ecf3427faa276ebfe07c5d66f77a9a2a5f66c8a9f012a1f403e0700b7ed0b3dd

General

Target

ecf3427faa276ebfe07c5d66f77a9a2a5f66c8a9f012a1f403e0700b7ed0b3dd.exe
Size

2.1MB
MD5

68bd5420c066fcaf0a1bc7bc276a6ebb
SHA1

eaace0d460c7775c6b282c4390cd5365b0b5462f
SHA256

ecf3427faa276ebfe07c5d66f77a9a2a5f66c8a9f012a1f403e0700b7ed0b3dd
SHA512

dacf5a508eed595165a20d75c9c1ebc427f5226224c614343d8599d6e8771a3cb5820475a2a0845e90025914c011cc620110563b1048182c1ea5054f886f64ba
SSDEEP

49152:O4c8XwyWct3boU95L0N9bLvrHCV3c79e1Smpli2SegcNQXWtd70L5YS:O4ckwyWctLo/T72z4Dka

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4008	ecf3427faa276ebfe07c5d66f77a9a2a5f66c8a9f012a1f403e0700b7ed0b3dd.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1152-135-0x0000000000660000-0x0000000000A26000-memory.dmp	upx
behavioral2/memory/4484-136-0x0000000000660000-0x0000000000A26000-memory.dmp	upx
behavioral2/files/0x0006000000022e0d-139.dat	upx
behavioral2/memory/4008-141-0x0000000000880000-0x0000000000C46000-memory.dmp	upx

Loads dropped DLL 3 IoCs

pid	Process
1152	ecf3427faa276ebfe07c5d66f77a9a2a5f66c8a9f012a1f403e0700b7ed0b3dd.exe
4484	ecf3427faa276ebfe07c5d66f77a9a2a5f66c8a9f012a1f403e0700b7ed0b3dd.exe
4008	ecf3427faa276ebfe07c5d66f77a9a2a5f66c8a9f012a1f403e0700b7ed0b3dd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	ecf3427faa276ebfe07c5d66f77a9a2a5f66c8a9f012a1f403e0700b7ed0b3dd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 4484	1152	ecf3427faa276ebfe07c5d66f77a9a2a5f66c8a9f012a1f403e0700b7ed0b3dd.exe	80
PID 1152 wrote to memory of 4484	1152	ecf3427faa276ebfe07c5d66f77a9a2a5f66c8a9f012a1f403e0700b7ed0b3dd.exe	80
PID 1152 wrote to memory of 4484	1152	ecf3427faa276ebfe07c5d66f77a9a2a5f66c8a9f012a1f403e0700b7ed0b3dd.exe	80
PID 1152 wrote to memory of 4008	1152	ecf3427faa276ebfe07c5d66f77a9a2a5f66c8a9f012a1f403e0700b7ed0b3dd.exe	81
PID 1152 wrote to memory of 4008	1152	ecf3427faa276ebfe07c5d66f77a9a2a5f66c8a9f012a1f403e0700b7ed0b3dd.exe	81
PID 1152 wrote to memory of 4008	1152	ecf3427faa276ebfe07c5d66f77a9a2a5f66c8a9f012a1f403e0700b7ed0b3dd.exe	81

C:\Users\Admin\AppData\Local\Temp\ecf3427faa276ebfe07c5d66f77a9a2a5f66c8a9f012a1f403e0700b7ed0b3dd.exe
"C:\Users\Admin\AppData\Local\Temp\ecf3427faa276ebfe07c5d66f77a9a2a5f66c8a9f012a1f403e0700b7ed0b3dd.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Users\Admin\AppData\Local\Temp\ecf3427faa276ebfe07c5d66f77a9a2a5f66c8a9f012a1f403e0700b7ed0b3dd.exe
  C:\Users\Admin\AppData\Local\Temp\ecf3427faa276ebfe07c5d66f77a9a2a5f66c8a9f012a1f403e0700b7ed0b3dd.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=58.0.3135.53 --initial-client-data=0x270,0x284,0x288,0x280,0x28c,0x754ca8e0,0x754ca8f0,0x754ca8fc
  2⤵
  - Loads dropped DLL
  PID:4484
- C:\Users\Admin\AppData\Local\Temp\Opera Installer\ecf3427faa276ebfe07c5d66f77a9a2a5f66c8a9f012a1f403e0700b7ed0b3dd.exe
  "C:\Users\Admin\AppData\Local\Temp\Opera Installer\ecf3427faa276ebfe07c5d66f77a9a2a5f66c8a9f012a1f403e0700b7ed0b3dd.exe" --version
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4008

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Opera Installer\ecf3427faa276ebfe07c5d66f77a9a2a5f66c8a9f012a1f403e0700b7ed0b3dd.exe

Filesize
2.1MB

MD5
68bd5420c066fcaf0a1bc7bc276a6ebb

SHA1
eaace0d460c7775c6b282c4390cd5365b0b5462f

SHA256
ecf3427faa276ebfe07c5d66f77a9a2a5f66c8a9f012a1f403e0700b7ed0b3dd

SHA512
dacf5a508eed595165a20d75c9c1ebc427f5226224c614343d8599d6e8771a3cb5820475a2a0845e90025914c011cc620110563b1048182c1ea5054f886f64ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Opera_installer_2210201502551201152.dll

Filesize
2.9MB

MD5
4f458563ccb143ff7f3bbcc57bb43067

SHA1
7caa08067bb0165622165f5f21485a7de76a4ae6

SHA256
9bc8a1b8429f516c7ea42743eee33ae30b8e5138867303f101b7b9e343772470

SHA512
02c459dfa48ec123555357b5d1484ce52ed447e3fff3b3ab712bfa24f9ec3ac0aea4b6f754e5a405563f1c02dfd9c56dc55a227c6282984655885a23759a6905

Download Submit
C:\Users\Admin\AppData\Local\Temp\Opera_installer_2210201502554644484.dll

Filesize
2.9MB

MD5
4f458563ccb143ff7f3bbcc57bb43067

SHA1
7caa08067bb0165622165f5f21485a7de76a4ae6

SHA256
9bc8a1b8429f516c7ea42743eee33ae30b8e5138867303f101b7b9e343772470

SHA512
02c459dfa48ec123555357b5d1484ce52ed447e3fff3b3ab712bfa24f9ec3ac0aea4b6f754e5a405563f1c02dfd9c56dc55a227c6282984655885a23759a6905

Download Submit
C:\Users\Admin\AppData\Local\Temp\Opera_installer_2210201502563394008.dll

Filesize
2.9MB

MD5
4f458563ccb143ff7f3bbcc57bb43067

SHA1
7caa08067bb0165622165f5f21485a7de76a4ae6

SHA256
9bc8a1b8429f516c7ea42743eee33ae30b8e5138867303f101b7b9e343772470

SHA512
02c459dfa48ec123555357b5d1484ce52ed447e3fff3b3ab712bfa24f9ec3ac0aea4b6f754e5a405563f1c02dfd9c56dc55a227c6282984655885a23759a6905

Download Submit
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

Filesize
40B

MD5
d1fe5dae1cd1fd9d588caa842353ff47

SHA1
2fac235cd3291e472436c446184c4d3c91c899a1

SHA256
7d61b4b86aafe3e409899cfbb92f3550bb792589c5e9638aec8e8adbcde0f788

SHA512
92cafb839575e87f7c931e51a32a26fc55ee4d38959d9443b8b54dec54e02d50a55dc45e846ba9e6dc7533bb8617f23679021fb66dc690af60566c29d596449c

Download Submit
memory/1152-135-0x0000000000660000-0x0000000000A26000-memory.dmp

Filesize
3.8MB

Download
memory/4008-141-0x0000000000880000-0x0000000000C46000-memory.dmp

Filesize
3.8MB

Download
memory/4484-136-0x0000000000660000-0x0000000000A26000-memory.dmp

Filesize
3.8MB

Download

Analysis

Sharing