Analysis

  • max time kernel
    145s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-08-2024 00:25

General

  • Target

    0ecb0b56ab2ad77f1b10bfab406f8189fd46db974c7dbd80a5f8838d45cbb02b.exe

  • Size

    5.1MB

  • MD5

    3bd306971f43cfec49b29a68247f3bba

  • SHA1

    b1fb5b7eb0f42fe2ec1dfb277a621c6a56de8bb9

  • SHA256

    0ecb0b56ab2ad77f1b10bfab406f8189fd46db974c7dbd80a5f8838d45cbb02b

  • SHA512

    6cff0d685aef99b56d76a89c6d77fa3cec0f0131ecebba6e950e2a774f7c6e5bebddb1c803d89880cc89f10ce67a631fe3a41c63fabf47c6a7713771b27134b5

  • SSDEEP

    98304:M0NFA6666666666666666666666666666666x666666666666666fwwwwwwwwwwV:UPMki6zio75L3pf3dedO4keCIwkoYbg1

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0ecb0b56ab2ad77f1b10bfab406f8189fd46db974c7dbd80a5f8838d45cbb02b.exe
    "C:\Users\Admin\AppData\Local\Temp\0ecb0b56ab2ad77f1b10bfab406f8189fd46db974c7dbd80a5f8838d45cbb02b.exe"
    1⤵
    • Loads dropped DLL
    • Enumerates connected drives
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4488
    • C:\Users\Admin\AppData\Local\Temp\0ecb0b56ab2ad77f1b10bfab406f8189fd46db974c7dbd80a5f8838d45cbb02b.exe
      C:\Users\Admin\AppData\Local\Temp\0ecb0b56ab2ad77f1b10bfab406f8189fd46db974c7dbd80a5f8838d45cbb02b.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.35 --initial-client-data=0x2a8,0x2ac,0x2b0,0x27c,0x2b4,0x74b4e1d0,0x74b4e1dc,0x74b4e1e8
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:2440
    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\0ecb0b56ab2ad77f1b10bfab406f8189fd46db974c7dbd80a5f8838d45cbb02b.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\0ecb0b56ab2ad77f1b10bfab406f8189fd46db974c7dbd80a5f8838d45cbb02b.exe" --version
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:4284
    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202408140025491\assistant\Assistant_112.0.5197.30_Setup.exe_sfx.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202408140025491\assistant\Assistant_112.0.5197.30_Setup.exe_sfx.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2464
    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202408140025491\assistant\assistant_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202408140025491\assistant\assistant_installer.exe" --version
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1156
      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202408140025491\assistant\assistant_installer.exe
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202408140025491\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=112.0.5197.30 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0xaf8f40,0xaf8f4c,0xaf8f58
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:3376
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3808,i,3387628439405076340,17957358341235678872,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:8
    1⤵
      PID:784

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\0ecb0b56ab2ad77f1b10bfab406f8189fd46db974c7dbd80a5f8838d45cbb02b.exe

      Filesize

      5.1MB

      MD5

      3bd306971f43cfec49b29a68247f3bba

      SHA1

      b1fb5b7eb0f42fe2ec1dfb277a621c6a56de8bb9

      SHA256

      0ecb0b56ab2ad77f1b10bfab406f8189fd46db974c7dbd80a5f8838d45cbb02b

      SHA512

      6cff0d685aef99b56d76a89c6d77fa3cec0f0131ecebba6e950e2a774f7c6e5bebddb1c803d89880cc89f10ce67a631fe3a41c63fabf47c6a7713771b27134b5

    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202408140025491\additional_file0.tmp

      Filesize

      2.6MB

      MD5

      1bf64fd766bd850bcf8e0ffa9093484b

      SHA1

      01524bb2c88b7066391da291ee474004a4904891

      SHA256

      58794b1bf4d84bd7566ee89fd8a8a4157dc70c598d229ec5101959f30b6f3491

      SHA512

      cdf2830edc5d4f30beae41591f3a1bcff820f75444d70338a4c6d36e10df43475f383a9f291b619a008452c53e0dddf65547f217386389000535d6d264854e7f

    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202408140025491\assistant\assistant_installer.exe

      Filesize

      1.9MB

      MD5

      9afe96db501220cf42b262fdac954dc8

      SHA1

      d3471998f674b267256e72a30977a79abcd8fca9

      SHA256

      fc5608bf95bb02e889aa9be15abc5c066acd62ba07f886b323383e75909a2566

      SHA512

      ecff52ca7467e3948faa244c1fc7c3d4d1f1dbe74077d071b78147729a078cc6a676212e0606111edcf542d554045c4f5a4d502545b2f0a285cda6c5d0b69b27

    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202408140025491\assistant\dbgcore.dll

      Filesize

      166KB

      MD5

      e0274730d20eb9571d59f2da20d165a2

      SHA1

      b746aeca5f7cbee0de163309c9d207c94f9b8d64

      SHA256

      c5c4c6430bcfe6118a4f499c94afa460401e369dc548a24688532c95fd202ec5

      SHA512

      d95998b69e6c3d25037e12e038f2773960de2d18df1af0342fd805c7c349bd630a21d0e0fe7490baaf274e90781ebf6a2667e64593f9d91174d040bfe640bddf

    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202408140025491\assistant\dbghelp.dll

      Filesize

      1.7MB

      MD5

      6e9976cc7b2def7a37106703e47626a5

      SHA1

      edcb4758f8ee56e9c6515f912d5024aeca9ead50

      SHA256

      fd8840fab4b61db4e9e09168e5b1b4f0e9bfea0a64482fd475ab63c712b92b9c

      SHA512

      27091e6ad001dac22897a295806925e02f693096d79667e587de74ca955ffb9b2773b22c83e306e7164862524e02ad028e68684c2ca7d9e4da1ff03787dd40ca

    • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2408140025476144488.dll

      Filesize

      4.6MB

      MD5

      117176ddeaf70e57d1747704942549e4

      SHA1

      75e3ab6b3469d93cce9ea2f7e22b71b987ccdf2b

      SHA256

      3c5b34de987116a4d3240e319c0da89a951c96b81e6705476a0fea27b22b20af

      SHA512

      ca2a356929c92d314aab63d7f3b246d72783212dfa3a4507f28d41a51ca0eedc78e85b1cd453aa8e02c12509f847a0216bb702154f903291c804c8a98ec378b9

    • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

      Filesize

      40B

      MD5

      682e193dbe82d4be3fd43b8a31fcaf29

      SHA1

      bac2ba0c9a03f3e52a82a8020d6e100c2a8f56cb

      SHA256

      b527f894839b3c9a4bb8b8e54ed65ec19ea2982439e5d50ab3271d9744992b97

      SHA512

      4897b3bfcb5613e46ae79077f019c39d4efe076a8fc45d9c58a539fab20df080347101eaa57925dfdaf38191ea24c4258a58b7290808b79344c79c30ea08a0c4