Analysis
- max time kernel
146s - max time network
153s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
31/05/2026, 12:13
General
- Target google-earth-pro_bymIw-1.exe
- Size 5.6MB
- Sample260531-pd66raav9m
- SHA256 c80bff747b830d898d8e7974f0268ad4186086f9565652f736f55d07dd9c9cb2
Malware Config
Signatures
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Executes dropped EXE 8 IoCs
- Loads dropped DLL 10 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- NSIS installer 2 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\google-earth-pro_bymIw-1.exe"C:\Users\Admin\AppData\Local\Temp\google-earth-pro_bymIw-1.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-GHDU9.tmp\google-earth-pro_bymIw-1.tmp"C:\Users\Admin\AppData\Local\Temp\is-GHDU9.tmp\google-earth-pro_bymIw-1.tmp" /SL5="$50274,4813283,845824,C:\Users\Admin\AppData\Local\Temp\google-earth-pro_bymIw-1.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-3DNIK.tmp\prod0_extract\WZSetup.exe"C:\Users\Admin\AppData\Local\Temp\is-3DNIK.tmp\prod0_extract\WZSetup.exe" /S /tpchannelid=1571 /distid=App1233⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\is-3DNIK.tmp\prod1_extract\OperaSetup.exe"C:\Users\Admin\AppData\Local\Temp\is-3DNIK.tmp\prod1_extract\OperaSetup.exe" --silent --allusers=0 --otd=utm.medium:apb,utm.source:ais,utm.campaign:a,utm.id:agiSfNdCXregKr5K88ETNnF57Moy2EJJWKWycjUT4jZrtFNA4ep4YeAYf6xw6Jacq6cPNOjaluTKuWmOGc3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC2B2C639\installer.exeC:\Users\Admin\AppData\Local\Temp\7zSC2B2C639\installer.exe --silent --allusers=0 --otd=utm.medium:apb,utm.source:ais,utm.campaign:a,utm.id:agiSfNdCXregKr5K88ETNnF57Moy2EJJWKWycjUT4jZrtFNA4ep4YeAYf6xw6Jacq6cPNOjaluTKuWmOGc --server-tracking-blob=ZWY0ZmY3Y2E2NmI0MDk0YzBhMzg4MjRkNmE2MzI0ZGM4NzE1MzJmZDg3YWViNWNhYjk1ZDJmYWU2MmY1Y2EwYTp7ImNvdW50cnkiOiJVUyIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cyIsInRpbWVzdGFtcCI6IjE3ODAyMjUyNDUuMzI2OCIsInVzZXJhZ2VudCI6InB5dGhvbi1yZXF1ZXN0cy8yLjMyLjMiLCJ1dG0iOnt9LCJ1dWlkIjoiN2Q4NGNhYTgtYjUzNy00M2Y0LTg5NWUtMmU0YjRiNzQzNWZjIn0=4⤵
- Enumerates connected drives
- Executes dropped EXE
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC2B2C639\installer.exeC:\Users\Admin\AppData\Local\Temp\7zSC2B2C639\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=132.0.5905.11 --initial-client-data=0x288,0x28c,0x290,0x264,0x294,0x7ff754cb1e08,0x7ff754cb1e14,0x7ff754cb1e205⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\ea63640c-972f-453e-9c7a-68d663bb544c Opera Installer Temp\installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\ea63640c-972f-453e-9c7a-68d663bb544c Opera Installer Temp\installer.exe" --version5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\7zSC2B2C639\installer.exe"C:\Users\Admin\AppData\Local\Temp\7zSC2B2C639\installer.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=0 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=1580 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\ea63640c-972f-453e-9c7a-68d663bb544c Opera Installer Temp\opera_package_20260531131511" --session-guid=7ee0e920-0dca-4f44-803d-e23bc8990c7c --server-tracking-blob=MTQwYWQwYzIzNTRjOGU3NWIwOWM3N2I4YjM0MzQyNzdlOTJkOGVmZWYwNzdiZjcyMTg1OGEzODI0ZTYzOTZiNDp7ImNvdW50cnkiOiJVUyIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cyIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjExIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTc4MDIyNTI0NS4zMjY4IiwidXNlcmFnZW50IjoicHl0aG9uLXJlcXVlc3RzLzIuMzIuMyIsInV0bSI6eyJjYW1wYWlnbiI6ImEiLCJpZCI6ImFnaVNmTmRDWHJlZ0tyNUs4OEVUTm5GNTdNb3kyRUpKV0tXeWNqVVQ0alpydEZOQTRlcDRZZUFZZjZ4dzZKYWNxNmNQTk9qYWx1VEt1V21PR2MiLCJtZWRpdW0iOiJhcGIiLCJzb3VyY2UiOiJhaXMifSwidXVpZCI6IjdkODRjYWE4LWI1MzctNDNmNC04OTVlLTJlNGI0Yjc0MzVmYyJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=74080000000000005⤵
- Enumerates connected drives
- Executes dropped EXE
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC2B2C639\installer.exeC:\Users\Admin\AppData\Local\Temp\7zSC2B2C639\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=132.0.5905.11 --initial-client-data=0x294,0x298,0x29c,0x264,0x2a0,0x7ff754cb1e08,0x7ff754cb1e14,0x7ff754cb1e206⤵
- Executes dropped EXE
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
B46811C17859FFB409CF0E904A4AA8F8
B46811C17859FFB409CF0E904A4AA8F8
installer.exe
Helper.dll
Opera_new.png
WeatherZero.png
loader.gif
mainlogo.png
prod0.zip
WZSetup.exe
prod1.zip
OperaSetup.exe
google-earth-pro_bymIw-1.tmp
INetC.dll
WeatherZeroNSISPlugin.dll
settings.dat
memory/3332-35-0x00000000055C0000-0x0000000005700000-memory.dmp
memory/3332-159-0x00000000005D0000-0x0000000000913000-memory.dmp
memory/3332-49-0x00000000055C0000-0x0000000005700000-memory.dmp
memory/3332-51-0x00000000055C0000-0x0000000005700000-memory.dmp
memory/3332-53-0x00000000005D0000-0x0000000000913000-memory.dmp
memory/3332-54-0x00000000055C0000-0x0000000005700000-memory.dmp
memory/3332-60-0x00000000005D0000-0x0000000000913000-memory.dmp
memory/3332-44-0x00000000005D0000-0x0000000000913000-memory.dmp
memory/3332-45-0x00000000055C0000-0x0000000005700000-memory.dmp
memory/3332-42-0x00000000055C0000-0x0000000005700000-memory.dmp
memory/3332-41-0x00000000055C0000-0x0000000005700000-memory.dmp
memory/3332-213-0x00000000005D0000-0x0000000000913000-memory.dmp
memory/3332-133-0x00000000055C0000-0x0000000005700000-memory.dmp
memory/3332-34-0x00000000055C0000-0x0000000005700000-memory.dmp
memory/3332-19-0x00000000005D0000-0x0000000000913000-memory.dmp
memory/3332-20-0x0000000002BA0000-0x0000000002BA1000-memory.dmp
memory/3332-50-0x00000000055C0000-0x0000000005700000-memory.dmp
memory/3332-168-0x00000000005D0000-0x0000000000913000-memory.dmp
memory/3332-170-0x00000000005D0000-0x0000000000913000-memory.dmp
memory/3332-178-0x00000000005D0000-0x0000000000913000-memory.dmp
memory/3332-5-0x0000000002BA0000-0x0000000002BA1000-memory.dmp
memory/4444-18-0x0000000000CE0000-0x0000000000DBC000-memory.dmp
memory/4444-1-0x0000000000CE0000-0x0000000000DBC000-memory.dmp