Analysis
-
max time kernel
211s -
max time network
289s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
27/06/2024, 22:54
Static task
static1
Behavioral task
behavioral1
Sample
641c1cf2c124706a971917861c38b2353e6010649c53c73720cee5149eb1f0cb.exe
Resource
win7-20240508-en
General
-
Target
641c1cf2c124706a971917861c38b2353e6010649c53c73720cee5149eb1f0cb.exe
-
Size
2.0MB
-
MD5
14832043698de68c5b732fcd4d59bdd2
-
SHA1
b345d26f3ad061346642296a8e1b20f233e5b73c
-
SHA256
641c1cf2c124706a971917861c38b2353e6010649c53c73720cee5149eb1f0cb
-
SHA512
e85c3f6a33974b52bea1880cfa3bb15714068740f5a9a4d2247ec67ebd60cd2ede187ee5db5ac68b3be41f18d26027b755ee2130241b177c0c64fcf15e7805de
-
SSDEEP
49152:ONEyY80FNFPy4tGmml/0947g+b9W7m6S/sbs0wQ22qPAoFmkB:kEhFvqXjbqoJQCX
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 6 IoCs
pid Process 1244 setup.exe 3864 setup.exe 4108 setup.exe 4296 Assistant_111.0.5168.25_Setup.exe_sfx.exe 4448 assistant_installer.exe 4892 assistant_installer.exe -
Loads dropped DLL 7 IoCs
pid Process 1244 setup.exe 3864 setup.exe 4108 setup.exe 4448 assistant_installer.exe 4448 assistant_installer.exe 4892 assistant_installer.exe 4892 assistant_installer.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: setup.exe File opened (read-only) \??\F: setup.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 setup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e75490f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e4190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e setup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c000000010000000400000000100000190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e199604000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e setup.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1244 setup.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 5028 wrote to memory of 1244 5028 641c1cf2c124706a971917861c38b2353e6010649c53c73720cee5149eb1f0cb.exe 74 PID 5028 wrote to memory of 1244 5028 641c1cf2c124706a971917861c38b2353e6010649c53c73720cee5149eb1f0cb.exe 74 PID 5028 wrote to memory of 1244 5028 641c1cf2c124706a971917861c38b2353e6010649c53c73720cee5149eb1f0cb.exe 74 PID 1244 wrote to memory of 3864 1244 setup.exe 75 PID 1244 wrote to memory of 3864 1244 setup.exe 75 PID 1244 wrote to memory of 3864 1244 setup.exe 75 PID 1244 wrote to memory of 4108 1244 setup.exe 76 PID 1244 wrote to memory of 4108 1244 setup.exe 76 PID 1244 wrote to memory of 4108 1244 setup.exe 76 PID 1244 wrote to memory of 4296 1244 setup.exe 77 PID 1244 wrote to memory of 4296 1244 setup.exe 77 PID 1244 wrote to memory of 4296 1244 setup.exe 77 PID 1244 wrote to memory of 4448 1244 setup.exe 78 PID 1244 wrote to memory of 4448 1244 setup.exe 78 PID 1244 wrote to memory of 4448 1244 setup.exe 78 PID 4448 wrote to memory of 4892 4448 assistant_installer.exe 79 PID 4448 wrote to memory of 4892 4448 assistant_installer.exe 79 PID 4448 wrote to memory of 4892 4448 assistant_installer.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\641c1cf2c124706a971917861c38b2353e6010649c53c73720cee5149eb1f0cb.exe"C:\Users\Admin\AppData\Local\Temp\641c1cf2c124706a971917861c38b2353e6010649c53c73720cee5149eb1f0cb.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\7zS4A356D27\setup.exeC:\Users\Admin\AppData\Local\Temp\7zS4A356D27\setup.exe --server-tracking-blob=YTJkYjlkMzg5YTc0NDYxNDk2OTVlMzJhNTNhZTMzM2ZjMjQzZDFkODFlMTdkNjE1MjBhMDVkNmFiZDA5ZmQzYzp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fbWVkaXVtPXBiJnV0bV9zb3VyY2U9Y2luc3QmdXRtX2NhbXBhaWduPU9wZXJhX0Rlc2t0b3AmdXRtX2NvbnRlbnQ9NWQ3NzZmZmE0ZDQ4OF8mdXRtX2lkPUdmVmZYOUx4SERBbUJKcXJ4OEVVQXciLCJ0aW1lc3RhbXAiOiIxNzE5MDMxMjA4LjE0MDMiLCJ1dG0iOnsiY2FtcGFpZ24iOiJPcGVyYV9EZXNrdG9wIiwiY29udGVudCI6IjVkNzc2ZmZhNGQ0ODhfIiwiaWQiOiJHZlZmWDlMeEhEQW1CSnFyeDhFVUF3IiwibWVkaXVtIjoicGIiLCJzb3VyY2UiOiJjaW5zdCJ9LCJ1dWlkIjoiZGIyNTNhNTgtMzZmNS00ZjI3LWIzYzQtYjVlNjllYWJmNzAzIn0=2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\7zS4A356D27\setup.exeC:\Users\Admin\AppData\Local\Temp\7zS4A356D27\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=111.0.5168.25 --initial-client-data=0x308,0x30c,0x310,0x304,0x314,0x72d5a128,0x72d5a134,0x72d5a1403⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3864
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\setup.exe" --version3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4108
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202406272255321\assistant\Assistant_111.0.5168.25_Setup.exe_sfx.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202406272255321\assistant\Assistant_111.0.5168.25_Setup.exe_sfx.exe"3⤵
- Executes dropped EXE
PID:4296
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202406272255321\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202406272255321\assistant\assistant_installer.exe" --version3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202406272255321\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202406272255321\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=111.0.5168.25 --initial-client-data=0x230,0x234,0x238,0x20c,0x23c,0x14e9f88,0x14e9f94,0x14e9fa04⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4892
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202406272255321\additional_file0.tmp
Filesize2.6MB
MD5dfe86cd1ab9fe5055dba3ead830574f6
SHA1800ba6757bf301a918a800ce15a3853e3941e019
SHA256f9cdff6fea65207cde93c637cca4b92939359ede3ac7337c2048e076085e7e5f
SHA512d3d363a221a3fa7a010194965cb8cc7210aa17d81be094a3e8ee89bb2de684c3b874ce1c6c55e8109091a849874d05c1bae132d450dabe2597167782d0063570
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202406272255321\assistant\assistant_installer.exe
Filesize1.9MB
MD5a8c564c798ae8160230297d361952dd6
SHA134a45ee9eb7733ae9afbebb9f2951288a27f9df5
SHA2563f48e5331890159921f7b65103c4b06bbf08552065718313761647d1648f8a64
SHA512141ac3356a2fee32121231308cdd8afa5f76695185d66bba9fa977b66e5c6bad8bd4ea4656acdc743cd6b6f85c28a16626ab07f8b2c72652de82b4fb21c0bb54
-
Filesize
5.2MB
MD56a39877aba485cd09c090e4e24f53de6
SHA1ada29b30d665203b7e6cda8f1b6114699ba472a7
SHA2562daba944e443aea09f4d50a0ac5ea2a6bb85b6f861c83c1bbd284e6d81e8a7e3
SHA512ecab25931ed2d985b396e62d5930dd5c7edc3c0835e3e3df3058197bb8800491a8ea13fc824935bcf187a848a29da176c7dd7dc8f43aaca108e17fed76dfb32c
-
Filesize
40B
MD5987ad31f25551b834ceee6de5d968241
SHA19dbdf3175f672bc60c99ad53df5d54b869df6e23
SHA2561abac154817cd49c54527d050f7451572c86b070ef7b34b0570746a0eb534780
SHA512f08cc962dc46ec3446e48caae26a38adb61cbd03003faf8fc74275b7be022408ccd0f51dc1ecc96516e2efd42fbc96175036257a55a409b8cce7947ca76bbbd6
-
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202406272255321\assistant\dbgcore.dll
Filesize166KB
MD5ff0364394f7bc74d0c68040a5fbcda6f
SHA1d19ce25e7d0e3043c377c5770b0f20cb42bd0295
SHA2563bd944ca30b77f9ce8a1f503a7ee0dbcb77b92ae9fcd68907abe0ef2e9275053
SHA5120676de1a65cc9c209f544e921f45c5eb8c5d42fb391ae1f370b0a2bedd26740f75f32ea5f17497d86e03edd6cf281ca51a7a54380a82de152d0e25a28297ccfd
-
\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202406272255321\assistant\dbghelp.dll
Filesize1.7MB
MD5eeb07dc97790e8b075d6938759fe6ee1
SHA1afb099be8ee28fef6488b5d253ba910b081a3b1b
SHA2562808772ce1653cdf659f4781c718a9dd6f3ac547d52a1080462487baccaeaf78
SHA512e541d839562c5045b5af0cc7ad2129393383df3fc528193cdef1a31ded4e894ffb8a02d34a009b3d6543d4987616534caaefa130a2b55ea73baf37ee0a294980
-
Filesize
4.7MB
MD5b05a49fe0b700420401974a62cea7be6
SHA11dec7981c1d5eab1952c69c512dcc3877241c82e
SHA25612f8a3f3569cecd209e1a6e229e7e6c3d130ab1694fdf71c10d5e3b5154ba703
SHA51234fc1e8a9e046400107ea0e1be1aeb7d1d8a5e71380733bbce0ac5d15ee9b58762b63f7de4591762b6a7c32f5be83122bbf757d3a88a6f78e6d2c06ffd596833