631fab57f2dccc7c3ea12c61f100027a35297df23230112d5ae3197735543ec1

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 15:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
631fab57f2dccc7c3ea12c61f100027a35297df23230112d5ae3197735543ec1.exe
Size 3.7MB
Sample240502-snvggsdf83
SHA256 631fab57f2dccc7c3ea12c61f100027a35297df23230112d5ae3197735543ec1
MD5 990615bc2a3a1b858f7b869a346774ce
SHA1 5dce990a98375e10a397165ae6aa574480c180a9
SHA512 b043afa946be8fbadee880c2705144130380d949538799664ff7b2783d10a446ae773ec0b79feb36bec46c990bc610ed7022a05ec8d7cdbed432a2bbba24827a
SSDEEP 98304:ZqcHd9dChDBdG26666666666666666666666666666666x666666666666666fwQ:ZqcHZChfGcwMqlqX
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3960	631fab57f2dccc7c3ea12c61f100027a35297df23230112d5ae3197735543ec1.exe
3960	631fab57f2dccc7c3ea12c61f100027a35297df23230112d5ae3197735543ec1.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 3960	744	631fab57f2dccc7c3ea12c61f100027a35297df23230112d5ae3197735543ec1.exe	83
PID 744 wrote to memory of 3960	744	631fab57f2dccc7c3ea12c61f100027a35297df23230112d5ae3197735543ec1.exe	83
PID 744 wrote to memory of 3960	744	631fab57f2dccc7c3ea12c61f100027a35297df23230112d5ae3197735543ec1.exe	83

C:\Users\Admin\AppData\Local\Temp\631fab57f2dccc7c3ea12c61f100027a35297df23230112d5ae3197735543ec1.exe
"C:\Users\Admin\AppData\Local\Temp\631fab57f2dccc7c3ea12c61f100027a35297df23230112d5ae3197735543ec1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:744
- C:\Users\Admin\AppData\Local\Temp\631fab57f2dccc7c3ea12c61f100027a35297df23230112d5ae3197735543ec1.exe
  C:\Users\Admin\AppData\Local\Temp\631fab57f2dccc7c3ea12c61f100027a35297df23230112d5ae3197735543ec1.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=73.0.3856.382 --initial-client-data=0x274,0x278,0x27c,0x250,0x280,0x7057a0,0x7057b0,0x7057bc
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7c2c4854-e21f-4fbb-a172-37bd4f1c4edd.dmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\reports\7c2c4854-e21f-4fbb-a172-37bd4f1c4edd.dmp
Size 344KB
SHA256 78146acb8ee6d42b4e22ba954d895ddcf4a3e6d5a3fb113976483c64fc43a028
MD5 d936df4f8200c193a3f3ed3beb080540
SHA1 3340f3cbfc7793e8f3c83386e5c5c61df514e1fa
SHA512 bae0efba8a468e34e1274af0658e66c7e977b151a2438443e09e7fe73e3e38510acfa4e008146662f5d99afd4c0090f659aef962892e96f7c996f76d0164c528
SSDEEP 3072:vhPjEURSE3zq7G2b7c78jFfNJ6DFuo8MBTPh9I8TnDSdhP9Lez1aC:9yfcwjFfNJ6DFuo8MBTPh93TnWM
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat
Size 40B
SHA256 6de11d9d89af78621c138e23c980866e411997695c553a935bc9fd903b632675
MD5 f78288308cc4c2a9c69a79ac5ea2bed1
SHA1 6d06efb6c13b91f7fdf24be3f4cf5740d9ae91f6
SHA512 494e3f3bc5ac90ce1bb8e085a4632dd0b641031826faeec886cb56fdc9ead5e513a03dd6ac3937e268b127b54af28f5bf7db9ade875447d6088894cbe2b32031
MD5 SHA1 SHA512

Submit Download

memory/744-0-0x0000000000400000-0x00000000007B9000-memory.dmp

Download

memory/744-15-0x0000000000400000-0x00000000007B9000-memory.dmp

Download

memory/3960-5-0x0000000000400000-0x00000000007B9000-memory.dmp

Download

memory/3960-25-0x0000000000400000-0x00000000007B9000-memory.dmp

Download