Analysis
- max time kernel
298s - max time network
179s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/07/2026, 09:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
OperaGXSetup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
17 signatures
300 seconds
Behavioral task
behavioral2
Sample
OperaGXSetup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
300 seconds
General
- Target OperaGXSetup.exe
- Size 2.7MB
- Sample260719-lt7wfagy4k
- SHA256 5adcd4ca03b95f5ddbbe90c579c79c609fc3b190a86687a3fc5778601df319d5
- MD5 0737ef34ae0c6b685996dfe34816f165
- SHA1 247abb9f9d70e0ec3bb6b832836cd1c43f06488f
- SHA512 468dc34b574d4917f29d85f6893219f89da558e1f849af2113db8358c188ff95102ce2fb02e04247c85bf34c30671e671edbae9b432bf394ba3aca74f06a5193
- SSDEEP 49152:R1L/n1CaRi0XbGXuIKldL9W3hrBXR8s/qyrh07qzlHCzDZgS4Zb1Z9+J4a+YsECT:R1h0c+hrBXR8s/qyn7jLa+YsEC/gmQT
- TLSH T108D58E11A7A801E9D177D338C6565603EBB6B48513319BDB53908BEA3F13AE12B3E3D1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 api.ipify.org 2 api.ipify.org 3 api.ipify.org - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2700 OperaGXSetup.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4656 cmd.exe - Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2700 OperaGXSetup.exe Token: SeSecurityPrivilege 2700 OperaGXSetup.exe Token: SeTakeOwnershipPrivilege 2700 OperaGXSetup.exe Token: SeLoadDriverPrivilege 2700 OperaGXSetup.exe Token: SeSystemProfilePrivilege 2700 OperaGXSetup.exe Token: SeSystemtimePrivilege 2700 OperaGXSetup.exe Token: SeProfSingleProcessPrivilege 2700 OperaGXSetup.exe Token: SeIncBasePriorityPrivilege 2700 OperaGXSetup.exe Token: SeCreatePagefilePrivilege 2700 OperaGXSetup.exe Token: SeBackupPrivilege 2700 OperaGXSetup.exe Token: SeRestorePrivilege 2700 OperaGXSetup.exe Token: SeShutdownPrivilege 2700 OperaGXSetup.exe Token: SeDebugPrivilege 2700 OperaGXSetup.exe Token: SeSystemEnvironmentPrivilege 2700 OperaGXSetup.exe Token: SeRemoteShutdownPrivilege 2700 OperaGXSetup.exe Token: SeUndockPrivilege 2700 OperaGXSetup.exe Token: SeManageVolumePrivilege 2700 OperaGXSetup.exe Token: 33 2700 OperaGXSetup.exe Token: 34 2700 OperaGXSetup.exe Token: 35 2700 OperaGXSetup.exe Token: 36 2700 OperaGXSetup.exe Token: SeIncreaseQuotaPrivilege 2700 OperaGXSetup.exe Token: SeSecurityPrivilege 2700 OperaGXSetup.exe Token: SeTakeOwnershipPrivilege 2700 OperaGXSetup.exe Token: SeLoadDriverPrivilege 2700 OperaGXSetup.exe Token: SeSystemProfilePrivilege 2700 OperaGXSetup.exe Token: SeSystemtimePrivilege 2700 OperaGXSetup.exe Token: SeProfSingleProcessPrivilege 2700 OperaGXSetup.exe Token: SeIncBasePriorityPrivilege 2700 OperaGXSetup.exe Token: SeCreatePagefilePrivilege 2700 OperaGXSetup.exe Token: SeBackupPrivilege 2700 OperaGXSetup.exe Token: SeRestorePrivilege 2700 OperaGXSetup.exe Token: SeShutdownPrivilege 2700 OperaGXSetup.exe Token: SeDebugPrivilege 2700 OperaGXSetup.exe Token: SeSystemEnvironmentPrivilege 2700 OperaGXSetup.exe Token: SeRemoteShutdownPrivilege 2700 OperaGXSetup.exe Token: SeUndockPrivilege 2700 OperaGXSetup.exe Token: SeManageVolumePrivilege 2700 OperaGXSetup.exe Token: 33 2700 OperaGXSetup.exe Token: 34 2700 OperaGXSetup.exe Token: 35 2700 OperaGXSetup.exe Token: 36 2700 OperaGXSetup.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2700 wrote to memory of 4656 2700 OperaGXSetup.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
- Executes a command shell one-liner
PID:4656
-