Analysis

  • max time kernel
    128s
  • max time network
    135s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/08/2024, 00:02

General

  • Target

    da64fb9d4d12aea715a88cddadc48b412416ef331b06d455a7df8ce8585fac13.exe

  • Size

    3.1MB

  • MD5

    736153e45afc50f1fb2f3745f32aef30

  • SHA1

    84a370cc11ab8402d188b9943093e938ad1bd3c5

  • SHA256

    da64fb9d4d12aea715a88cddadc48b412416ef331b06d455a7df8ce8585fac13

  • SHA512

    8929f1b12105e811df6701a845fe42c9bb843bd99c8ffc6bf60b511213434ede244f96966a6a5480c4b6dad1c986bb50d0b336cc553de6d96907266f9ce6ee16

  • SSDEEP

    49152:9VAbwWYb12jHSVaHO3Vg3gfRv9yuqohghbpVOpmV4w1Z6nPI4gyJv:bAJY5oHhb0FqWgFQlw2w4gG

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\da64fb9d4d12aea715a88cddadc48b412416ef331b06d455a7df8ce8585fac13.exe
    "C:\Users\Admin\AppData\Local\Temp\da64fb9d4d12aea715a88cddadc48b412416ef331b06d455a7df8ce8585fac13.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3584
    • C:\Users\Admin\AppData\Local\Temp\7zS00E13218\setup.exe
      C:\Users\Admin\AppData\Local\Temp\7zS00E13218\setup.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4276
      • C:\Users\Admin\AppData\Local\Temp\7zS00E13218\setup.exe
        C:\Users\Admin\AppData\Local\Temp\7zS00E13218\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=112.0.5197.74 --initial-client-data=0x32c,0x330,0x334,0x304,0x338,0x74041b54,0x74041b60,0x74041b6c
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:1628
      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe" --version
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:1016
      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202408220002421\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202408220002421\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4948
      • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202408220002421\assistant\assistant_installer.exe
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202408220002421\assistant\assistant_installer.exe" --version
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1432
        • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202408220002421\assistant\assistant_installer.exe
          "C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202408220002421\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=73.0.3856.382 --initial-client-data=0x26c,0x270,0x274,0x248,0x278,0xfa4f48,0xfa4f58,0xfa4f64
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2360
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3708,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:8
    1⤵
      PID:3472

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202408220002421\additional_file0.tmp

      Filesize

      1.4MB

      MD5

      e9a2209b61f4be34f25069a6e54affea

      SHA1

      6368b0a81608c701b06b97aeff194ce88fd0e3c0

      SHA256

      e950f17f4181009eeafa9f5306e8a9dfd26d88ca63b1838f44ff0efc738e7d1f

      SHA512

      59e46277ca79a43ed8b0a25b24eff013e251a75f90587e013b9c12851e5dd7283b6172f7d48583982f6a32069457778ee440025c1c754bf7bb6ce8ae1d2c3fc5

    • C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202408220002421\assistant\assistant_installer.exe

      Filesize

      1.8MB

      MD5

      4c8fbed0044da34ad25f781c3d117a66

      SHA1

      8dd93340e3d09de993c3bc12db82680a8e69d653

      SHA256

      afe569ce9e4f71c23ba5f6e8fd32be62ac9538e397cde8f2ecbe46faa721242a

      SHA512

      a04e6fd052d2d63a0737c83702c66a9af834f9df8423666508c42b3e1d8384300239c9ddacdc31c1e85140eb1193bcfac209f218750b40342492ffce6e9da481

    • C:\Users\Admin\AppData\Local\Temp\7zS00E13218\setup.exe

      Filesize

      6.4MB

      MD5

      24ceb5521ec9daf20512eecdb1695958

      SHA1

      ffcb26e536dae0c7380c5cf784a7df1439815ae4

      SHA256

      9b400311b1b05422be39c6aa1410534edb32cf46da21348364cbcde7e8167ad8

      SHA512

      a0cc14b5e1c861c4eafb885beb65bcfa752c850c4c8225aeee728ee5cbf4a448a5e98d34dd985125acd261919a154000e8c7146485427be7ad7bb15dbe6b83f8

    • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2408220002412214276.dll

      Filesize

      5.9MB

      MD5

      7916599e12ee8885e6a27d0d4573439f

      SHA1

      6959f0546e76b32d95c167aab10774261657f319

      SHA256

      3d3e546fbcd332e4a3bdadb2933a705bbc39e7a0c2f1e012a5269742a612afe2

      SHA512

      67d01ca3938abe1aa2018c49d3c089baaa0022b4ce35bf4950877d0a7b5e4df09d165c9a29afc33d8869fafb772ebc64ad65422ebd9d6473c76699d3021f1d93

    • C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat

      Filesize

      40B

      MD5

      76c15c6b933a09a75e7f2a9e92d79d8a

      SHA1

      2d669219ed5728e1912ee647d4e60fdebf119ba9

      SHA256

      2776ee929f414ff4fd3adc2e2a68159c8cafefee868675964220274494d0143c

      SHA512

      29cac69393522a55b2911d5e860faa45f86e7295fdd195ac13e311920168fb5b01873091a277955f2e08b44c3595e25193020eb4ffb0eeb8a896eebf61cd667d