Analysis
- max time kernel
149s - max time network
148s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
18/04/2026, 13:36
General
- Target OperaGXSetup.exe
- Size 3.9MB
- Sample260418-qwckjaay91
- SHA256 c746305f0923cc5c45a6690edcf9c4e388baf0bf41455e26e763dd465c0ba560
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Enumerates system info in registry 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8CC8F938\installer.exeC:\Users\Admin\AppData\Local\Temp\7zS8CC8F938\installer.exe --server-tracking-blob=ODBmYjkzOTBjZGViNDMxZjA5Y2EyOTFlOWY5MmNkZGExOGQ1MDQzZDZkZjE1MTY2ZjdhYzE1ZDk5MDIxMTZmOTp7ImNvdW50cnkiOiJOTCIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYV9neCIsInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX05MX1NWUl85NDgxX0REXzM2NTcmdXRtX2lkPWJjYTNhMmYwYjI0ZDRkZjU4NWVjOTk3YjI2NzAyZTFmIiwidGltZXN0YW1wIjoiMTc3NjUwNTIzOS4yODc2IiwidXNlcmFnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzE0Ny4wLjAuMCBTYWZhcmkvNTM3LjM2IiwidXRtIjp7ImNhbXBhaWduIjoiUFdOX05MX1NWUl85NDgxX0REXzM2NTciLCJpZCI6ImJjYTNhMmYwYjI0ZDRkZjU4NWVjOTk3YjI2NzAyZTFmIiwibWVkaXVtIjoicGEiLCJzb3VyY2UiOiJQV05nYW1lcyJ9LCJ1dWlkIjoiODM5NDZkMmItMmY3MC00ZWM2LTllMzgtMmRiN2I1M2VjMjNjIn0=2⤵
- Executes dropped EXE
- Enumerates connected drives
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8CC8F938\installer.exeC:\Users\Admin\AppData\Local\Temp\7zS8CC8F938\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=130.0.5847.58 --initial-client-data=0x270,0x26c,0x298,0x274,0x29c,0x7ff7e5cee6d8,0x7ff7e5cee6e4,0x7ff7e5cee6f03⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\debbd03c-b167-4d03-8f0a-be9d69aef3bb Opera GX Installer Temp\installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\debbd03c-b167-4d03-8f0a-be9d69aef3bb Opera GX Installer Temp\installer.exe" --version3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
installer.exe
21dcee88-22d9-4a63-8371-2a08a882714a.dmp
settings.dat
memory/792-12-0x000001C532EC0000-0x000001C532F2F000-memory.dmp
memory/1340-45-0x0000028DAACB0000-0x0000028DAACB9000-memory.dmp
memory/1340-44-0x0000028DA93F0000-0x0000028DA945F000-memory.dmp
memory/1340-56-0x0000028DA93F0000-0x0000028DA945F000-memory.dmp
memory/1992-32-0x00000279C0F60000-0x00000279C0F69000-memory.dmp
memory/1992-33-0x00000279C2130000-0x00000279C213C000-memory.dmp
memory/1992-31-0x00000279BF660000-0x00000279BF6CF000-memory.dmp
memory/3272-43-0x0000000000D30000-0x0000000000DEB000-memory.dmp