

  • SSDEEP

    49152:FtXXx7d5hSa3sWgOAhnvpAyw0rqMjdomso+NMnCPFLesr8xEZgCCDPLpGrpWBATJ:h7d5IalgOAjyaqM59sbNMnyezxEZ87LS

Score
7/10
spywarestealer

Malware Config

Targets

    • Target

      PBCCRCPassGuardEdge.exe

    • Size

      2.7MB

    • MD5

      c0568331b9984599f57d7bbe11e17cd9

    • SHA1

      4860334bc492832586a10f28aaa4c1e9c59ed847

    • SHA256

      57a1929e2863a92d4e1dfdc5c0f34edfd28e7b7a8995a5afb5da3653d1ca4856

    • SHA512

      cb58825cef114ca73eac6bbf5995077c5b34a627a36b5557c1be591aec5312b2ce1708b01cfe7db665f8586e3e5181e2ff455a487a2ea6718784ae8cbbd226f6

    • SSDEEP

      49152:FtXXx7d5hSa3sWgOAhnvpAyw0rqMjdomso+NMnCPFLesr8xEZgCCDPLpGrpWBATJ:h7d5IalgOAjyaqM59sbNMnyezxEZ87LS

    Score
    4/10
    behavioral1behavioral2

    • Target

      $PLUGINSDIR/KillProcDLL.dll

    • Size

      4KB

    • MD5

      99f345cf51b6c3c317d20a81acb11012

    • SHA1

      b3d0355f527c536ea14a8ff51741c8739d66f727

    • SHA256

      c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93

    • SHA512

      937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef

    Score
    3/10
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      a436db0c473a087eb61ff5c53c34ba27

    • SHA1

      65ea67e424e75f5065132b539c8b2eda88aa0506

    • SHA256

      75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49

    • SHA512

      908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d

    • SSDEEP

      192:aVL7iZJX76BisO7+UZEw+Rl59pV8ghsVJ39dx8T:d7NsOpZsfLMJ39e

    Score
    3/10
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/killer.dll

    • Size

      6KB

    • MD5

      16205cd992d3b3827573f93ab8923e4e

    • SHA1

      4eece7a206ee619264d686ca1b3021b9f482866b

    • SHA256

      967d66f23cf3d9d3e5a4d6a9c6e366e792a98cc8a293196095b10cd82da9a695

    • SHA512

      257b2047b8e9303457bb050a760b8d2577da55642e4fb02933e6188d0591ff8adfe0c8df2a441577466f23a8e3bff2e94e9cfcfc381c4d255935123996c06d6d

    • SSDEEP

      48:CRNdQ/SbTfx6gA6IMzLvM0Aoy3TYzyixX9o1TNRgPEgt/b82ebRuqSd7:mNGajxG+PWTwlSbpx

    Score
    3/10
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      e75ae7cfe06ff9692d98a934f6aa2d3c

    • SHA1

      d5fd4a59a39630c4693ce656bbbc0a55ede0a500

    • SHA256

      1f861aeb145ebbb9a2628414e6dca6b06d0bfb252f2de624b86814cfec8097d0

    • SHA512

      ab4998f8f6bbb60321d0c2aa941d4e85319901960297059bf0832cf84b18dfbb120c3aa71963b46d3be3b7c9602434cb23f9a961c00de02403b3f266b294d41b

    • SSDEEP

      96:3np41CMj95rKhkfL5RkEdKkcxM2DjDf3GEEE9v5E9av+Yx40ndY7ndS27gA:3nujesS4HREEK5MYxtdqn420

    Score
    3/10
    behavioral10behavioral9

    • Target

      $TEMP/certmgr.exe

    • Size

      77KB

    • MD5

      ec58a1586ad70953d48e3c393163348f

    • SHA1

      f18eebaea4460b057f5b49e8239779f1c0c05bb9

    • SHA256

      a097cc322fa68e1ff500d79598f657d9c211e86e632c3c3b896e566852cea991

    • SHA512

      05615c1ee6aeaf82a1d52e31f18c4174ae4d44e96fcd4466643f01ef431d4ad5022f3b4eb07e9f472ea43b59e8de5f3b5c10328e7109dafa4c3f3b9ff41b2da2

    • SSDEEP

      1536:Xg63vRMvSytDe5TIUGl9JZhT9gvtYw+WXsA9iYzvlt92LzzqD:vRMvdSTI5l7ZhOvtt+WXsof92HuD

    Score
    1/10
    behavioral11behavioral12

    • Target

      $TEMP/certutil.exe

    • Size

      789KB

    • MD5

      c259445a630b1dfb5df701fe0df9b51e

    • SHA1

      a91c5362bdc8428c7a9c01550888b8fc8ed2d05b

    • SHA256

      a793c0f253cc9a3807df32fe8db7d3e76a6fd0191316459deae8149456df4367

    • SHA512

      232e8d219adb823ad37da3a5cdcaafb896095ab69ba09c547a6bba645778ed5b6adbe551060424a6ad325747024a8dcb16211c0d0d53772c7b62451d583b8877

    • SSDEEP

      24576:wxGutn70ZTJqnhNoxhzN3oU+7+O3OIsuOqina:kG4cTJqnV+OX1Obna

    Score
    4/10
    behavioral13behavioral14

    • Target

      PBCCRCPassGuardX.exe

    • Size

      1.0MB

    • MD5

      52e22babfbfaf59f14859e175856115d

    • SHA1

      45dc92d8fc7f3aba824be0f0519c2844506a5960

    • SHA256

      7fa6544460b039457311bb310882c84801efa6c535e5ea360948803deb90c0e1

    • SHA512

      796568eae06ed17a81c7a36d392b8fd03ddbd76d746564f91a6d395fc8245453c1f574fc448d3cec93710abcc6c2e113c2df62fa4facd7b6676d7036855310bf

    • SSDEEP

      24576:GLPh4AjgcRov+reCJUcvVvCAyuHsJVvUwr+II6:GLPh4DjCeCDvF1lw56y

    Score
    1/10
    behavioral15behavioral16

    • Target

      PBCCRCPassGuardXInput.exe

    • Size

      2.2MB

    • MD5

      711a4cff055438d5d09ca435f0f14711

    • SHA1

      1cd82ddcb7f0a6c03631e8f94d137ddfa056eb6d

    • SHA256

      e1a00202904b2606777b69c23bc6b432c68400ce2913c3e9bc480f4062957dec

    • SHA512

      cec702983ba3d1db5a6a06a9b5265d5943a1c5c5c015e15dc0d4fb34ab9443cea8285bd6b85db2f4f2ce69c49e59752bc9c3be7081c9d1346a2e57eaae155f9a

    • SSDEEP

      49152:PFWocvooVzlMClwnbPhwDhOp/Qo0MZ8BRZ0ibMD7IanoI8ovn:PFWocQoVhl2wV63DZ83RgD7zf

    Score
    7/10
    spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral17behavioral18

    • Target

      PBCCRCPassGuardXInputService.exe

    • Size

      325KB

    • MD5

      dc606c1a0dc7d554fb2f3f8f1d2388a7

    • SHA1

      3119c24f69ea3b5e595100ba8a05badb2e49fcdc

    • SHA256

      24550160fdf34fac8895da3f8799dc284654222291803a006302a60ef5299407

    • SHA512

      cd4246dd524821f262907721ef22231fa505afae135abe6dfe1bd100765644446a084f857ae52502ef4ab307b8f3ea3c992938b471a54c2b9482435bad823f9f

    • SSDEEP

      6144:lzBAeL5G6yq91UawxAT+vMnjoctZpRg78jBX:lv5nwTqT+evf08jh

    Score
    5/10

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral19behavioral20

MITRE ATT&CK Enterprise v15

Tasks