Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/06/2024, 20:14

General

  • Target

    OperaGXSetup (9).exe

  • Size

    6.3MB

  • MD5

    c538344c3a1e29f939e889c777b37cd5

  • SHA1

    274ea9ef447dd0f2ade511659ddff47f457e5428

  • SHA256

    77069d61a595a7c8ec528e31e3a61c14e14f9b17d149cea34fdd5aa478ab98f5

  • SHA512

    e5d4a91a80545cc9fca04fed5a35816733e7d5d45dc5acda4ede3cef16a51a0b35ea329407d28a92c8247de5c1245c539e9cbbb8865d0f6c7d6b87e2d27b5cd4

  • SSDEEP

    196608:oLlrQr62xLShe3g8juVZD8Niqywq3ptwj0GUP4t7nMXXHblceHl3MJ/qd/bcqanj:oLlrQr62xLShSg8juVZD8Niqywq3ptw5

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\OperaGXSetup (9).exe
    "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup (9).exe"
    1⤵
    • Loads dropped DLL
    • Enumerates connected drives
    • Modifies system certificate store
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1876
    • C:\Users\Admin\AppData\Local\Temp\OperaGXSetup (9).exe
      "C:\Users\Admin\AppData\Local\Temp\OperaGXSetup (9).exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=109.0.5097.142 --initial-client-data=0x2a4,0x2a8,0x2ac,0x2a0,0x2b0,0x751052b8,0x751052c4,0x751052d0
      2⤵
      • Loads dropped DLL
      PID:1584
    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\OperaGXSetup (9).exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\OperaGXSetup (9).exe" --version
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:3372
    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202406282014581\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202406282014581\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe"
      2⤵
      • Executes dropped EXE
      PID:2628
    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202406282014581\assistant\assistant_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202406282014581\assistant\assistant_installer.exe" --version
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4224
      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202406282014581\assistant\assistant_installer.exe
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202406282014581\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=73.0.3856.382 --initial-client-data=0x26c,0x270,0x274,0x248,0x278,0x1014f48,0x1014f58,0x1014f64
        3⤵
        • Executes dropped EXE
        PID:4872

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\OperaGXSetup (9).exe

    Filesize

    6.3MB

    MD5

    c538344c3a1e29f939e889c777b37cd5

    SHA1

    274ea9ef447dd0f2ade511659ddff47f457e5428

    SHA256

    77069d61a595a7c8ec528e31e3a61c14e14f9b17d149cea34fdd5aa478ab98f5

    SHA512

    e5d4a91a80545cc9fca04fed5a35816733e7d5d45dc5acda4ede3cef16a51a0b35ea329407d28a92c8247de5c1245c539e9cbbb8865d0f6c7d6b87e2d27b5cd4

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202406282014581\additional_file0.tmp

    Filesize

    1.4MB

    MD5

    e9a2209b61f4be34f25069a6e54affea

    SHA1

    6368b0a81608c701b06b97aeff194ce88fd0e3c0

    SHA256

    e950f17f4181009eeafa9f5306e8a9dfd26d88ca63b1838f44ff0efc738e7d1f

    SHA512

    59e46277ca79a43ed8b0a25b24eff013e251a75f90587e013b9c12851e5dd7283b6172f7d48583982f6a32069457778ee440025c1c754bf7bb6ce8ae1d2c3fc5

  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202406282014581\assistant\assistant_installer.exe

    Filesize

    1.8MB

    MD5

    4c8fbed0044da34ad25f781c3d117a66

    SHA1

    8dd93340e3d09de993c3bc12db82680a8e69d653

    SHA256

    afe569ce9e4f71c23ba5f6e8fd32be62ac9538e397cde8f2ecbe46faa721242a

    SHA512

    a04e6fd052d2d63a0737c83702c66a9af834f9df8423666508c42b3e1d8384300239c9ddacdc31c1e85140eb1193bcfac209f218750b40342492ffce6e9da481

  • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2406282014583381876.dll

    Filesize

    5.8MB

    MD5

    1a4fdbb85e2b99ec1f3ca6e4716ddf62

    SHA1

    fb4698270b8664980407b932d76a99907ce1033a

    SHA256

    e9ead6307f9461d7cadf9a37cae959082e08d9d8d98374e4f7ea15ddd5d53b2a

    SHA512

    a7da63f9d7f95c0984f120f12df31a7051624fc0825a658cc54676b2835ecffc8f549e37d777158925901b520642d0adf1c3e3046302e24a70514266acf04cc2

  • C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat

    Filesize

    40B

    MD5

    4d01cdcbc6f71e0ea4267ffe15587988

    SHA1

    c3a85dd1eb5dafd2e8a11998e2ab87d7a1df8707

    SHA256

    636b879899d2523c2fe50c24c7dff4cc24c43a566308d3be908918f5a2be912d

    SHA512

    b6b03bd11483682524618759ab364b227ec2dfa2f6673cb09a362908668ac8e7488cd94b34e95e4675c453b0477bb4e47350b245a90a71271176c06c7c7c42c5