20b545c7b0b0cb56926972b7fc2a94f428b7aa3e4f9f4e65d1bd0ad800fb60b7

Analysis

user interaction
yes
max time kernel
64s
max time network
66s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 18:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OperaInstaller (6).exe
Size 178KB
Sample260716-xfla3afw2w
SHA256 20b545c7b0b0cb56926972b7fc2a94f428b7aa3e4f9f4e65d1bd0ad800fb60b7
MD5 4ef32b114eaa6f05340b46d0f48154c7
SHA1 a07219dc2a0fa96f5f9a03b1bb350c9ab2679d3f
SHA512 6631937f30fcfdc536bd14735870c9c4592f4414e9c1d71ec69c718bf341ff286174b782c6a23a6c29744be940bcac34aa93845e60727e090bee8423d738ea9d
SSDEEP 3072:IYHHEa1Lz5KhEwh5kc9+5sFoq0X/r6LGV4RxJ0OZnS+Rl//bRRlTHGVJp99vqRy:IYEwP5KhVyc9esFoBvum4RvGJTEy
TLSH
T1EB046B823AC184B5E5B244321864DBB19A7DFC700F65D9DB73987A3B5DB02C09932F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery spyware stealer

Malware Config

Signatures

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	installer.exe
File opened (read-only)	\??\F:	installer.exe
File opened (read-only)	\??\E:	installer.exe
File opened (read-only)	\??\F:	installer.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 6 IoCs

pid	Process
6068	OpInst.exe
4624	installer.exe
3292	installer.exe
5924	installer.exe
4248	installer.exe
5704	installer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaInstaller (6).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OpInst.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 6068	4348	OperaInstaller (6).exe	87
PID 6068 wrote to memory of 4624	6068	OpInst.exe	88
PID 4624 wrote to memory of 3292	4624	installer.exe	89
PID 4624 wrote to memory of 5924	4624	installer.exe	90
PID 4624 wrote to memory of 4248	4624	installer.exe	92
PID 4248 wrote to memory of 5704	4248	installer.exe	93

C:\Users\Admin\AppData\Local\Temp\OperaInstaller (6).exe
"C:\Users\Admin\AppData\Local\Temp\OperaInstaller (6).exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Users\Admin\AppData\Local\Temp\OpInst.exe
  "C:\Users\Admin\AppData\Local\Temp\OpInst.exe" --silent --allusers=0 --setdefaultbrowser=1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6068
- - C:\Users\Admin\AppData\Local\Temp\7zS4B7094B9\installer.exe
    C:\Users\Admin\AppData\Local\Temp\7zS4B7094B9\installer.exe --silent --allusers=0 --setdefaultbrowser=1 --server-tracking-blob=ZWMxN2QyODA0OTZjMzIxMmEyOTljZjViNDA1YzAyOTAyYzdiOThhNmUwZWJkNzljYzhiZmViNDQ1Yjk0YzMwMjp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdyayZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1zcG90aWZ5X29wZXJhIiwidGltZXN0YW1wIjoiMTc4NDIyNzcxMS4zMTMxIiwidXNlcmFnZW50IjoiT3BlcmEgSW5zdGFsbGVyLzEuMCIsInV0bSI6eyJjYW1wYWlnbiI6InNwb3RpZnlfb3BlcmEiLCJtZWRpdW0iOiJwYiIsInNvdXJjZSI6IndyayJ9LCJ1dWlkIjoiYTlkMTNmMDUtMzY1MS00NDNhLTg3ODgtYjBkYzljODUwZjFkIn0=
    3⤵
    - Enumerates connected drives
    - Executes dropped EXE
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:4624
  - - C:\Users\Admin\AppData\Local\Temp\7zS4B7094B9\installer.exe
      C:\Users\Admin\AppData\Local\Temp\7zS4B7094B9\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=133.0.5932.60 --initial-client-data=0x2ac,0x2b0,0x2b4,0x288,0x2b8,0x7ff7f01dad88,0x7ff7f01dad94,0x7ff7f01dada0
      4⤵
      Executes dropped EXE
      PID:3292
  - - C:\Users\Admin\AppData\Local\Temp\.opera\1bd4b58e-42ff-45e9-ac47-7f76203d371e Opera Installer Temp\installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\1bd4b58e-42ff-45e9-ac47-7f76203d371e Opera Installer Temp\installer.exe" --version
      4⤵
      Executes dropped EXE
      PID:5924
  - - C:\Users\Admin\AppData\Local\Temp\7zS4B7094B9\installer.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS4B7094B9\installer.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=4624 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\1bd4b58e-42ff-45e9-ac47-7f76203d371e Opera Installer Temp\opera_package_20260716194834" --session-guid=f20ff311-f17b-4bea-883a-3ab98e3d986c --server-tracking-blob=MzhhYzQxZTRhZWNiNjUzMmE2MTA2ZDY3NjFhZmY1YTljOGZlY2ViM2Y3ZjU4ZWU5MzNmMGNjNTI5YzEyYmRjYTp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdyayZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1zcG90aWZ5X29wZXJhIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTEiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzg0MjI3NzExLjMxMzEiLCJ1c2VyYWdlbnQiOiJPcGVyYSBJbnN0YWxsZXIvMS4wIiwidXRtIjp7ImNhbXBhaWduIjoic3BvdGlmeV9vcGVyYSIsIm1lZGl1bSI6InBiIiwic291cmNlIjoid3JrIn0sInV1aWQiOiJhOWQxM2YwNS0zNjUxLTQ0M2EtODc4OC1iMGRjOWM4NTBmMWQifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=CC07000000000000
      4⤵
      Enumerates connected drives
      Executes dropped EXE
      Enumerates system info in registry
      Suspicious use of WriteProcessMemory
      PID:4248
    - - C:\Users\Admin\AppData\Local\Temp\7zS4B7094B9\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4B7094B9\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=133.0.5932.60 --initial-client-data=0x2c0,0x2c4,0x2c8,0x290,0x2cc,0x7ff7f01dad88,0x7ff7f01dad94,0x7ff7f01dada0
        5⤵
        Executes dropped EXE
        
        PID:5704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 1KB
SHA256 63b14543360f5e89942ea8d5113526e64fbc71c1207328f0136b3a495d921dd0
MD5 adac67e1d2da2d706db151c2db316b2d
SHA1 5f6e301d23e33132209707945d0e740d5bcb8996
SHA512 9371b62ac25c6ea8fb6fca19ac47b873ced9b3d0cb45ce4de5ea974b93c12684c65aa23c7d83331c77502853258a08dff73ce5e3fb6170bd3ab1c5b3283a86a9
TLSH
T1DE31AD4EA2153027D5427F72D8CEBE83CEB1364667CAD46B18046E4229AAFC25FC80C9
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
Size 528B
SHA256 d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
MD5 047f3e9d21d6b325d592b1959e4362e6
SHA1 5aeef5f985171cd69da397fd039854e44ebecdd2
SHA512 4523896ed4a03afafd2075d8c8947236d34fe1da2c246a3f90c2be2a5c151c18bc58a6cde5a209abb8e06e80f662e24d0149640b3e98e8a872bfa8a04ef592a4
TLSH
T147F0500990082252C855FF55DFD6AC97DC76336136E595036D458E410C12F96AF950F5
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
Size 471B
SHA256 9e2f26cf6c11d6fe70989c701fed6d18584d891b1cb48deccb7cb211292e434b
MD5 20c6fc1e097ced98fbb8f1725babd909
SHA1 420bc4f380fe5f96f5ae4b0b4bd693dfb1b3ea30
SHA512 65be09d56c2c372ac2840a306b1d5380de83d87a79ee0d328e7d311ecb83cef880ab6fc4e4e761642c4ef90dc23fed7b278c408bd4d0f0b01ab6a2882cc4876a
TLSH
T192F0D49191ACE8680E078CBC2EF589267C32903640A71464E41C46EC99D45EEFB6F43F
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 174B
SHA256 1204e40d92ea47594de89c79f15db5efc6dd161f02807b2111009d5fa2b02f69
MD5 0ffcd2c7c3b147f6588ff3cb6bb370ab
SHA1 070c65c01da5979c1e1173dc73f8be8e0b969084
SHA512 dd04ec8769bac92799d04c8cf1082821047dadda39619df1407779ef0512212f05b39dc45df84d3309d00b776d347c6ab8e944c36615fcb61192626f08a05384
TLSH
T12DC09B1837B54155F1304D7F565353118BFBE505CD4183940F705269C51DB425CF5D06
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Size 170B
SHA256 47624808577ff2a0134148f889e775a77956448e3f5a9e691d222e32f7890eaa
MD5 69fffb9cf58639e915e1b26a4f74ef93
SHA1 51662afcebdb256deecac38b28d04afc697d51b4
SHA512 c4b3c4930b81c72d2de82fe1eab6d9deac25e144f02ca860a90f6027c7571bebbeab21e739aabc2235e0d76fd6fcd9bca0521824eb53379fa7f1a47882cd6b7c
TLSH
T1C9C09254B3A9472AF10E217EB9E61A041BBA820AF6CAC3484FB855388928B4048B2D09
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
Size 416B
SHA256 4cbaa460563e7662d1897dce763d7d90f9043c923fc3fa547bf80ea0f002d992
MD5 8416fcb39edc46d2785d057bcf8d47e1
SHA1 c9e8601559a746e3042b4f7275c1916337ee54d1
SHA512 eba15e3e4a644eb096c0bef6f8ade13978e2579f3421810fb27a4e23d37384cc0fc56c979a16cf6a21055d2b26f3357347e97a43e083e86f1e92e43135bcf47e
TLSH
T1D5E0C02412FB90ADF4F4D0788FDAB5354C56F0221428A2F51AE45B047A06D00EF13B38
MD5 SHA1 SHA512 TLSH

Submit Download

installer.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS4B7094B9\installer.exe
Size 8.3MB
SHA256 fe71363fe15584aff60b1ede75fa9295337f65229e4f32505c601f3fd0e9d2b5
MD5 046b6b37f71c386e733a4d386f9ef1b9
SHA1 32661dcea8aff4983aa06108a93157cd41f7c5e4
SHA512 7e9d3527368e46dcf02b29718e400099d3694040c2c252f97c6039a3b6cd87b44cf5efa7b4dbd190b2b2d856413f66c545f8c6d91501adac825b4431fe3323bb
SSDEEP 98304:a/06Gb0nT7ePcI/Ztlg1RbdsuJXMZ+AUYNY8AF7:I03b0Xex/zwVC+RXF7
TLSH
T1EB967C53F2E601F8D06FDA748B7A5232A9357C464B35A2EF0A9436251E71FD46B3CB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OpInst.exe

Path C:\Users\Admin\AppData\Local\Temp\OpInst.exe
Size 3.1MB
SHA256 88bb5ed28bcc1ba8e7266d3a03cafdb50d2dd76f39312003ecb7914d7ffb2252
MD5 764c3cde4484043542cb4b4d2524d3ce
SHA1 e31f7f8c6e0001a2ab59665d42125db3f2931319
SHA512 8fcbb78de035713dd733a346d7f4c1b603f2c48d44ed7da43c7a81a9858cb06522a4a192ad9fb86b5493401af9d026adfe171c19898f156c26295127a619070c
SSDEEP 49152:FVAbwuyoi3J6ASyDIlP/QzwFxZ+GNPxuTFxOUzJGUPNfaalL46HLXyDpJywuTIWA:zAtypYPV5JNZKNzcUPtVuDhMvhy
TLSH
T101E52312B781D475CA7325320F45E764A7ADFD611F32899B77881A6F4EF0281AB32F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.png

Path C:\Users\Admin\AppData\Local\Temp\bg.png
Size 224KB
SHA256 5fa976ea5780439175bb696817cd6eab3625ba5ccfe5b220587130ed5e1da855
MD5 21eb6b8232802f32b6483eedb96677bb
SHA1 b390f01600e521586e210936a4b57a6b89e66a7b
SHA512 5cfcb0278e5e7473dde396ee34115a3f50a9ad195d99b53cc5cc33a169a42c8f729806491fc0fb607719139081fa3c774c37b1638de1289b73c0c4c80768cfcd
SSDEEP 3072:7MuA+f6FJxlUhyLg2cugpbM5Q+jBre6cAJqmm6nkrw8sGaDy7y8bRzUnKdh8BfM9:7MuAWojcVdGSf+4BML49RzUnKUuLZ
TLSH
T1E92423876BC391F4590BD65FE9386BEC3CD4E7EC82AB113C931A42424D8416B85DE8F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
Size 40B
SHA256 59210723f419967844e16528e5ef4ccf08750dff59c2ad3d0fe5096235418bf5
MD5 2c7c2e7efe35a11000b61f3dffb01d28
SHA1 351544213d20850ff4c38cf6da5c9c126bc113b7
SHA512 10481474b995291ffbeb0270d4c8e0ff22458ba3275bbb0ab525364842efd0249d4f5b1e20a85a64569df2044b7f178c9304deb789f0822d983bbbaf0d7014f2
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads