c746305f0923cc5c45a6690edcf9c4e388baf0bf41455e26e763dd465c0ba560

General

Target
OperaGXSetup.exe
Size 3.9MB
Sample260418-qwckjaay91
SHA256 c746305f0923cc5c45a6690edcf9c4e388baf0bf41455e26e763dd465c0ba560
MD5 a211b983049bd7d84f764a46fc19c170
SHA1 403964ce4834dde5661bc4f3a23263e22139f2f7
SHA512 8b7d587d3825e1c29c0b2eef040ae8f19315dd2ef3ad5470a6a3b90635cae501f6c307e705a51bbcae17266ea2f08577326faec6aafb9de63085110e3715b728
SSDEEP 98304:EAiuN0V0ZhWQ7LepW4ghq6ZrWecBcG4uK76:v0VeWQLrhX1Wxa6
TLSH
T1E71633217B80D033D2A315325FA9E76D97BEB6691E22425B67C80E0DDF32941BE35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2076	installer.exe
1876	installer.exe
892	installer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	installer.exe
File opened (read-only)	\??\F:	installer.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaGXSetup.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1876	installer.exe
1876	installer.exe
1876	installer.exe
1876	installer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2076	installer.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3484 wrote to memory of 2076	3484	OperaGXSetup.exe	86
PID 2076 wrote to memory of 1876	2076	installer.exe	87
PID 2076 wrote to memory of 892	2076	installer.exe	88

C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
"C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3484
- C:\Users\Admin\AppData\Local\Temp\7zSC9D35C58\installer.exe
  C:\Users\Admin\AppData\Local\Temp\7zSC9D35C58\installer.exe --server-tracking-blob=ODBmYjkzOTBjZGViNDMxZjA5Y2EyOTFlOWY5MmNkZGExOGQ1MDQzZDZkZjE1MTY2ZjdhYzE1ZDk5MDIxMTZmOTp7ImNvdW50cnkiOiJOTCIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYV9neCIsInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX05MX1NWUl85NDgxX0REXzM2NTcmdXRtX2lkPWJjYTNhMmYwYjI0ZDRkZjU4NWVjOTk3YjI2NzAyZTFmIiwidGltZXN0YW1wIjoiMTc3NjUwNTIzOS4yODc2IiwidXNlcmFnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzE0Ny4wLjAuMCBTYWZhcmkvNTM3LjM2IiwidXRtIjp7ImNhbXBhaWduIjoiUFdOX05MX1NWUl85NDgxX0REXzM2NTciLCJpZCI6ImJjYTNhMmYwYjI0ZDRkZjU4NWVjOTk3YjI2NzAyZTFmIiwibWVkaXVtIjoicGEiLCJzb3VyY2UiOiJQV05nYW1lcyJ9LCJ1dWlkIjoiODM5NDZkMmItMmY3MC00ZWM2LTllMzgtMmRiN2I1M2VjMjNjIn0=
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Enumerates system info in registry
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2076
- - C:\Users\Admin\AppData\Local\Temp\7zSC9D35C58\installer.exe
    C:\Users\Admin\AppData\Local\Temp\7zSC9D35C58\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=130.0.5847.58 --initial-client-data=0x26c,0x270,0x274,0x248,0x278,0x7ff6789be6d8,0x7ff6789be6e4,0x7ff6789be6f0
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1876
- - C:\Users\Admin\AppData\Local\Temp\.opera\0f258172-f42e-428d-aabe-32f893caea84 Opera GX Installer Temp\installer.exe
    "C:\Users\Admin\AppData\Local\Temp\.opera\0f258172-f42e-428d-aabe-32f893caea84 Opera GX Installer Temp\installer.exe" --version
    3⤵
    - Executes dropped EXE
    PID:892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

installer.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC9D35C58\installer.exe
Size 9.0MB
SHA256 ffe37c5e6519b2992735665c5001c9364824b2148baeb6ac8799ca7f208ae00e
MD5 00960bb6459d87c6c2074e9807cfa485
SHA1 7f40fed6ad488b758f5214b022976e301e8ee8f2
SHA512 c259e074a052a45a3281f6329a3787805d1c041986a0d7b1ca6ade0c22d1ba578479e74de01aa44b109d450eb67f838df0d561963b7958f579c25b1140a07695
SSDEEP 98304:uKH86eyCQLP5s7lqFxHVK92tZ49rF0XmHHxvFBI3++wteEmp:xH8F4tsGKPvH63+Bqp
TLSH
T181968D53F3E611E8D06ECA748B7A5222A9357C464B34A3DF0A943A251E75FD49F3CB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0dcc880c-e51e-488a-904c-41b4d764af73.dmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\reports\0dcc880c-e51e-488a-904c-41b4d764af73.dmp
Size 1.2MB
SHA256 601f4509fa0fb5421c67f47e9402e5df316eda5eb30c2ef207947f9163b86a20
MD5 7c56e037dd6b9428bb22772ea914ffb3
SHA1 ddedc61b76589576a41c51edbdf0287a9644e3b6
SHA512 e33d88e415678c086e24fdbcb7e1463344ce2cc20078e76a99f32299cf665689d94b72b87d55cd610ba61ea19cdc396ebeb7b20dc464065578cfd6a59ca7d40e
SSDEEP 12288:UqQnRhjZtSn4hgFsp3nU9xe/6g5V+h9MR777Vp68Uuq5mpdjyAg7:UpnRlSn4ie/6S/7Vp64q5mpdjyAg7
TLSH
T1E6450917A79519DBD13682318B9A5310B7F1FC24275247CB12A0F23AAE76FC06A35B1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat
Size 40B
SHA256 9bb55b651a177e155e91723b56c710895ccb48fb5858f63caab9602bc3349e7d
MD5 10355e2a27fa07509809cf78a547a602
SHA1 ea2d90e836c863f6583c8285604e528015fb8e73
SHA512 9f69c925d7b8007c0667f5496fae390565988c0452e4619363cf8fc0252de2a0b3483c01eed60cee76b48d516c045bc3a5fccae1821ca3a6758633ba1f30f465
MD5 SHA1 SHA512

Submit Download

memory/1876-30-0x0000018435160000-0x0000018435168000-memory.dmp

Download

memory/2076-22-0x000001DEF6D20000-0x000001DEF6D28000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads