Analysis
- max time kernel
149s - max time network
129s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
04/07/2026, 21:50
General
- Target tmp573ib0up.exe
- Size 3.1MB
- Sample260704-1pyvaset9w
- SHA256 3312be47f484efea33af084de6e81db241719278b25b0160215eda78b243d2d3
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Enumerates system info in registry 2 TTPs 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp573ib0up.exe"C:\Users\Admin\AppData\Local\Temp\tmp573ib0up.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC6C30248\installer.exeC:\Users\Admin\AppData\Local\Temp\7zSC6C30248\installer.exe --server-tracking-blob=NmFjNWZjZDJiYjNlNzk4NDM0ZmUwNDRiZTIxNDE1ZjRiNzZiOGIzYzI3YzY0NzhiOGI0NWVhMTA1MTY5ZGM3Njp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPWFkY2FzaCZ1dG1fbWVkaXVtPXBkJnV0bV9jYW1wYWlnbj12aWRlby1zdHJlYW1pbmctZGRsJnV0bV9pZD0xNzgyNjg1NzkxMTAwMDAwVUs1ODYxZTc2ZGUyN2EwYmM4SSZ1dG1fY29udGVudD05NTk2OTU4LTI1MTc1NTUwODUtMzU3Njk4NjcxMiIsInRpbWVzdGFtcCI6IjE3ODI2ODU4MTkuMTI2NyIsInVzZXJhZ2VudCI6Ik1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xNDkuMC4wLjAgU2FmYXJpLzUzNy4zNiBFZGcvMTQ5LjAuMC4wIiwidXRtIjp7ImNhbXBhaWduIjoidmlkZW8tc3RyZWFtaW5nLWRkbCIsImNvbnRlbnQiOiI5NTk2OTU4LTI1MTc1NTUwODUtMzU3Njk4NjcxMiIsImlkIjoiMTc4MjY4NTc5MTEwMDAwMFVLNTg2MWU3NmRlMjdhMGJjOEkiLCJtZWRpdW0iOiJwZCIsInNvdXJjZSI6ImFkY2FzaCJ9LCJ1dWlkIjoiODEzNGE0OTQtYTYxZS00NjQ4LWI0MmMtOWEzYWE3Y2JlNmYyIn0=2⤵
- Executes dropped EXE
- Enumerates connected drives
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC6C30248\installer.exeC:\Users\Admin\AppData\Local\Temp\7zSC6C30248\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=132.0.5905.102 --initial-client-data=0x274,0x278,0x27c,0x250,0x280,0x7ff798394e08,0x7ff798394e14,0x7ff798394e203⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\7247a2f5-7ed4-4873-ba47-773bbee90330 Opera Installer Temp\installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\7247a2f5-7ed4-4873-ba47-773bbee90330 Opera Installer Temp\installer.exe" --version3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
installer.exe