Analysis

  • max time kernel
    211s
  • max time network
    289s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    27/06/2024, 22:54

General

  • Target

    641c1cf2c124706a971917861c38b2353e6010649c53c73720cee5149eb1f0cb.exe

  • Size

    2.0MB

  • MD5

    14832043698de68c5b732fcd4d59bdd2

  • SHA1

    b345d26f3ad061346642296a8e1b20f233e5b73c

  • SHA256

    641c1cf2c124706a971917861c38b2353e6010649c53c73720cee5149eb1f0cb

  • SHA512

    e85c3f6a33974b52bea1880cfa3bb15714068740f5a9a4d2247ec67ebd60cd2ede187ee5db5ac68b3be41f18d26027b755ee2130241b177c0c64fcf15e7805de

  • SSDEEP

    49152:ONEyY80FNFPy4tGmml/0947g+b9W7m6S/sbs0wQ22qPAoFmkB:kEhFvqXjbqoJQCX

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\641c1cf2c124706a971917861c38b2353e6010649c53c73720cee5149eb1f0cb.exe
    "C:\Users\Admin\AppData\Local\Temp\641c1cf2c124706a971917861c38b2353e6010649c53c73720cee5149eb1f0cb.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5028
    • C:\Users\Admin\AppData\Local\Temp\7zS4A356D27\setup.exe
      C:\Users\Admin\AppData\Local\Temp\7zS4A356D27\setup.exe --server-tracking-blob=YTJkYjlkMzg5YTc0NDYxNDk2OTVlMzJhNTNhZTMzM2ZjMjQzZDFkODFlMTdkNjE1MjBhMDVkNmFiZDA5ZmQzYzp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fbWVkaXVtPXBiJnV0bV9zb3VyY2U9Y2luc3QmdXRtX2NhbXBhaWduPU9wZXJhX0Rlc2t0b3AmdXRtX2NvbnRlbnQ9NWQ3NzZmZmE0ZDQ4OF8mdXRtX2lkPUdmVmZYOUx4SERBbUJKcXJ4OEVVQXciLCJ0aW1lc3RhbXAiOiIxNzE5MDMxMjA4LjE0MDMiLCJ1dG0iOnsiY2FtcGFpZ24iOiJPcGVyYV9EZXNrdG9wIiwiY29udGVudCI6IjVkNzc2ZmZhNGQ0ODhfIiwiaWQiOiJHZlZmWDlMeEhEQW1CSnFyeDhFVUF3IiwibWVkaXVtIjoicGIiLCJzb3VyY2UiOiJjaW5zdCJ9LCJ1dWlkIjoiZGIyNTNhNTgtMzZmNS00ZjI3LWIzYzQtYjVlNjllYWJmNzAzIn0=
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Enumerates connected drives
      • Modifies system certificate store
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1244
      • C:\Users\Admin\AppData\Local\Temp\7zS4A356D27\setup.exe
        C:\Users\Admin\AppData\Local\Temp\7zS4A356D27\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=111.0.5168.25 --initial-client-data=0x308,0x30c,0x310,0x304,0x314,0x72d5a128,0x72d5a134,0x72d5a140
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3864
      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\setup.exe
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\setup.exe" --version
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4108
      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202406272255321\assistant\Assistant_111.0.5168.25_Setup.exe_sfx.exe
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202406272255321\assistant\Assistant_111.0.5168.25_Setup.exe_sfx.exe"
        3⤵
        • Executes dropped EXE
        PID:4296
      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202406272255321\assistant\assistant_installer.exe
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202406272255321\assistant\assistant_installer.exe" --version
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:4448
        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202406272255321\assistant\assistant_installer.exe
          "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202406272255321\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=111.0.5168.25 --initial-client-data=0x230,0x234,0x238,0x20c,0x23c,0x14e9f88,0x14e9f94,0x14e9fa0
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4892

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202406272255321\additional_file0.tmp

    Filesize

    2.6MB

    MD5

    dfe86cd1ab9fe5055dba3ead830574f6

    SHA1

    800ba6757bf301a918a800ce15a3853e3941e019

    SHA256

    f9cdff6fea65207cde93c637cca4b92939359ede3ac7337c2048e076085e7e5f

    SHA512

    d3d363a221a3fa7a010194965cb8cc7210aa17d81be094a3e8ee89bb2de684c3b874ce1c6c55e8109091a849874d05c1bae132d450dabe2597167782d0063570

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202406272255321\assistant\assistant_installer.exe

    Filesize

    1.9MB

    MD5

    a8c564c798ae8160230297d361952dd6

    SHA1

    34a45ee9eb7733ae9afbebb9f2951288a27f9df5

    SHA256

    3f48e5331890159921f7b65103c4b06bbf08552065718313761647d1648f8a64

    SHA512

    141ac3356a2fee32121231308cdd8afa5f76695185d66bba9fa977b66e5c6bad8bd4ea4656acdc743cd6b6f85c28a16626ab07f8b2c72652de82b4fb21c0bb54

  • C:\Users\Admin\AppData\Local\Temp\7zS4A356D27\setup.exe

    Filesize

    5.2MB

    MD5

    6a39877aba485cd09c090e4e24f53de6

    SHA1

    ada29b30d665203b7e6cda8f1b6114699ba472a7

    SHA256

    2daba944e443aea09f4d50a0ac5ea2a6bb85b6f861c83c1bbd284e6d81e8a7e3

    SHA512

    ecab25931ed2d985b396e62d5930dd5c7edc3c0835e3e3df3058197bb8800491a8ea13fc824935bcf187a848a29da176c7dd7dc8f43aaca108e17fed76dfb32c

  • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

    Filesize

    40B

    MD5

    987ad31f25551b834ceee6de5d968241

    SHA1

    9dbdf3175f672bc60c99ad53df5d54b869df6e23

    SHA256

    1abac154817cd49c54527d050f7451572c86b070ef7b34b0570746a0eb534780

    SHA512

    f08cc962dc46ec3446e48caae26a38adb61cbd03003faf8fc74275b7be022408ccd0f51dc1ecc96516e2efd42fbc96175036257a55a409b8cce7947ca76bbbd6

  • \Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202406272255321\assistant\dbgcore.dll

    Filesize

    166KB

    MD5

    ff0364394f7bc74d0c68040a5fbcda6f

    SHA1

    d19ce25e7d0e3043c377c5770b0f20cb42bd0295

    SHA256

    3bd944ca30b77f9ce8a1f503a7ee0dbcb77b92ae9fcd68907abe0ef2e9275053

    SHA512

    0676de1a65cc9c209f544e921f45c5eb8c5d42fb391ae1f370b0a2bedd26740f75f32ea5f17497d86e03edd6cf281ca51a7a54380a82de152d0e25a28297ccfd

  • \Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202406272255321\assistant\dbghelp.dll

    Filesize

    1.7MB

    MD5

    eeb07dc97790e8b075d6938759fe6ee1

    SHA1

    afb099be8ee28fef6488b5d253ba910b081a3b1b

    SHA256

    2808772ce1653cdf659f4781c718a9dd6f3ac547d52a1080462487baccaeaf78

    SHA512

    e541d839562c5045b5af0cc7ad2129393383df3fc528193cdef1a31ded4e894ffb8a02d34a009b3d6543d4987616534caaefa130a2b55ea73baf37ee0a294980

  • \Users\Admin\AppData\Local\Temp\Opera_installer_2406272255316101244.dll

    Filesize

    4.7MB

    MD5

    b05a49fe0b700420401974a62cea7be6

    SHA1

    1dec7981c1d5eab1952c69c512dcc3877241c82e

    SHA256

    12f8a3f3569cecd209e1a6e229e7e6c3d130ab1694fdf71c10d5e3b5154ba703

    SHA512

    34fc1e8a9e046400107ea0e1be1aeb7d1d8a5e71380733bbce0ac5d15ee9b58762b63f7de4591762b6a7c32f5be83122bbf757d3a88a6f78e6d2c06ffd596833