59aeb4f45c50d7e3cba04f3a6516bf0984ed33268ab22f1a1ff991a08663e104

General

Target
OperaGXSetup.exe
Size 3.9MB
Sample260620-mr9gxset9n
SHA256 59aeb4f45c50d7e3cba04f3a6516bf0984ed33268ab22f1a1ff991a08663e104
MD5 b9803324d0a2471e96cba914e5cacdf5
SHA1 be7ae21c192576749d907efad51b2d6529e74bd6
SHA512 2537ffde9f5af5371032360948706fc5f50d2b26ae43059ae1b7109a0d44811824946bb055a4f12338453cdfc76594e4a83d6c4f7074aec18f8d15af2bb26d18
SSDEEP 98304:PA8i9vOkHk3o5PrxnO1/r3k9Q/36sYs1cuV6npFlEY:IGkH3VFm3oQP6sY9l5l
TLSH
T1B61623623BC584B6E23310321FA8FB6847BDB6518F27494B77D81A5DCF702819A32F56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
3160	installer.exe
3296	installer.exe
2088	installer.exe
1324	Opera_GX_assistant_132.0.5905.28_Setup.exe_sfx.exe
2644	assistant_installer.exe
2744	assistant_installer.exe

Loads dropped DLL 4 IoCs

pid	Process
2644	assistant_installer.exe
2644	assistant_installer.exe
2744	assistant_installer.exe
2744	assistant_installer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	installer.exe
File opened (read-only)	\??\F:	installer.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaGXSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opera_GX_assistant_132.0.5905.28_Setup.exe_sfx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	assistant_installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	assistant_installer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3160	installer.exe
3160	installer.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4184 wrote to memory of 3160	4184	OperaGXSetup.exe	88
PID 3160 wrote to memory of 3296	3160	installer.exe	89
PID 3160 wrote to memory of 2088	3160	installer.exe	90
PID 3160 wrote to memory of 1324	3160	installer.exe	91
PID 3160 wrote to memory of 2644	3160	installer.exe	92
PID 2644 wrote to memory of 2744	2644	assistant_installer.exe	93

C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
"C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Users\Admin\AppData\Local\Temp\7zS85094A49\installer.exe
  C:\Users\Admin\AppData\Local\Temp\7zS85094A49\installer.exe --server-tracking-blob=ZDEyOWI5NzllYzQ3MGU0NjJjYTYyMDk2Mjc1NzhkYTFiZmUzODMzOTZkMWZkNTA5NGYzNjNjZjZjYWJlOTEzMjp7ImNvdW50cnkiOiJSTyIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImh0dHBfcmVmZXJyZXIiOiJodHRwczovL3d3dy5vcGVyYS5jb20vIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYUdYU2V0dXAuZXhlIiwicHJvZHVjdCI6Im9wZXJhX2d4IiwicXVlcnkiOiIvb3BlcmFfZ3gvc3RhYmxlL3dpbmRvd3M/ZWRpdGlvbj1zdGQtMiZ1dG1fc291cmNlPVBXTmdhbWVzJnV0bV9tZWRpdW09cGEmdXRtX2NhbXBhaWduPVBXTl9ST19IVlJfOTU3MV9XRUJfMTAwMyZlZGl0aW9uPXN0ZC0yJnV0bV9pZD04NmZhZThjZTYyMjY0NmY3YmRjYjg1NDExNWRkYzAxNiZodHRwX3JlZmVycmVyPWh0dHBzJTNBJTJGJTJGd3d3Lm9wZXJhLmNvbSUyRmd4JTNGdXRtX21lZGl1bSUzRHBhJTI2dXRtX2NhbXBhaWduJTNEUFdOX1JPX0hWUl85NTcxX1dFQl8xMDAzJTI2dXRtX2lkJTNEODZmYWU4Y2U2MjI2NDZmN2JkY2I4NTQxMTVkZGMwMTYlMjZ1dG1fc291cmNlJTNEUFdOZ2FtZXMlMjZlZGl0aW9uJTNEc3RkLTImdXRtX3NpdGU9b3BlcmFfY29tJnV0bV9sYXN0cGFnZT1vcGVyYS5jb20lMkZneCZ1dG1faWQ9ODZmYWU4Y2U2MjI2NDZmN2JkY2I4NTQxMTVkZGMwMTYmZGxfdG9rZW49MTE2MDYwMDAiLCJ0aW1lc3RhbXAiOiIxNzgxNjM5Mzg5Ljk1MzciLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTQ5LjAuMC4wIFNhZmFyaS81MzcuMzYgRWRnLzE0OS4wLjAuMCIsInV0bSI6eyJjYW1wYWlnbiI6IlBXTl9ST19IVlJfOTU3MV9XRUJfMTAwMyIsImlkIjoiODZmYWU4Y2U2MjI2NDZmN2JkY2I4NTQxMTVkZGMwMTYiLCJsYXN0cGFnZSI6Im9wZXJhLmNvbS9neCIsIm1lZGl1bSI6InBhIiwic2l0ZSI6Im9wZXJhX2NvbSIsInNvdXJjZSI6IlBXTmdhbWVzIn0sInV1aWQiOiIxZTEwMmRhOC03ZTFlLTRlYjgtOGI2NC04MDdmZTkwZDdiN2MifQ==
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Enumerates system info in registry
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3160
- - C:\Users\Admin\AppData\Local\Temp\7zS85094A49\installer.exe
    C:\Users\Admin\AppData\Local\Temp\7zS85094A49\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=132.0.5905.43 --initial-client-data=0x2a0,0x2a4,0x2a8,0x27c,0x2ac,0x7ff7eaa97e08,0x7ff7eaa97e14,0x7ff7eaa97e20
    3⤵
    - Executes dropped EXE
    PID:3296
- - C:\Users\Admin\AppData\Local\Temp\.opera\df454523-35e8-4708-9783-c6fb98349023 Opera GX Installer Temp\installer.exe
    "C:\Users\Admin\AppData\Local\Temp\.opera\df454523-35e8-4708-9783-c6fb98349023 Opera GX Installer Temp\installer.exe" --version
    3⤵
    - Executes dropped EXE
    PID:2088
- - C:\Users\Admin\AppData\Local\Temp\.opera\df454523-35e8-4708-9783-c6fb98349023 Opera GX Installer Temp\opera_package_202606200643381\assistant\Opera_GX_assistant_132.0.5905.28_Setup.exe_sfx.exe
    "C:\Users\Admin\AppData\Local\Temp\.opera\df454523-35e8-4708-9783-c6fb98349023 Opera GX Installer Temp\opera_package_202606200643381\assistant\Opera_GX_assistant_132.0.5905.28_Setup.exe_sfx.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1324
- - C:\Users\Admin\AppData\Local\Temp\.opera\df454523-35e8-4708-9783-c6fb98349023 Opera GX Installer Temp\opera_package_202606200643381\assistant\assistant_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\.opera\df454523-35e8-4708-9783-c6fb98349023 Opera GX Installer Temp\opera_package_202606200643381\assistant\assistant_installer.exe" --version
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:2644
  - - C:\Users\Admin\AppData\Local\Temp\.opera\df454523-35e8-4708-9783-c6fb98349023 Opera GX Installer Temp\opera_package_202606200643381\assistant\assistant_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\df454523-35e8-4708-9783-c6fb98349023 Opera GX Installer Temp\opera_package_202606200643381\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=132.0.5905.28 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x494b80,0x494b8c,0x494b98
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:2744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2240

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

additional_file0.tmp

Path C:\Users\Admin\AppData\Local\Temp\.opera\df454523-35e8-4708-9783-c6fb98349023 Opera GX Installer Temp\opera_package_202606200643381\additional_file0.tmp
Size 2.8MB
SHA256 0f50bda78a34e09ccfd5e33a7958de9eebe9863cc3d875e8b9c52dec3f3a9992
MD5 1bed04ab23ee645cad438456a6d465fa
SHA1 68b7d9eb6ff0bd159281a2fd55a7a24860ba765c
SHA512 9ca295d1c574e88eb8506ba3bb4096ff3860e605b7870fe11a2eff27c85a551894345b7524485fb4fd5ed5e9cfbefb917f735ed51085cfd3adbabd9a28909f23
SSDEEP 49152:MkinoAcJ53ld/JCHyHuw+yIfBfnDWUKT5qDztnvkbPsGaW6EYFZoMzu3ug:MkioJJ57RCH2uryIfi0mz+W6Eory3ug
TLSH
T1E0D533317D918476D22392330DD5FBEC66BFF5B22F229A9B3388072EAF201A24715557
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

assistant_installer.exe

Path C:\Users\Admin\AppData\Local\Temp\.opera\df454523-35e8-4708-9783-c6fb98349023 Opera GX Installer Temp\opera_package_202606200643381\assistant\assistant_installer.exe
Size 2.5MB
SHA256 e86907d20a18c6b99e270a4422e0c279079e8a118b6bd7fbb4001161ddc881f4
MD5 31f5e82954b11ee1cbaf09294f7d5d6d
SHA1 580d39bfee5fad23b31ea4869561b4f9d15f322e
SHA512 e3ec7a6c238faaa1561b12b67217edac16e5c63ff68483daf4e7d7bf6b1bdcc16e2dda5b11a7b69434dcfd864cab6e427854d8d70a2cd7cbf744ca8b15a6fe9f
SSDEEP 49152:6P/Ojp1psS7+BMvcOZ+XMxNBfAlVH5p6h7yMo:6nOjp1psS7+BMvpiMnBfAPH5p6hGp
TLSH
T1CBC59D02B89194B5DC963032361CF77E9A345E114B364DC79B90BCD16FB9AE2223739B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

browser_assistant.exe

Path C:\Users\Admin\AppData\Local\Temp\.opera\df454523-35e8-4708-9783-c6fb98349023 Opera GX Installer Temp\opera_package_202606200643381\assistant\browser_assistant.exe
Size 5.2MB
SHA256 4a5fd953fd0e1c3085ae68fa3984083b6273b2fecad4cbd5149f9b20a720e7e5
MD5 5680d512b11f574b5524f10c3d45ce87
SHA1 0e7cd5320efefa1df9732096e472f1b956d75708
SHA512 66ac6b71c34139109dff57757fda405610a3ae78263cab833ecb3a1275bfeacf57de0ea59a047d4d6b93401652fe94ab9715638dc53ddc6acd8a4181280fdd59
SSDEEP 98304:u6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwm:oBjuUOK93csaOxLVlod8Il796HKXPZ
TLSH
T10A46BE52FB217074C80A7971643C6B7B9C281D2B972186DF8AD87CE25B784C2363DB5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbgcore.DLL

Path C:\Users\Admin\AppData\Local\Temp\.opera\df454523-35e8-4708-9783-c6fb98349023 Opera GX Installer Temp\opera_package_202606200643381\assistant\dbgcore.DLL
Size 196KB
SHA256 a2777992696c953c001dabade3f236f731987b58061efd8c894815f9939f979c
MD5 874334b4e7891772e6543f666e6d2411
SHA1 d9f0ca0263a50f254c6516aa9c8fbc671d978025
SHA512 c5b205cd580c75df43e69215028874bd233cede85c1829e4bbc67a2160c786a59124ef49681351aee383c27ce764fb7e47fc22e8b454b0eed8f0bb4020edca1f
SSDEEP 6144:pASh0NdOkBakZykbp/eyhr+SJors+k0L3nTd:8YIqFLnT
TLSH
T169148C6296840833DD9F11B8B29F333795FEEFB0139194C362549AE4E5647C06E3A2DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbghelp.dll

Path C:\Users\Admin\AppData\Local\Temp\.opera\df454523-35e8-4708-9783-c6fb98349023 Opera GX Installer Temp\opera_package_202606200643381\assistant\dbghelp.dll
Size 1.8MB
SHA256 102419e70ed462dd1ef4a30d94b714c4317ea838d7acc85ae030dfca19f609ab
MD5 7660d7d4afc11706c9b4f03aaef74a9e
SHA1 38136ffc06c49fde4dc4210e9f9f580b5aeecd53
SHA512 e8f2f71ec524dd7435515c012ccbbe2e29d0de866a64fcfe604c0a9888425f0b6a7f89baac8078a1715f6c7dc411a5da4d5c0b92c720195d9ef00eb57ef4fa1f
SSDEEP 24576:gDOSE7VspFPxh+EqYbt6lyn2GyQWKACVOxHTdMgh9IVbMAQyvyXiuVKHeeKKwsf0:gqhRcFPxhHYCBRnyHO6W6NIyX/kQs2Rp
TLSH
T1E8856A20E784813CE4EA0177E67D7A79866DE134073440CBAAD45B69782D7C3AF386DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

files_list

Path C:\Users\Admin\AppData\Local\Temp\.opera\df454523-35e8-4708-9783-c6fb98349023 Opera GX Installer Temp\opera_package_202606200643381\assistant\files_list
Size 72B
SHA256 5b3741e12f14d0ae54d450fff585c5fbfa7b360800c863722472d320c26b4ef4
MD5 7c375531029e3e1e14e204850417eb74
SHA1 086ccee638fbb7dcad3d21627c4f32386490f456
SHA512 8411bf285d334a51b51993487148d0b53f6cf9439a9250b71cce9718250bbb226825e3a1be832443b84ace59e43f3fb77c4f4741f0d376543ca32d9ab40f4a67
TLSH
T169A00204C51E089CAFC53595831146FF67D765145AB89655075F10CC5926027478F776
MD5 SHA1 SHA512 TLSH

Submit Download

installer.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS85094A49\installer.exe
Size 9.1MB
SHA256 41f6858a706267dbf37881b676e8ecdda66b549d009c73949a4b1790c7f1d8b1
MD5 5134a3b72bffbded04340a84bbfa5a25
SHA1 245061644afc9520d448c38a453e32676b40b822
SHA512 55646b087e36e5991f2930b8182540a7516a6b1d60da23b8249e47714e8545ba66b531de92570a583dbae8f4d299ebc1cf8b0fa54ec4dac44146061b94b6875c
SSDEEP 98304:te4C+i1DtCzcIH9SKpZUfE0O28pQNsarhOzFBI3++wteEmr:Q4C+2tCz/EDl93+Bqr
TLSH
T1E4A68D53F3E601E8D0AFCAB48B7A5232A9357C464B30A2DF0A9436251E75FD45B3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat
Size 40B
SHA256 189ade0d459454736f457357640d2c7508d4a0c04f41c0e1707973ce3032f96d
MD5 47ad5a7a892d2ec1bdd772396f1df9e0
SHA1 204d4c29b8affe8cecb9a5ea35d078d342fdbd93
SHA512 7d529129ca301eb18ead902a66c00916b5d0f92d392d74e25b3567b46c7f27fa282d98ee0593d677b5fe914de7482c1ec7251b591f2a6aa3f85716a0aa8af6e1
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads