5e956e660a87294c678892b2907cc42cac5543fb71a3364e089fd75b823a076d

General

Target

5e956e660a87294c678892b2907cc42cac5543fb71a3364e089fd75b823a076d.exe
Size

2.4MB
MD5

44e805e6a73cc9aa145a1880b5121ed5
SHA1

9afdb57b73e8cbb5ff13f2352703481ef3f932de
SHA256

5e956e660a87294c678892b2907cc42cac5543fb71a3364e089fd75b823a076d
SHA512

7950893416e20832d41f6c866f3d02ea609b99701824398c1f965c4cd97c12b7421fba72c4f142c653e8df5ac4a6f8c0530ba9f83745cf1cf1333cd6cfdc87d4
SSDEEP

49152:OrGz6Twh2vmbJg48S3pbOSrowX038gWskigEc+2Eq0TVB9Bqhjy/Qt6r7:f6TDvmbJX80rowX0Mfskif2oBBGhj7tm

Score

8^/10

spyware stealer upx

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
3276	5e956e660a87294c678892b2907cc42cac5543fb71a3364e089fd75b823a076d.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/364-132-0x00000000005C0000-0x0000000000A1A000-memory.dmp	upx
behavioral2/memory/364-133-0x00000000005C0000-0x0000000000A1A000-memory.dmp	upx
behavioral2/memory/2380-138-0x00000000005C0000-0x0000000000A1A000-memory.dmp	upx
behavioral2/files/0x0006000000023167-140.dat	upx
behavioral2/memory/3276-141-0x0000000000480000-0x00000000008DA000-memory.dmp	upx
behavioral2/memory/2380-142-0x00000000005C0000-0x0000000000A1A000-memory.dmp	upx
behavioral2/memory/3276-144-0x0000000000480000-0x00000000008DA000-memory.dmp	upx

Loads dropped DLL 3 IoCs

pid	Process
364	5e956e660a87294c678892b2907cc42cac5543fb71a3364e089fd75b823a076d.exe
2380	5e956e660a87294c678892b2907cc42cac5543fb71a3364e089fd75b823a076d.exe
3276	5e956e660a87294c678892b2907cc42cac5543fb71a3364e089fd75b823a076d.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	5e956e660a87294c678892b2907cc42cac5543fb71a3364e089fd75b823a076d.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
364	5e956e660a87294c678892b2907cc42cac5543fb71a3364e089fd75b823a076d.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 364 wrote to memory of 2380	364	5e956e660a87294c678892b2907cc42cac5543fb71a3364e089fd75b823a076d.exe	84
PID 364 wrote to memory of 2380	364	5e956e660a87294c678892b2907cc42cac5543fb71a3364e089fd75b823a076d.exe	84
PID 364 wrote to memory of 2380	364	5e956e660a87294c678892b2907cc42cac5543fb71a3364e089fd75b823a076d.exe	84
PID 364 wrote to memory of 3276	364	5e956e660a87294c678892b2907cc42cac5543fb71a3364e089fd75b823a076d.exe	85
PID 364 wrote to memory of 3276	364	5e956e660a87294c678892b2907cc42cac5543fb71a3364e089fd75b823a076d.exe	85
PID 364 wrote to memory of 3276	364	5e956e660a87294c678892b2907cc42cac5543fb71a3364e089fd75b823a076d.exe	85

C:\Users\Admin\AppData\Local\Temp\5e956e660a87294c678892b2907cc42cac5543fb71a3364e089fd75b823a076d.exe
"C:\Users\Admin\AppData\Local\Temp\5e956e660a87294c678892b2907cc42cac5543fb71a3364e089fd75b823a076d.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:364
- C:\Users\Admin\AppData\Local\Temp\5e956e660a87294c678892b2907cc42cac5543fb71a3364e089fd75b823a076d.exe
  C:\Users\Admin\AppData\Local\Temp\5e956e660a87294c678892b2907cc42cac5543fb71a3364e089fd75b823a076d.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=68.0.3618.173 --initial-client-data=0x2c0,0x2c4,0x2c8,0x29c,0x2cc,0x74cf0558,0x74cf0568,0x74cf0574
  2⤵
  - Loads dropped DLL
  PID:2380
- C:\Users\Admin\AppData\Local\Temp\Opera Installer Temp\5e956e660a87294c678892b2907cc42cac5543fb71a3364e089fd75b823a076d.exe
  "C:\Users\Admin\AppData\Local\Temp\Opera Installer Temp\5e956e660a87294c678892b2907cc42cac5543fb71a3364e089fd75b823a076d.exe" --version
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3276

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Opera Installer Temp\5e956e660a87294c678892b2907cc42cac5543fb71a3364e089fd75b823a076d.exe

Filesize
2.4MB

MD5
44e805e6a73cc9aa145a1880b5121ed5

SHA1
9afdb57b73e8cbb5ff13f2352703481ef3f932de

SHA256
5e956e660a87294c678892b2907cc42cac5543fb71a3364e089fd75b823a076d

SHA512
7950893416e20832d41f6c866f3d02ea609b99701824398c1f965c4cd97c12b7421fba72c4f142c653e8df5ac4a6f8c0530ba9f83745cf1cf1333cd6cfdc87d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Opera_installer_221201035350039364.dll

Filesize
3.2MB

MD5
17177fbb166b60e925432e142a5e9bf2

SHA1
4829e9593599b640c78948090af6578339df47c0

SHA256
4d2b8f2b1ef5fe1072763f6f6b588bce88f63d601406b9f846aebb28b115c967

SHA512
1ecf90c74da61ed2261aa56ff09627e6f9c3d84024fef777bc456a1bf396ac35cef0cc1ebd67ae5ccfc3dc2e6d17688e5a0405bea81e57bf486eff226a92913a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Opera_installer_2212010354166322380.dll

Filesize
3.2MB

MD5
17177fbb166b60e925432e142a5e9bf2

SHA1
4829e9593599b640c78948090af6578339df47c0

SHA256
4d2b8f2b1ef5fe1072763f6f6b588bce88f63d601406b9f846aebb28b115c967

SHA512
1ecf90c74da61ed2261aa56ff09627e6f9c3d84024fef777bc456a1bf396ac35cef0cc1ebd67ae5ccfc3dc2e6d17688e5a0405bea81e57bf486eff226a92913a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Opera_installer_2212010354180393276.dll

Filesize
3.2MB

MD5
17177fbb166b60e925432e142a5e9bf2

SHA1
4829e9593599b640c78948090af6578339df47c0

SHA256
4d2b8f2b1ef5fe1072763f6f6b588bce88f63d601406b9f846aebb28b115c967

SHA512
1ecf90c74da61ed2261aa56ff09627e6f9c3d84024fef777bc456a1bf396ac35cef0cc1ebd67ae5ccfc3dc2e6d17688e5a0405bea81e57bf486eff226a92913a

Download Submit
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

Filesize
40B

MD5
776f7a503123ed24becfe2eabf70a75a

SHA1
11fc764aca0ab5c77fe5931db1bf208151a2db47

SHA256
1f6126a09b866a51dfbdaaf82bb7b79ac2423e29b6a0243e883cb7d511eacf3e

SHA512
eaed31132034abdfc663fb340974b83be2ed26087331e4f6118fa666a5191fc1d0fb12e9f56059def16832d6d2f8eb0aef2a9e711967ba609f7955b2a5ffa59e

Download Submit
memory/364-133-0x00000000005C0000-0x0000000000A1A000-memory.dmp

Filesize
4.4MB

Download
memory/364-132-0x00000000005C0000-0x0000000000A1A000-memory.dmp

Filesize
4.4MB

Download
memory/2380-138-0x00000000005C0000-0x0000000000A1A000-memory.dmp

Filesize
4.4MB

Download
memory/2380-142-0x00000000005C0000-0x0000000000A1A000-memory.dmp

Filesize
4.4MB

Download
memory/3276-141-0x0000000000480000-0x00000000008DA000-memory.dmp

Filesize
4.4MB

Download
memory/3276-144-0x0000000000480000-0x00000000008DA000-memory.dmp

Filesize
4.4MB

Download

Analysis

Sharing