b627b156cf65eb26761f4afb9c79ef3107f661c1e6b4177573d5a60ed08d2fb0

General

Target
OperaGXSetup.exe
Size 3.9MB
Sample260626-thwm2ads9m
SHA256 b627b156cf65eb26761f4afb9c79ef3107f661c1e6b4177573d5a60ed08d2fb0
MD5 59380414b96746b97d0e02cf49fdb7a3
SHA1 de8d7db4913535c4ba2d65f05ee1a7a4900262a9
SHA512 2d4bb9d6adc2046ec263faf9583c13e7cb4fd2e4548ad9490e2d5661ee237c73ee4625bdbfdc4f19801b13d54035597d6a2df3952a819920bba07b45450ef35c
SSDEEP 98304:UA0Prx+lLItxUran6m1SX8Q7btUHyLDbojgXySMXtWMDiJ9H1:aDx4QisXubtUSlXyJWV
TLSH
T1331633217782C0B0E6F312320F79F766A6BEB9100F67568F27941E9D8F719829635F12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
3960	installer.exe
5176	installer.exe
3280	installer.exe
1636	Opera_GX_assistant_132.0.5905.28_Setup.exe_sfx.exe
4464	assistant_installer.exe
240	assistant_installer.exe

Loads dropped DLL 4 IoCs

pid	Process
4464	assistant_installer.exe
4464	assistant_installer.exe
240	assistant_installer.exe
240	assistant_installer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	installer.exe
File opened (read-only)	\??\F:	installer.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaGXSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opera_GX_assistant_132.0.5905.28_Setup.exe_sfx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	assistant_installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	assistant_installer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3960	installer.exe
3960	installer.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5632 wrote to memory of 3960	5632	OperaGXSetup.exe	89
PID 3960 wrote to memory of 5176	3960	installer.exe	90
PID 3960 wrote to memory of 3280	3960	installer.exe	91
PID 3960 wrote to memory of 1636	3960	installer.exe	93
PID 3960 wrote to memory of 4464	3960	installer.exe	94
PID 4464 wrote to memory of 240	4464	assistant_installer.exe	95

C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
"C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5632
- C:\Users\Admin\AppData\Local\Temp\7zS0069DDB8\installer.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0069DDB8\installer.exe --server-tracking-blob=NTU0Y2FhMTI1NTNmNTAxYmI5MzhjYWQxNmI5ZWI4N2RmZjc1OTU2NWUzYzYyNTBlODI3MTg2YTIxNjZiZWQ2ODp7ImNvdW50cnkiOiJERSIsImZhc3Rfb25ib2FyZGluZyI6e30sImh0dHBfcmVmZXJyZXIiOiJodHRwczovL3d3dy5vcGVyYS5jb20vIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYUdYU2V0dXAuZXhlIiwicHJvZHVjdCI6Im9wZXJhX2d4IiwicXVlcnkiOiIvb3BlcmFfZ3gvc3RhYmxlL3dpbmRvd3M/dXRtX3NvdXJjZT1zZWFyY2guYnJhdmUuY29tJnV0bV9tZWRpdW09cm9jJnV0bV9jYW1wYWlnbj0lMjhub25lJTI5JnV0bV9jb250ZW50PSUyRiZodHRwX3JlZmVycmVyPWh0dHBzJTNBJTJGJTJGc2VhcmNoLmJyYXZlLmNvbSUyRiZ1dG1fc2l0ZT1vcGVyYV9jb20mdXRtX2xhc3RwYWdlPW9wZXJhLmNvbSUyRmd4JmRsX3Rva2VuPTM1Mjg4NDY4IiwidGltZXN0YW1wIjoiMTc4MjQ4OTUyMi44NjUwIiwidXNlcmFnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzE0OS4wLjAuMCBTYWZhcmkvNTM3LjM2IiwidXRtIjp7ImNhbXBhaWduIjoiKG5vbmUpIiwiY29udGVudCI6Ii8iLCJsYXN0cGFnZSI6Im9wZXJhLmNvbS9neCIsIm1lZGl1bSI6InJvYyIsInNpdGUiOiJvcGVyYV9jb20iLCJzb3VyY2UiOiJzZWFyY2guYnJhdmUuY29tIn0sInV1aWQiOiJlMjNlNjc0Mi1hMDE3LTQ1ZTctOWMyNS05MTg3ZDkzZGMxNzcifQ==
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Enumerates system info in registry
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3960
- - C:\Users\Admin\AppData\Local\Temp\7zS0069DDB8\installer.exe
    C:\Users\Admin\AppData\Local\Temp\7zS0069DDB8\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=132.0.5905.110 --initial-client-data=0x2a0,0x2a4,0x2a8,0x27c,0x2ac,0x7ff725eb6e08,0x7ff725eb6e14,0x7ff725eb6e20
    3⤵
    - Executes dropped EXE
    PID:5176
- - C:\Users\Admin\AppData\Local\Temp\.opera\e24832b3-6779-466d-8c87-9ae385b6879d Opera GX Installer Temp\installer.exe
    "C:\Users\Admin\AppData\Local\Temp\.opera\e24832b3-6779-466d-8c87-9ae385b6879d Opera GX Installer Temp\installer.exe" --version
    3⤵
    - Executes dropped EXE
    PID:3280
- - C:\Users\Admin\AppData\Local\Temp\.opera\e24832b3-6779-466d-8c87-9ae385b6879d Opera GX Installer Temp\opera_package_202606261704101\assistant\Opera_GX_assistant_132.0.5905.28_Setup.exe_sfx.exe
    "C:\Users\Admin\AppData\Local\Temp\.opera\e24832b3-6779-466d-8c87-9ae385b6879d Opera GX Installer Temp\opera_package_202606261704101\assistant\Opera_GX_assistant_132.0.5905.28_Setup.exe_sfx.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1636
- - C:\Users\Admin\AppData\Local\Temp\.opera\e24832b3-6779-466d-8c87-9ae385b6879d Opera GX Installer Temp\opera_package_202606261704101\assistant\assistant_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\.opera\e24832b3-6779-466d-8c87-9ae385b6879d Opera GX Installer Temp\opera_package_202606261704101\assistant\assistant_installer.exe" --version
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:4464
  - - C:\Users\Admin\AppData\Local\Temp\.opera\e24832b3-6779-466d-8c87-9ae385b6879d Opera GX Installer Temp\opera_package_202606261704101\assistant\assistant_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\e24832b3-6779-466d-8c87-9ae385b6879d Opera GX Installer Temp\opera_package_202606261704101\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=132.0.5905.28 --initial-client-data=0x24c,0x250,0x254,0x210,0x258,0x1074b80,0x1074b8c,0x1074b98
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

additional_file0.tmp

Path C:\Users\Admin\AppData\Local\Temp\.opera\e24832b3-6779-466d-8c87-9ae385b6879d Opera GX Installer Temp\opera_package_202606261704101\additional_file0.tmp
Size 2.8MB
SHA256 0f50bda78a34e09ccfd5e33a7958de9eebe9863cc3d875e8b9c52dec3f3a9992
MD5 1bed04ab23ee645cad438456a6d465fa
SHA1 68b7d9eb6ff0bd159281a2fd55a7a24860ba765c
SHA512 9ca295d1c574e88eb8506ba3bb4096ff3860e605b7870fe11a2eff27c85a551894345b7524485fb4fd5ed5e9cfbefb917f735ed51085cfd3adbabd9a28909f23
SSDEEP 49152:MkinoAcJ53ld/JCHyHuw+yIfBfnDWUKT5qDztnvkbPsGaW6EYFZoMzu3ug:MkioJJ57RCH2uryIfi0mz+W6Eory3ug
TLSH
T1E0D533317D918476D22392330DD5FBEC66BFF5B22F229A9B3388072EAF201A24715557
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

assistant_installer.exe

Path C:\Users\Admin\AppData\Local\Temp\.opera\e24832b3-6779-466d-8c87-9ae385b6879d Opera GX Installer Temp\opera_package_202606261704101\assistant\assistant_installer.exe
Size 2.5MB
SHA256 e86907d20a18c6b99e270a4422e0c279079e8a118b6bd7fbb4001161ddc881f4
MD5 31f5e82954b11ee1cbaf09294f7d5d6d
SHA1 580d39bfee5fad23b31ea4869561b4f9d15f322e
SHA512 e3ec7a6c238faaa1561b12b67217edac16e5c63ff68483daf4e7d7bf6b1bdcc16e2dda5b11a7b69434dcfd864cab6e427854d8d70a2cd7cbf744ca8b15a6fe9f
SSDEEP 49152:6P/Ojp1psS7+BMvcOZ+XMxNBfAlVH5p6h7yMo:6nOjp1psS7+BMvpiMnBfAPH5p6hGp
TLSH
T1CBC59D02B89194B5DC963032361CF77E9A345E114B364DC79B90BCD16FB9AE2223739B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

browser_assistant.exe

Path C:\Users\Admin\AppData\Local\Temp\.opera\e24832b3-6779-466d-8c87-9ae385b6879d Opera GX Installer Temp\opera_package_202606261704101\assistant\browser_assistant.exe
Size 5.2MB
SHA256 4a5fd953fd0e1c3085ae68fa3984083b6273b2fecad4cbd5149f9b20a720e7e5
MD5 5680d512b11f574b5524f10c3d45ce87
SHA1 0e7cd5320efefa1df9732096e472f1b956d75708
SHA512 66ac6b71c34139109dff57757fda405610a3ae78263cab833ecb3a1275bfeacf57de0ea59a047d4d6b93401652fe94ab9715638dc53ddc6acd8a4181280fdd59
SSDEEP 98304:u6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwm:oBjuUOK93csaOxLVlod8Il796HKXPZ
TLSH
T10A46BE52FB217074C80A7971643C6B7B9C281D2B972186DF8AD87CE25B784C2363DB5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbgcore.DLL

