Analysis
-
max time kernel
89s -
max time network
91s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
02/08/2023, 09:06
General
-
Target
OperaSetup.exe
-
Size
6.1MB
-
MD5
187340d0966252e19cd25234908be33d
-
SHA1
47d9e8f4be1f2cb8dc9e979ce17344b2a906de4e
-
SHA256
1c041ceec32a88f14ba0705059598af65206ab7a61abff23b012b95928890d59
-
SHA512
7f63b5567ef65b3aa98331f27699b3f88f0ed3f793567427998770d185a80714b1a74d3ea6492ab3456df2f1f59c498032d07eaa41751c3cd29e02dbd8e90853
-
SSDEEP
98304:gGh5ziNlRUaub+MPDrc/c+NmXnKyFrsqC4HIs2iTa2UUePNlcF134zJM70TR16r:g3NlqaubXgUCqCmjmMii
Malware Config
Extracted
quasar
-
reconnect_delay
3000
Extracted
quasar
1.0
Opera
RomaPro28937723-49554.portmap.io:49554
dbdeb9e2-1d62-453a-8c06-8a6bf4be3071
-
encryption_key
8A2A7B58F2803115FF796E733C7311493928333B
-
install_name
launcher.exe
-
log_directory
Opera Logs
-
reconnect_delay
3000
-
startup_key
Opera Launcher
-
subdirectory
Opera Software
Signatures
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar payload 7 IoCs
-
Downloads MZ/PE file
-
Executes dropped EXE 8 IoCs
-
Loads dropped DLL 7 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 10 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies system certificate store 2 TTPs 12 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 34 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\OperaSetup.exe"C:\Users\Admin\AppData\Local\Temp\OperaSetup.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Opera Software\OperaSetup.exe"C:\Users\Admin\AppData\Local\Opera Software\OperaSetup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Opera Software\OperaSetup.exe"C:\Users\Admin\AppData\Local\Opera Software\OperaSetup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=100.0.4815.76 --initial-client-data=0x2e8,0x2ec,0x2f0,0x2e4,0x2f4,0x7009d178,0x7009d188,0x7009d1943⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\OperaSetup.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\OperaSetup.exe" --version3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202308020907081\assistant\Assistant_100.0.4815.21_Setup.exe_sfx.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202308020907081\assistant\Assistant_100.0.4815.21_Setup.exe_sfx.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202308020907081\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202308020907081\assistant\assistant_installer.exe" --version3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202308020907081\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202308020907081\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=100.0.4815.21 --initial-client-data=0x26c,0x270,0x274,0x248,0x278,0x104e8a0,0x104e8b0,0x104e8bc4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
C:\Users\Admin\AppData\Roaming\Opera Software\opera.exe"C:\Users\Admin\AppData\Roaming\Opera Software\opera.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Opera Launcher" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Opera Software\launcher.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Roaming\Opera Software\launcher.exe"C:\Users\Admin\AppData\Roaming\Opera Software\launcher.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Opera Launcher" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Opera Software\launcher.exe" /rl HIGHEST /f4⤵
- Creates scheduled task(s)
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /delete /tn "Opera Launcher" /f4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kGBVmb6YAx7v.bat" "4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650015⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost5⤵
- Runs ping.exe
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD527ddbd45631c889147790b6d77d97719
SHA1acfdc5911e4454bfce9ca76e4bbd24057b505a05
SHA256cfcf70165dae47335062c5e6a608877aa8ad1f4914de614af92f6165952febba
SHA512234aeebe010a161ca7de36957b9c190ed1db0d49bd5a37d508053c478e34af3c83d057ba9408535fd252517aea48a5423705de914c7ad382bfbfdc62cd34a436
-
Filesize
2.7MB
MD527ddbd45631c889147790b6d77d97719
SHA1acfdc5911e4454bfce9ca76e4bbd24057b505a05
SHA256cfcf70165dae47335062c5e6a608877aa8ad1f4914de614af92f6165952febba
SHA512234aeebe010a161ca7de36957b9c190ed1db0d49bd5a37d508053c478e34af3c83d057ba9408535fd252517aea48a5423705de914c7ad382bfbfdc62cd34a436
-
Filesize
2.7MB
MD527ddbd45631c889147790b6d77d97719
SHA1acfdc5911e4454bfce9ca76e4bbd24057b505a05
SHA256cfcf70165dae47335062c5e6a608877aa8ad1f4914de614af92f6165952febba
SHA512234aeebe010a161ca7de36957b9c190ed1db0d49bd5a37d508053c478e34af3c83d057ba9408535fd252517aea48a5423705de914c7ad382bfbfdc62cd34a436
-
Filesize
2.7MB
MD527ddbd45631c889147790b6d77d97719
SHA1acfdc5911e4454bfce9ca76e4bbd24057b505a05
SHA256cfcf70165dae47335062c5e6a608877aa8ad1f4914de614af92f6165952febba
SHA512234aeebe010a161ca7de36957b9c190ed1db0d49bd5a37d508053c478e34af3c83d057ba9408535fd252517aea48a5423705de914c7ad382bfbfdc62cd34a436
-
Filesize
2.7MB
MD527ddbd45631c889147790b6d77d97719
SHA1acfdc5911e4454bfce9ca76e4bbd24057b505a05
SHA256cfcf70165dae47335062c5e6a608877aa8ad1f4914de614af92f6165952febba
SHA512234aeebe010a161ca7de36957b9c190ed1db0d49bd5a37d508053c478e34af3c83d057ba9408535fd252517aea48a5423705de914c7ad382bfbfdc62cd34a436
-
Filesize
2.4MB
MD579ef7e63ffe3005c8edacaa49e997bdc
SHA19a236cb584c86c0d047ce55cdda4576dd40b027e
SHA256388a4c959063e7edf133058e2cf797574bed808776a7c9a0307aaeb718ff7bd1
SHA51259ee17f0f452617bcd1a4e42947310c52c21e88d31f1d6a09ebdb6ab400fcb1f997627a0f97fa185e58683d65a45425f8a7ec698f63a84d91c838e0f7e899094
-
Filesize
2.4MB
MD579ef7e63ffe3005c8edacaa49e997bdc
SHA19a236cb584c86c0d047ce55cdda4576dd40b027e
SHA256388a4c959063e7edf133058e2cf797574bed808776a7c9a0307aaeb718ff7bd1
SHA51259ee17f0f452617bcd1a4e42947310c52c21e88d31f1d6a09ebdb6ab400fcb1f997627a0f97fa185e58683d65a45425f8a7ec698f63a84d91c838e0f7e899094
-
Filesize
2.4MB
MD579ef7e63ffe3005c8edacaa49e997bdc
SHA19a236cb584c86c0d047ce55cdda4576dd40b027e
SHA256388a4c959063e7edf133058e2cf797574bed808776a7c9a0307aaeb718ff7bd1
SHA51259ee17f0f452617bcd1a4e42947310c52c21e88d31f1d6a09ebdb6ab400fcb1f997627a0f97fa185e58683d65a45425f8a7ec698f63a84d91c838e0f7e899094
-
Filesize
2.0MB
MD50d88834a56d914983a2fe03d6c8c7a83
SHA1e1ecd04c3610fe5f9df9bb747ee4754ccbdddb35
SHA256e61426a4c8d7d18d497e7ae7db69c470bae545a630e2d27eada917135fc65f53
SHA51295233cbcc81838b16825ab7bd52981d99ae4ec27c91fcd5285bff5c4e6fcea43f4a0c78617c0b9404fb69d6d83871b32f0ed6c58ca62e73e41cd999b813c3fc1
-
Filesize
2.0MB
MD50d88834a56d914983a2fe03d6c8c7a83
SHA1e1ecd04c3610fe5f9df9bb747ee4754ccbdddb35
SHA256e61426a4c8d7d18d497e7ae7db69c470bae545a630e2d27eada917135fc65f53
SHA51295233cbcc81838b16825ab7bd52981d99ae4ec27c91fcd5285bff5c4e6fcea43f4a0c78617c0b9404fb69d6d83871b32f0ed6c58ca62e73e41cd999b813c3fc1
-
Filesize
166KB
MD515a2bc75539a13167028a3d2940bf40a
SHA11aed6d2855b26aa7a8fb06d690a89da3fc8eca86
SHA25607465dffa02c99d11dcd0a81ab7cea1fc97ef6666f37b2fd10592c1c463bf693
SHA512141d44339fb706971a0b481e1987a0a0eb71e63d485404548ff7443ddf744a8b6a5f869c33e49141b974cdaf17e0a654785c8ddac789c2fb821ba0a8b72dea9d
-
Filesize
166KB
MD515a2bc75539a13167028a3d2940bf40a
SHA11aed6d2855b26aa7a8fb06d690a89da3fc8eca86
SHA25607465dffa02c99d11dcd0a81ab7cea1fc97ef6666f37b2fd10592c1c463bf693
SHA512141d44339fb706971a0b481e1987a0a0eb71e63d485404548ff7443ddf744a8b6a5f869c33e49141b974cdaf17e0a654785c8ddac789c2fb821ba0a8b72dea9d
-
Filesize
166KB
MD515a2bc75539a13167028a3d2940bf40a
SHA11aed6d2855b26aa7a8fb06d690a89da3fc8eca86
SHA25607465dffa02c99d11dcd0a81ab7cea1fc97ef6666f37b2fd10592c1c463bf693
SHA512141d44339fb706971a0b481e1987a0a0eb71e63d485404548ff7443ddf744a8b6a5f869c33e49141b974cdaf17e0a654785c8ddac789c2fb821ba0a8b72dea9d
-
Filesize
1.7MB
MD52215b082f5128ab5e3f28219f9c4118a
SHA120c6e3294a5b8ebbebb55fc0e025afff33c3834d
SHA25698593b37dfe911eea2fee3014fb1b5460c73433b73dc211d063701353441706d
SHA5123e1249a0b4baad228045f4869273821f97a0cd108bc9385478e562e91830f6bc369810d6f4021c6e04e79b9ec0f4088056f4998950af46f6ab50366522aa887d
-
Filesize
1.7MB
MD52215b082f5128ab5e3f28219f9c4118a
SHA120c6e3294a5b8ebbebb55fc0e025afff33c3834d
SHA25698593b37dfe911eea2fee3014fb1b5460c73433b73dc211d063701353441706d
SHA5123e1249a0b4baad228045f4869273821f97a0cd108bc9385478e562e91830f6bc369810d6f4021c6e04e79b9ec0f4088056f4998950af46f6ab50366522aa887d
-
Filesize
1.7MB
MD52215b082f5128ab5e3f28219f9c4118a
SHA120c6e3294a5b8ebbebb55fc0e025afff33c3834d
SHA25698593b37dfe911eea2fee3014fb1b5460c73433b73dc211d063701353441706d
SHA5123e1249a0b4baad228045f4869273821f97a0cd108bc9385478e562e91830f6bc369810d6f4021c6e04e79b9ec0f4088056f4998950af46f6ab50366522aa887d
-
Filesize
90.9MB
MD58f2518c16c95940448da142c6c02027d
SHA15f9a4e6f5977ab1114f6ecf1cdb3c2f9bfc48079
SHA2568cfa8195c716e3e317308c69c4f3091abfc1ee98b8ca78db2e7ef6ca95c0ee62
SHA512e6e38b3001f6ae50e32993140456e0c8102bb4119649f9cb9527192324850dd09bd98af507c1041b4095cb95d674166e6a6422e233d300e895f8d697cadaf5d5
-
Filesize
4.5MB
MD5d457c7babc8cb0909303e5a46e70eeb2
SHA1912fb82d1e6b7489b8b41e1f80f4a991fe9db2a8
SHA2561f4a482f829847a57e663101cda02443aead44b1eab9fdc3f1da6b3015643160
SHA5126a335fffb02fe06fc4ecf81d091e5ea9c10225427cb4ca70da5fadba17c2223507afd6de9b6b073c4ad05c0554d42a02e4b9980f20bd01e17328c46847275e8d
-
Filesize
4.5MB
MD5d457c7babc8cb0909303e5a46e70eeb2
SHA1912fb82d1e6b7489b8b41e1f80f4a991fe9db2a8
SHA2561f4a482f829847a57e663101cda02443aead44b1eab9fdc3f1da6b3015643160
SHA5126a335fffb02fe06fc4ecf81d091e5ea9c10225427cb4ca70da5fadba17c2223507afd6de9b6b073c4ad05c0554d42a02e4b9980f20bd01e17328c46847275e8d
-
Filesize
4.5MB
MD5d457c7babc8cb0909303e5a46e70eeb2
SHA1912fb82d1e6b7489b8b41e1f80f4a991fe9db2a8
SHA2561f4a482f829847a57e663101cda02443aead44b1eab9fdc3f1da6b3015643160
SHA5126a335fffb02fe06fc4ecf81d091e5ea9c10225427cb4ca70da5fadba17c2223507afd6de9b6b073c4ad05c0554d42a02e4b9980f20bd01e17328c46847275e8d
-
Filesize
4.5MB
MD5d457c7babc8cb0909303e5a46e70eeb2
SHA1912fb82d1e6b7489b8b41e1f80f4a991fe9db2a8
SHA2561f4a482f829847a57e663101cda02443aead44b1eab9fdc3f1da6b3015643160
SHA5126a335fffb02fe06fc4ecf81d091e5ea9c10225427cb4ca70da5fadba17c2223507afd6de9b6b073c4ad05c0554d42a02e4b9980f20bd01e17328c46847275e8d
-
Filesize
221B
MD507caa99f84582ea35065d841de829eb9
SHA174bf4aa5a8d7f41d372ba60d42ed6f794e122450
SHA256b0a8006e3f34507a58075a021a137a075ece9d10b4f848c9c8c19ebcaf3c6099
SHA512cec1e5fc4af65a6a5d4392809e052846a4a545f545d5ff680e7bd03a18dd2a5141b582847e4680545710a84153cfc0cdb96f7c6884d1e454171e7c8a1ccefbb7
-
Filesize
40B
MD59d27986e92662b4267c9018414fa741d
SHA1b718e142c120ea5ccf81b3de5c1bcfae9f3c6a8f
SHA2569bb8dc1a23aa5dbe6a1d20e4407020c802102bf08d09aa3b6701082ed03fa1c2
SHA512375cf9e3b6978e26cb6729e3fe1b73f531ac39665df6526fe3e7f6ffcc6f1f100fdf2521ea487f4369f3c25d67f19aaea55f9eac6519968555d9d445d5f0873a
-
Filesize
40B
MD59d27986e92662b4267c9018414fa741d
SHA1b718e142c120ea5ccf81b3de5c1bcfae9f3c6a8f
SHA2569bb8dc1a23aa5dbe6a1d20e4407020c802102bf08d09aa3b6701082ed03fa1c2
SHA512375cf9e3b6978e26cb6729e3fe1b73f531ac39665df6526fe3e7f6ffcc6f1f100fdf2521ea487f4369f3c25d67f19aaea55f9eac6519968555d9d445d5f0873a
-
Filesize
3.2MB
MD553d988fd134e127b6c285d6ba799cb35
SHA11b4b5db46a2d4764b1d8e96c845df97d7d0fb3c2
SHA256f42af11e64e132b7000228eb69c8a85b5eb9100114a5e6a51c493550923d6b90
SHA512a4b5eabfdeb5d8c26ac4ac96125ffee0b34b007f447db52973c4596ca857dcd06821d46d58846681fdf8b959ea7b326aa52afe66f4d4a65aae00be822046785b
-
Filesize
3.2MB
MD553d988fd134e127b6c285d6ba799cb35
SHA11b4b5db46a2d4764b1d8e96c845df97d7d0fb3c2
SHA256f42af11e64e132b7000228eb69c8a85b5eb9100114a5e6a51c493550923d6b90
SHA512a4b5eabfdeb5d8c26ac4ac96125ffee0b34b007f447db52973c4596ca857dcd06821d46d58846681fdf8b959ea7b326aa52afe66f4d4a65aae00be822046785b
-
Filesize
3.2MB
MD553d988fd134e127b6c285d6ba799cb35
SHA11b4b5db46a2d4764b1d8e96c845df97d7d0fb3c2
SHA256f42af11e64e132b7000228eb69c8a85b5eb9100114a5e6a51c493550923d6b90
SHA512a4b5eabfdeb5d8c26ac4ac96125ffee0b34b007f447db52973c4596ca857dcd06821d46d58846681fdf8b959ea7b326aa52afe66f4d4a65aae00be822046785b
-
Filesize
3.2MB
MD553d988fd134e127b6c285d6ba799cb35
SHA11b4b5db46a2d4764b1d8e96c845df97d7d0fb3c2
SHA256f42af11e64e132b7000228eb69c8a85b5eb9100114a5e6a51c493550923d6b90
SHA512a4b5eabfdeb5d8c26ac4ac96125ffee0b34b007f447db52973c4596ca857dcd06821d46d58846681fdf8b959ea7b326aa52afe66f4d4a65aae00be822046785b
-
Filesize
3.2MB
MD553d988fd134e127b6c285d6ba799cb35
SHA11b4b5db46a2d4764b1d8e96c845df97d7d0fb3c2
SHA256f42af11e64e132b7000228eb69c8a85b5eb9100114a5e6a51c493550923d6b90
SHA512a4b5eabfdeb5d8c26ac4ac96125ffee0b34b007f447db52973c4596ca857dcd06821d46d58846681fdf8b959ea7b326aa52afe66f4d4a65aae00be822046785b
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
3.2MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
240KB
-
Filesize
10.8MB
-
Filesize
72KB
-
Filesize
712KB
-
Filesize
10.8MB
-
Filesize
320KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
64KB
-
Filesize
584KB
-
Filesize
5.6MB
-
Filesize
624KB
-
Filesize
344KB
-
Filesize
7.7MB
-
Filesize
6.1MB
-
Filesize
5.2MB