1d48fc48bc4e0bbafd3defadc3452266edd1c9b91ccafc7fc13fc8c40ba6f15f

Analysis

max time kernel
121s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-04-2024 19:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

67e49b12addd7dfe76416faa910bebd0.exe
Size

37KB
MD5

67e49b12addd7dfe76416faa910bebd0
SHA1

66ad5c50b15556d09e7fe17fb9a32ae02c3c3dd1
SHA256

1d48fc48bc4e0bbafd3defadc3452266edd1c9b91ccafc7fc13fc8c40ba6f15f
SHA512

266c85a13e01a34661c010cf62ba41f341a65cd680b47e1b56c5f64ad82767f6a8908ea38fa67c5ae97c708493eb47cbd1fc0a18de905be0d1895d5e028d476d
SSDEEP

384:JC+EaVVpDSL/7wIUAch1A9NB/erdO9oMCCQcxbRxla0rh84KtI3/w9netgKPTv08:JSfL/76As1FdMQ8RjaeeILt//+SWRFw

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2836	opera_autoupdater.exe

Loads dropped DLL 4 IoCs

pid	Process
2872	67e49b12addd7dfe76416faa910bebd0.exe
2836	opera_autoupdater.exe
2836	opera_autoupdater.exe
2836	opera_autoupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2836	2872	67e49b12addd7dfe76416faa910bebd0.exe	28
PID 2872 wrote to memory of 2836	2872	67e49b12addd7dfe76416faa910bebd0.exe	28
PID 2872 wrote to memory of 2836	2872	67e49b12addd7dfe76416faa910bebd0.exe	28
PID 2872 wrote to memory of 2836	2872	67e49b12addd7dfe76416faa910bebd0.exe	28
PID 2872 wrote to memory of 2836	2872	67e49b12addd7dfe76416faa910bebd0.exe	28
PID 2872 wrote to memory of 2836	2872	67e49b12addd7dfe76416faa910bebd0.exe	28
PID 2872 wrote to memory of 2836	2872	67e49b12addd7dfe76416faa910bebd0.exe	28

C:\Users\Admin\AppData\Local\Temp\67e49b12addd7dfe76416faa910bebd0.exe
"C:\Users\Admin\AppData\Local\Temp\67e49b12addd7dfe76416faa910bebd0.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Users\Admin\AppData\Local\Temp\opera_autoupdater.exe
  "C:\Users\Admin\AppData\Local\Temp\opera_autoupdater.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\opera_autoupdater.exe

Filesize
37KB

MD5
ab306cacd6a3020e10776894887b863f

SHA1
9351ad802d0c9239b2682b742361d5ae7ef1725c

SHA256
3e294b7b30962122fdaa76ab75d66dbcae9656ee7f342b495861ab3a86408050

SHA512
45794b55fbaf8baa9ea374d5fd4c2a6a5d1ddb6128c2df9385fae838603e068ef92ad5f786235347788b5e639ccd9d1cdaa275f2f6c86874712d6ec8fdc00721

Download Submit
memory/2872-0-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download