Path C:\Users\Admin\AppData\Local\Temp\.opera\e24832b3-6779-466d-8c87-9ae385b6879d Opera GX Installer Temp\opera_package_202606261704101\assistant\dbgcore.DLL
Size 196KB
SHA256 a2777992696c953c001dabade3f236f731987b58061efd8c894815f9939f979c
MD5 874334b4e7891772e6543f666e6d2411
SHA1 d9f0ca0263a50f254c6516aa9c8fbc671d978025
SHA512 c5b205cd580c75df43e69215028874bd233cede85c1829e4bbc67a2160c786a59124ef49681351aee383c27ce764fb7e47fc22e8b454b0eed8f0bb4020edca1f
SSDEEP 6144:pASh0NdOkBakZykbp/eyhr+SJors+k0L3nTd:8YIqFLnT
TLSH
T169148C6296840833DD9F11B8B29F333795FEEFB0139194C362549AE4E5647C06E3A2DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbghelp.dll

Path C:\Users\Admin\AppData\Local\Temp\.opera\e24832b3-6779-466d-8c87-9ae385b6879d Opera GX Installer Temp\opera_package_202606261704101\assistant\dbghelp.dll
Size 1.8MB
SHA256 102419e70ed462dd1ef4a30d94b714c4317ea838d7acc85ae030dfca19f609ab
MD5 7660d7d4afc11706c9b4f03aaef74a9e
SHA1 38136ffc06c49fde4dc4210e9f9f580b5aeecd53
SHA512 e8f2f71ec524dd7435515c012ccbbe2e29d0de866a64fcfe604c0a9888425f0b6a7f89baac8078a1715f6c7dc411a5da4d5c0b92c720195d9ef00eb57ef4fa1f
SSDEEP 24576:gDOSE7VspFPxh+EqYbt6lyn2GyQWKACVOxHTdMgh9IVbMAQyvyXiuVKHeeKKwsf0:gqhRcFPxhHYCBRnyHO6W6NIyX/kQs2Rp
TLSH
T1E8856A20E784813CE4EA0177E67D7A79866DE134073440CBAAD45B69782D7C3AF386DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

files_list

Path C:\Users\Admin\AppData\Local\Temp\.opera\e24832b3-6779-466d-8c87-9ae385b6879d Opera GX Installer Temp\opera_package_202606261704101\assistant\files_list
Size 72B
SHA256 5b3741e12f14d0ae54d450fff585c5fbfa7b360800c863722472d320c26b4ef4
MD5 7c375531029e3e1e14e204850417eb74
SHA1 086ccee638fbb7dcad3d21627c4f32386490f456
SHA512 8411bf285d334a51b51993487148d0b53f6cf9439a9250b71cce9718250bbb226825e3a1be832443b84ace59e43f3fb77c4f4741f0d376543ca32d9ab40f4a67
TLSH
T169A00204C51E089CAFC53595831146FF67D765145AB89655075F10CC5926027478F776
MD5 SHA1 SHA512 TLSH

Submit Download

installer.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS0069DDB8\installer.exe
Size 9.1MB
SHA256 ab34f86bacc5748b9a8ffee905e1d6e67e679b1c52af2271d87ebe380e9c0c2b
MD5 5bfccafae60aedcb17d2a6c50ab0b3b9
SHA1 6be3b4c4c4a7862bcf6db236ce0db25fd23d7fcb
SHA512 feae698bb35cb299b4ec523ec320ce8ea3a47916395a40cf68bd2427a5e4201e5735c78d4e56589fc208ae8fae15a996981560da4a43fe84fec1c12d4b735d92
SSDEEP 98304:gKzmLFBIDg/NgR7lUTqJgTQ+mL/WkcXdrFBI3++wteEmA:gvLFBGeNgdKgwI3+BqA
TLSH
T1F2A69D53F3E601E8D06FCA748B7A523299357C464B34A2DF0A943A251E75FD4AB3CB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat
Size 40B
SHA256 e49bb2b764ca5ba2e6f54c9488e65c20fa83194b35cb6a2f182396a9f977291c
MD5 8a4c34f3a3acc739b293a21e6979b8c5
SHA1 2ae21f68c1af7f5a9c7168963f0e7a6bb1cf2e8e
SHA512 d6a750f976805113f9d107149a08ed52d1dc830c022bc899ee21077d85ce6d1987eccbe1b19415dd1a22ba9dcfac01aac7619668e6a64f828b114d0737979677
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads