71f17a2ba63f0bbd94719184707e1bc9c45f57ca98d9da67fc7998fa292be90e

General

Target
OperaSetup.exe
Size 3.1MB
Sample260522-pgx29ads71
SHA256 71f17a2ba63f0bbd94719184707e1bc9c45f57ca98d9da67fc7998fa292be90e
MD5 bc5ef64aee493a3cee0f11492bb8b958
SHA1 68cac17e006233580ed470f7d560a2e6f4f40a00
SHA512 8834172ebec7be827c921a7ed5bccd3350f1c7cc5cc12e17cf83539bd9c6c22055f0eb357d987b1f915c2f78683d9a46fd855695848050ebbb88c41aa9ac38cf
SSDEEP 49152:qVAbwfgwwETZin2reA5ZBj8XsJM5MTXaycsNuQFgwsY+rR4R4zmt4eD+V:+ALE1ZvnBj8XWMuTX3zNuUsYtqY4ek
TLSH
T1F8E523527784C876C62311320F16F799A3BEB9710E36DA5733482E6E9FB01819E21F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
3344	installer.exe
1108	installer.exe
5056	installer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	installer.exe
File opened (read-only)	\??\F:	installer.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaSetup.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1108	installer.exe
1108	installer.exe
1108	installer.exe
1108	installer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3344	installer.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4492 wrote to memory of 3344	4492	OperaSetup.exe	79
PID 3344 wrote to memory of 1108	3344	installer.exe	80
PID 3344 wrote to memory of 5056	3344	installer.exe	81

C:\Users\Admin\AppData\Local\Temp\OperaSetup.exe
"C:\Users\Admin\AppData\Local\Temp\OperaSetup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Users\Admin\AppData\Local\Temp\7zSC811DCA7\installer.exe
  C:\Users\Admin\AppData\Local\Temp\7zSC811DCA7\installer.exe --server-tracking-blob=ZmVjMzY0NWRjNjU5NThmZmYyMjMwNGRmOTMwZGNmMDc0Y2M4NTM5MTJjODBmMWQyYmQ4Y2EzZDU1MDBlYjYzMjp7ImNvdW50cnkiOiJERSIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPWVtZXJlcm8mdXRtX21lZGl1bT1wYiZ1dG1fY2FtcGFpZ249YnVuZGxlJnV0bV9jb250ZW50PTEyMzQ5MTkiLCJ0aW1lc3RhbXAiOiIxNzc5NDUyMzE4LjU3OTYiLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTMxLjAuMC4wIFNhZmFyaS81MzcuMzYgRWRnLzEzMS4wLjAuMCIsInV0bSI6eyJjYW1wYWlnbiI6ImJ1bmRsZSIsImNvbnRlbnQiOiIxMjM0OTE5IiwibWVkaXVtIjoicGIiLCJzb3VyY2UiOiJlbWVyZXJvIn0sInV1aWQiOiI5N2I3OTljYi1iY2ZhLTQ4YWUtYmZlNy03YjA3ZTMzODAxMWUifQ==
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Enumerates system info in registry
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3344
- - C:\Users\Admin\AppData\Local\Temp\7zSC811DCA7\installer.exe
    C:\Users\Admin\AppData\Local\Temp\7zSC811DCA7\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=131.0.5877.97 --initial-client-data=0x298,0x29c,0x2a0,0x278,0x2a4,0x7ff7207f2e98,0x7ff7207f2ea4,0x7ff7207f2eb0
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1108
- - C:\Users\Admin\AppData\Local\Temp\.opera\48a45869-036d-4010-9b04-61e576c696ee Opera Installer Temp\installer.exe
    "C:\Users\Admin\AppData\Local\Temp\.opera\48a45869-036d-4010-9b04-61e576c696ee Opera Installer Temp\installer.exe" --version
    3⤵
    - Executes dropped EXE
    PID:5056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

installer.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC811DCA7\installer.exe
Size 8.2MB
SHA256 a11cc12047afb9fe77e3ba3890a217625e443f7eab893c58b572880cce443da9
MD5 b8ae02778d1cad4989635d9374b2b378
SHA1 79a38b28a2f21c96586ab13fd6477cc52ad5bdbf
SHA512 e225d383637534f6a431e2ae79c803df2b089e7cc363c16000cddd9eab2ba9158e2c5451e83adf4726c4f3019f1b452e3a915b65be0542322449ee2ac1d49f01
SSDEEP 98304:tBbNLLOsoU6rTVixfYxnGnajTpdrT6W9H9YNY8AFR:XNLCDHKYv3H9XFR
TLSH
T1B8967C43F3A601E8D06FCA748B7A5622A9757C564B30A3DF0AA436251E75FD46F3CB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

636c0408-d0fb-4043-b54e-cff5807c8159.dmp

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\reports\636c0408-d0fb-4043-b54e-cff5807c8159.dmp
Size 1.4MB
SHA256 827f2cc5dac0c457196fd5408569d149ce9ace19be97a78ee534b6a3513fc6f0
MD5 a177e6cf3401005fb4e369300f2aaf73
SHA1 3d42f32f173eb865d5de8d86dd0ac8efdb53a764
SHA512 7c385a56073642d9559fb74dc9dad29fbcd3e6bac8ded59d5a8b1405fa376f5ff5f79592d68701a4f9f223c79b1dacf64fedace96317be9aaad904f5ed58abb4
SSDEEP 12288:6hs0206oa/MoxbBkPLJ5TH9W74/ce9tdtxC2mGBUUn+20AQJyigDAVv32D:KLjHXdtYvmr+20A+yiguO
TLSH
T1D565F51AA7D84959F4F5C2308DDB93327BF2FC110B22D3CB1A54862A3E773D86A35A51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
Size 40B
SHA256 719a31ba19d842b5fba38b656eab5eb1c98c5795428018961d422cd1a0ecc4d2
MD5 cb3bf9192b8e9b2b6f7ffcca21dba802
SHA1 5f23d56f5fd24ad0fcaf033e3ec684673438775e
SHA512 acdd6fb464ad9ccf8a78c473b13ddf39049a180123854b6890a277fd2db2ade1556c497b6d73099057c775881e8f93dca6de751fb7e27143f2cd71ce269ddb19
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads