Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-06-2024 13:53

General

  • Target

    772825846835d94e306d78560040161879b9db4b73fd9f7921753fa7441bfce2.exe

  • Size

    3.3MB

  • MD5

    d41501d6899358a83d6f39b856517c5b

  • SHA1

    e698963ba1816f8afb76d9f65e935e78cbe3f8b9

  • SHA256

    772825846835d94e306d78560040161879b9db4b73fd9f7921753fa7441bfce2

  • SHA512

    0804ba6a4ce018dc78383c0c0a9702fa9aee579edd2637ddb61b81aaab79e50efff47ef86703011cd80a6c400f50b8c35512981e71b069dad45978ed619c6f65

  • SSDEEP

    98304:6Ol4eNA4MqMVdrh6h6UuLQhpejzEjlPdm23JYC+BBvUWuj2dtLS:6Ol1+JTrH325YJvuI

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\772825846835d94e306d78560040161879b9db4b73fd9f7921753fa7441bfce2.exe
    "C:\Users\Admin\AppData\Local\Temp\772825846835d94e306d78560040161879b9db4b73fd9f7921753fa7441bfce2.exe"
    1⤵
    • Loads dropped DLL
    • Enumerates connected drives
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:884
    • C:\Users\Admin\AppData\Local\Temp\772825846835d94e306d78560040161879b9db4b73fd9f7921753fa7441bfce2.exe
      C:\Users\Admin\AppData\Local\Temp\772825846835d94e306d78560040161879b9db4b73fd9f7921753fa7441bfce2.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=99.0.4788.49 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2c8,0x2f8,0x74f0a108,0x74f0a118,0x74f0a124
      2⤵
      • Loads dropped DLL
      PID:3192
    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\772825846835d94e306d78560040161879b9db4b73fd9f7921753fa7441bfce2.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\772825846835d94e306d78560040161879b9db4b73fd9f7921753fa7441bfce2.exe" --version
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2424

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\772825846835d94e306d78560040161879b9db4b73fd9f7921753fa7441bfce2.exe

    Filesize

    3.3MB

    MD5

    d41501d6899358a83d6f39b856517c5b

    SHA1

    e698963ba1816f8afb76d9f65e935e78cbe3f8b9

    SHA256

    772825846835d94e306d78560040161879b9db4b73fd9f7921753fa7441bfce2

    SHA512

    0804ba6a4ce018dc78383c0c0a9702fa9aee579edd2637ddb61b81aaab79e50efff47ef86703011cd80a6c400f50b8c35512981e71b069dad45978ed619c6f65

  • C:\Users\Admin\AppData\Local\Temp\Opera_installer_240612135311292884.dll

    Filesize

    5.1MB

    MD5

    30f85385033134cb6db41e29ccfc60a4

    SHA1

    77797120af3ff451563627ecb67939d00b722bde

    SHA256

    f1e2fa22d39268551e4a639dac3f19d2c1de87d85d776b059f0e92d627deb2fe

    SHA512

    33941260f6b626a7c07a7cd567c7b28cbccb8c4d8e472f70b85d2a8ec883e9298b3652dbc252905f25c34d3b90a539f00ff2342eef0723c357be298a363991af

  • memory/884-1-0x00000000001C0000-0x000000000077C000-memory.dmp

    Filesize

    5.7MB

  • memory/884-21-0x00000000001C0000-0x000000000077C000-memory.dmp

    Filesize

    5.7MB

  • memory/2424-16-0x0000000000800000-0x0000000000DBC000-memory.dmp

    Filesize

    5.7MB

  • memory/2424-19-0x0000000000800000-0x0000000000DBC000-memory.dmp

    Filesize

    5.7MB

  • memory/3192-4-0x00000000001C0000-0x000000000077C000-memory.dmp

    Filesize

    5.7MB

  • memory/3192-22-0x00000000001C0000-0x000000000077C000-memory.dmp

    Filesize

    5.7MB