Overview

overview

8

Static

static

8

Schwab_Des....7.exe

windows7-x64

8

Schwab_Des....7.exe

windows10-2004-x64

8

langs/Hungarian.ps1

windows7-x64

1

langs/Hungarian.ps1

windows10-2004-x64

1

langs/Korean.ps1

windows7-x64

1

langs/Korean.ps1

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Schwab_Desktop_v2.7.zip

  • Size

    4.8MB

  • Sample

    221129-lqhgdabb41

  • MD5

    e8781fc5a7fd6d557cf4f32e45175978

  • SHA1

    de349d75bbe414bf67ee7dec3492217bbf83ea00

  • SHA256

    c0bd2850fc1fdafa2cf0768b94076a87f32fc11babfcb034c0f7563a4541ec28

  • SHA512

    bdff1b815e53d4e3415791e6a87d8ca5b6a942f2ed9553ec3e730dc71bded9a6b7ad22ff1eba2c4bf8895170fac3ec4e74782c9241cd9cf181d73ea3741228af

  • SSDEEP

    98304:d+tEBqKEUGyN7Y/UaxmZqUChZjcne1/r64p2JLoZ01eS:dUKJzN7YsaxmZHCInepr64UJACeS

Score
8/10
collectiondiscoveryspywarestealervmprotect

Malware Config

Targets

    • Target

      Schwab_Desktop_v2.7.exe

    • Size

      401.9MB

    • MD5

      800a60c9de653f119035b42984f47e01

    • SHA1

      95d3c504865aa0c30bb24c4de3a3fc2880a8facc

    • SHA256

      b566086aa3efcbfe88ec27884e365a671c02879166d2b3a5cde186b3d0f951c5

    • SHA512

      0a35c622da1ea03a2021b6b98af9e3b0f48a236684a2e8a74accc1633b976d2fb927e196a763633c83af27a0f1b9e100a9ac5c94975ad410412d7035bab2ba8b

    • SSDEEP

      98304:Jg6OOOW638tFjYat5ddWLdpcXSpThOigPRzRR+JK:FF66FjYaFdWwXSphOig5dR+g

    Score
    8/10
    vmprotectcollectiondiscoveryspywarestealer

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

    • Target

      langs/Hungarian.ini

    • Size

      107KB

    • MD5

      7591df7fae4342cbc7a0706e1b28e87b

    • SHA1

      825e88ad498e8713522f5aef3b21ee01d6fa8b41

    • SHA256

      fe9997629d296908247a2e82da6c369e2ea7eb4c87b12fc7c8d3ecb3e6fc320d

    • SHA512

      8f58c6fbaf5ea140a3ecbbc88cbf4bdd0e0ba3fbdf169f4b7cb831094a47a6ead103f89fc07748f91d1396ebd13c7ebcc90a316f0eb203ff4c86a50be5cd3ca4

    • SSDEEP

      3072:UaKBsDgGod8NAH4iyf8kXrLfKgL6YhL+L3yGU:73X

    Score
    1/10
    behavioral3behavioral4

    • Target

      langs/Korean.ini

    • Size

      91KB

    • MD5

      efae0c78be2abe2920c78b9d4785ab45

    • SHA1

      8c0799fb68852cb071bbe260deb4ab357bd5f4ed

    • SHA256

      ad556989f6e4a683d9668e41d2d7175b7b46847c2eef26188b9075fc600d0132

    • SHA512

      44737be4d4bd0f93ca3e986c89102612932f3749b8e9b89446a567cff60ceb856b4bd7380da7fe3f1809579e6ec2162d0cdd4a217935a4961c6b36a482dd4ac8

    • SSDEEP

      768:wPYhkzQl6qE7rY+xuPAsyKVmq8Ag8lyWqFk5ziCfsg8S+EZNlWJ7lxyBiCWfbMav:HSzQlc7siCmq8AFlBmLfbNA2Nt7osVP

    Score
    1/10
    behavioral5behavioral6

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

3
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks