5a4300757192b0190711fd048c666d70e3c613c937be50b550a60e4044925a60

General

Target
OperaSetup2.exe
Size 3.1MB
Sample260620-s8zxpsg121
SHA256 5a4300757192b0190711fd048c666d70e3c613c937be50b550a60e4044925a60
MD5 61355ede4c09646998f5b4a6066e121f
SHA1 6665abc6e1b8dd8b813a83fe6421bdbf2cce1e3e
SHA512 3332ad135d73fbf1cef0c8d729b3b7fa0dee2f80dadde55855945eed5c9fecdc50439b17defbdf384d3742fa582fe8cf22e5e96f8b3888bc394d8384e14bb49e
SSDEEP 49152:4VAbw4Y5G+ucxnEvI2H3ytBuUadfTKldr2e8Lw59OKI/ubH7AXcS:0A9Y5G+jEvBXytw3Tmd2vKiSH7wcS
TLSH
T1F7E5234237C1D835D56330321F1AD6A8967DB9A01F31E69F73886A6E8EB0681D631F1F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
6184	installer.exe
6000	installer.exe
2900	installer.exe
4748	Assistant_130.0.5847.41_Setup.exe_sfx.exe
7108	assistant_installer.exe
1812	assistant_installer.exe

Loads dropped DLL 4 IoCs

pid	Process
7108	assistant_installer.exe
7108	assistant_installer.exe
1812	assistant_installer.exe
1812	assistant_installer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	installer.exe
File opened (read-only)	\??\F:	installer.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaSetup2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Assistant_130.0.5847.41_Setup.exe_sfx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	assistant_installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
6184	installer.exe
6184	installer.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 6328 wrote to memory of 6184	6328	OperaSetup2.exe	90
PID 6184 wrote to memory of 6000	6184	installer.exe	91
PID 6184 wrote to memory of 2900	6184	installer.exe	92
PID 6184 wrote to memory of 4748	6184	installer.exe	93
PID 6184 wrote to memory of 7108	6184	installer.exe	94
PID 7108 wrote to memory of 1812	7108	assistant_installer.exe	95

C:\Users\Admin\AppData\Local\Temp\OperaSetup2.exe
"C:\Users\Admin\AppData\Local\Temp\OperaSetup2.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6328
- C:\Users\Admin\AppData\Local\Temp\7zS8B82FD48\installer.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8B82FD48\installer.exe --server-tracking-blob=NzI4MTJkMDM2MWZiYTFiNWYyMmU0M2E4ZmQ3MTE5M2E3YTg3Mjk5YzRhMzhlMGVmODFjMjc1OTA5OTBiZDU4OTp7ImNvdW50cnkiOiJERSIsImZhc3Rfb25ib2FyZGluZyI6e30sImh0dHBfcmVmZXJyZXIiOiJodHRwczovL2Jyb3dzZXJwcm8ub25saW5lLyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPWFkY2FzaCZ1dG1fbWVkaXVtPXBkJnV0bV9jYW1wYWlnbj1kZGxfdGVzdCZ1dG1faWQ9MTc4MTU0ODIzNTEwMDAwMERFVktqU0p3V2NJZmJrSUcmdXRtX2NvbnRlbnQ9OTQxMDM3MC0yNTE3NTU1MDg1LTQyNjk0NDE0OTgiLCJ0aW1lc3RhbXAiOiIxNzgxNTQ4NTcyLjYzNTAiLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTQ1LjAuMC4wIFNhZmFyaS81MzcuMzYiLCJ1dG0iOnsiY2FtcGFpZ24iOiJkZGxfdGVzdCIsImNvbnRlbnQiOiI5NDEwMzcwLTI1MTc1NTUwODUtNDI2OTQ0MTQ5OCIsImlkIjoiMTc4MTU0ODIzNTEwMDAwMERFVktqU0p3V2NJZmJrSUciLCJtZWRpdW0iOiJwZCIsInNvdXJjZSI6ImFkY2FzaCJ9LCJ1dWlkIjoiMDRhYWEwMWUtNzZiNi00MzMyLTk0MjMtODQyZjQ5ZDFmMWZmIn0=
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Enumerates system info in registry
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:6184
- - C:\Users\Admin\AppData\Local\Temp\7zS8B82FD48\installer.exe
    C:\Users\Admin\AppData\Local\Temp\7zS8B82FD48\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=132.0.5905.37 --initial-client-data=0x2b8,0x2b4,0x2bc,0x288,0x2c0,0x7ff692b05e08,0x7ff692b05e14,0x7ff692b05e20
    3⤵
    - Executes dropped EXE
    PID:6000
- - C:\Users\Admin\AppData\Local\Temp\.opera\489bfe21-fc90-4258-9f82-0eff4238b8f0 Opera Installer Temp\installer.exe
    "C:\Users\Admin\AppData\Local\Temp\.opera\489bfe21-fc90-4258-9f82-0eff4238b8f0 Opera Installer Temp\installer.exe" --version
    3⤵
    - Executes dropped EXE
    PID:2900
- - C:\Users\Admin\AppData\Local\Temp\.opera\489bfe21-fc90-4258-9f82-0eff4238b8f0 Opera Installer Temp\opera_package_202606201648331\assistant\Assistant_130.0.5847.41_Setup.exe_sfx.exe
    "C:\Users\Admin\AppData\Local\Temp\.opera\489bfe21-fc90-4258-9f82-0eff4238b8f0 Opera Installer Temp\opera_package_202606201648331\assistant\Assistant_130.0.5847.41_Setup.exe_sfx.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4748
- - C:\Users\Admin\AppData\Local\Temp\.opera\489bfe21-fc90-4258-9f82-0eff4238b8f0 Opera Installer Temp\opera_package_202606201648331\assistant\assistant_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\.opera\489bfe21-fc90-4258-9f82-0eff4238b8f0 Opera Installer Temp\opera_package_202606201648331\assistant\assistant_installer.exe" --version
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:7108
  - - C:\Users\Admin\AppData\Local\Temp\.opera\489bfe21-fc90-4258-9f82-0eff4238b8f0 Opera Installer Temp\opera_package_202606201648331\assistant\assistant_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\489bfe21-fc90-4258-9f82-0eff4238b8f0 Opera Installer Temp\opera_package_202606201648331\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=130.0.5847.41 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x314040,0x31404c,0x314058
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:1812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

additional_file0.tmp

Path C:\Users\Admin\AppData\Local\Temp\.opera\489bfe21-fc90-4258-9f82-0eff4238b8f0 Opera Installer Temp\opera_package_202606201648331\additional_file0.tmp
Size 2.8MB
SHA256 71a4cc628fd1716fd994689c4808d2ebbc00e8bd2ecb7600b9921baa8916c752
MD5 3b028b1188ac321e66add16f8ebadbec
SHA1 086bcb2b1c0d300be15c1390841aadadcec4eac7
SHA512 17c390e0df8e29ff9ad43e581db298ada2d8378fbb890dc5f4b17df8fbe21134f99ab203ea4752a419215d289c128a1d8bc14721bde80042e5bb4c3901dffb72
SSDEEP 49152:+kinoIZOrzV7AlDfo7eT/uAtH00raHx774jx4aGhcr0glyGIGE1HVyVNW272DS/Z:+kiocQzV89Tmeradk2ha0gdIT11yVQ2w
TLSH
T167D5233275A48C34D62312321CE0FAEDA5BE72701E6347DB73A42B1F9EB01979A1D562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

assistant_installer.exe

Path C:\Users\Admin\AppData\Local\Temp\.opera\489bfe21-fc90-4258-9f82-0eff4238b8f0 Opera Installer Temp\opera_package_202606201648331\assistant\assistant_installer.exe
Size 2.4MB
SHA256 63187b388e01fb05d8c29957e1c566324af67aff2f7a2e3da9132248c79375a8
MD5 b0408fa2a406f483e42c3ac102d35e9b
SHA1 fbaca900ad54abc65ec2cb34d63727c87132d16b
SHA512 2e8b9af626fff68ecd0204d6a3151b4518749143ec78a2f8f99f959399d1c8ea59987f99c38c9e48fe38b518fd8c91381356daf3f17944fa3432337b882e5401
SSDEEP 49152:wJv8lBbu91xwyiZSwRDzWEibQojjHLQDpizF:wR8lBbu91xwyiZSwRWEKQWjHLOpc
TLSH
T10AC5AE12A86094B5D8563132321DEB3E9A30BE1657354DDBDB90BCC1BBB86E2353734B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

browser_assistant.exe

Path C:\Users\Admin\AppData\Local\Temp\.opera\489bfe21-fc90-4258-9f82-0eff4238b8f0 Opera Installer Temp\opera_package_202606201648331\assistant\browser_assistant.exe
Size 5.3MB
SHA256 fdd6f367514a8c44bedd7d8cae73120bcab054975df41be2a38f082b9521746a
MD5 120b5539ce7123698f17dfe49977f6e0
SHA1 20fcf9b525b48ccecc40fb6e82aa99d086fe63ca
SHA512 171c79b08816ddc655ea65866f467e26c1628051f973144ff80d705f97201ed071b8e19b22ace834a8f1e44c823ff1d1d8e282ea7a6a7c8b88ec8622a48e2c30
SSDEEP 98304:P6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwS:baFDasWTMzz4/qyOwHqBt8Zh9RQl
TLSH
T1ED46AF62F6116074C81EA471383D7B7F68296D23D72187DB8DD83CA06F746C2263EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbgcore.DLL

Path C:\Users\Admin\AppData\Local\Temp\.opera\489bfe21-fc90-4258-9f82-0eff4238b8f0 Opera Installer Temp\opera_package_202606201648331\assistant\dbgcore.DLL
Size 222KB
SHA256 7bb46348c2ec97ef9ee7a8e0ae28c8e069513e8acaee2689134a2d906b5fdecf
MD5 b26ebc5cde9b1726ee9f9534dd6107d0
SHA1 de00af3ec4de63a158bcd50c6e95b046669d3353
SHA512 2e01c65b58369c1f5f4081cf377c3fedd87ae5fca63cfbc44dd7859a1e10a849d1bbdbb592349d793166f577dbd954cd8660f625dcbc9adc4d936d6a44f062bf
SSDEEP 6144:FASh0NdOEQzFh0ekr6nzwBaQGdppLIg2dFl96Fl:4MHZn1n+P96Fl
TLSH
T14C247C2269401533DCEF12F062AF363A96AEDD90239490C359A05BDDD6D4BC12E3D6EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbghelp.dll

Path C:\Users\Admin\AppData\Local\Temp\.opera\489bfe21-fc90-4258-9f82-0eff4238b8f0 Opera Installer Temp\opera_package_202606201648331\assistant\dbghelp.dll
Size 1.8MB
SHA256 6fd2b4bfc275ed306ce09008ff8437818b3373e69e4b3db3cbb79be91b2b9308
MD5 021b11c0fc1a09e49a2046ef07d1747a
SHA1 4b955c1e7150db4f07528929fc529fde9738a2b3
SHA512 6ca94fdf2b92928859152aa23f31df46944eeeac7988f6bb5d647341843d8d2aa91c2c810d17c8b58a03c99e4ca7d7e1ae6b6c2d9ea5029616d870b89794d6c8
SSDEEP 49152:xEDlXSohR86M5NKBlv/2yOFVnzM9F0KM7:uFhR86MHyl0fb
TLSH
T128856B20E784813CE4EA1177E67C7A7D85ADE524073440CBAAC45BA978297D32F387DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

files_list

Path C:\Users\Admin\AppData\Local\Temp\.opera\489bfe21-fc90-4258-9f82-0eff4238b8f0 Opera Installer Temp\opera_package_202606201648331\assistant\files_list
Size 72B
SHA256 5b3741e12f14d0ae54d450fff585c5fbfa7b360800c863722472d320c26b4ef4
MD5 7c375531029e3e1e14e204850417eb74
SHA1 086ccee638fbb7dcad3d21627c4f32386490f456
SHA512 8411bf285d334a51b51993487148d0b53f6cf9439a9250b71cce9718250bbb226825e3a1be832443b84ace59e43f3fb77c4f4741f0d376543ca32d9ab40f4a67
TLSH
T169A00204C51E089CAFC53595831146FF67D765145AB89655075F10CC5926027478F776
MD5 SHA1 SHA512 TLSH

Submit Download

installer.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS8B82FD48\installer.exe
Size 8.3MB
SHA256 83941ee9676a40559ec50b519adcb8dde3e417184222651fce7e75d4c719a3bd
MD5 49a3de26dbb677838b5acc85fb0153fc
SHA1 79960871c6a580e7485b9805882ac54e2cf52a6d
SHA512 8ecb5d7553042bd29680e6494cdd8ba95e33ca002d9135c74fc6ba7fe94981e378c0881b1f8606eee66c623972c5aebb830c13b7ee2779afd21bd5ba47ba45c9
SSDEEP 98304:M67ATLk4kFfVTqD52/h67uMu+pqbNFXbSgITVLYNY8AFZ:MEATLJUfVAsNF/sLXFZ
TLSH
T13B967C53F3A601E8D06FCA788B7A5632A9357C564B30A3EF0A9436250E75FD45B3CB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
Size 40B
SHA256 c0a737e3bf54b47e176ed4a869aab5d79404fd1908ac1b7714b34d478640d062
MD5 5bbb79a56f18b7c315f1263a2e3bbfe9
SHA1 93368bc65591ceabb335a7f213ec8c2d06ae5526
SHA512 8c3b3bba877ed53867c95bba8bb61aeee3ec30ffb567d260ccc8af4ddf86f7e5380a953aba453e172a717e44b3a5df559d6690c2c989e1d4ab6a0a955b2d27d7
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads