20b545c7b0b0cb56926972b7fc2a94f428b7aa3e4f9f4e65d1bd0ad800fb60b7

Analysis

user interaction
yes
max time kernel
110s
max time network
110s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 02:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OperaInstaller.exe
Size 178KB
Sample260729-cs2hlasdpc
SHA256 20b545c7b0b0cb56926972b7fc2a94f428b7aa3e4f9f4e65d1bd0ad800fb60b7
MD5 4ef32b114eaa6f05340b46d0f48154c7
SHA1 a07219dc2a0fa96f5f9a03b1bb350c9ab2679d3f
SHA512 6631937f30fcfdc536bd14735870c9c4592f4414e9c1d71ec69c718bf341ff286174b782c6a23a6c29744be940bcac34aa93845e60727e090bee8423d738ea9d
SSDEEP 3072:IYHHEa1Lz5KhEwh5kc9+5sFoq0X/r6LGV4RxJ0OZnS+Rl//bRRlTHGVJp99vqRy:IYEwP5KhVyc9esFoBvum4RvGJTEy
TLSH
T1EB046B823AC184B5E5B244321864DBB19A7DFC700F65D9DB73987A3B5DB02C09932F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
13	3372	OperaInstaller.exe

Executes dropped EXE 6 IoCs

pid	Process
5524	OpInst.exe
3360	installer.exe
6088	installer.exe
1356	installer.exe
1348	installer.exe
4772	installer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	installer.exe
File opened (read-only)	\??\F:	installer.exe
File opened (read-only)	\??\E:	installer.exe
File opened (read-only)	\??\F:	installer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OpInst.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 5524	3372	OperaInstaller.exe	89
PID 5524 wrote to memory of 3360	5524	OpInst.exe	90
PID 3360 wrote to memory of 6088	3360	installer.exe	91
PID 3360 wrote to memory of 1356	3360	installer.exe	92
PID 3360 wrote to memory of 1348	3360	installer.exe	94
PID 1348 wrote to memory of 4772	1348	installer.exe	95

C:\Users\Admin\AppData\Local\Temp\OperaInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\OperaInstaller.exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Users\Admin\AppData\Local\Temp\OpInst.exe
  "C:\Users\Admin\AppData\Local\Temp\OpInst.exe" --silent --allusers=0 --setdefaultbrowser=1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5524
- - C:\Users\Admin\AppData\Local\Temp\7zS49509D89\installer.exe
    C:\Users\Admin\AppData\Local\Temp\7zS49509D89\installer.exe --silent --allusers=0 --setdefaultbrowser=1 --server-tracking-blob=YTU5OGJkOGI5ODhiZjY5ZmE0M2ViMWI0Y2UyMGI5M2FlNDQ2NmQ5MjZiZmUyNTZhYWZmNDRmYWE1NDJhMjZiZjp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdyayZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1zcG90aWZ5X29wZXJhIiwidGltZXN0YW1wIjoiMTc4NTI5MTcwNS4wODMzIiwidXNlcmFnZW50IjoiT3BlcmEgSW5zdGFsbGVyLzEuMCIsInV0bSI6eyJjYW1wYWlnbiI6InNwb3RpZnlfb3BlcmEiLCJtZWRpdW0iOiJwYiIsInNvdXJjZSI6IndyayJ9LCJ1dWlkIjoiZWM3ZDFmZjAtZjFjOC00NzcxLWJjZDUtNmMxMDRjNTA5MjExIn0=
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:3360
  - - C:\Users\Admin\AppData\Local\Temp\7zS49509D89\installer.exe
      C:\Users\Admin\AppData\Local\Temp\7zS49509D89\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=133.0.5932.85 --initial-client-data=0x2bc,0x2c0,0x2c4,0x298,0x2c8,0x7ff79ad4ad88,0x7ff79ad4ad94,0x7ff79ad4ada0
      4⤵
      Executes dropped EXE
      PID:6088
  - - C:\Users\Admin\AppData\Local\Temp\.opera\7a4e1158-f425-416e-9a5b-cc481eda54ce Opera Installer Temp\installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\7a4e1158-f425-416e-9a5b-cc481eda54ce Opera Installer Temp\installer.exe" --version
      4⤵
      Executes dropped EXE
      PID:1356
  - - C:\Users\Admin\AppData\Local\Temp\7zS49509D89\installer.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS49509D89\installer.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=3360 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\7a4e1158-f425-416e-9a5b-cc481eda54ce Opera Installer Temp\opera_package_20260729032148" --session-guid=02570ba0-d736-4401-9f9f-677848b47e26 --server-tracking-blob=NTJmZjdmOTFiZTViYTYyYzEwN2VjNmEzNmEwYzc1NjIyOTYxODZkZmFjMzdiMjI2ZDczOWYyMjlkZmU1M2RkNzp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdyayZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1zcG90aWZ5X29wZXJhIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTEiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzg1MjkxNzA1LjA4MzMiLCJ1c2VyYWdlbnQiOiJPcGVyYSBJbnN0YWxsZXIvMS4wIiwidXRtIjp7ImNhbXBhaWduIjoic3BvdGlmeV9vcGVyYSIsIm1lZGl1bSI6InBiIiwic291cmNlIjoid3JrIn0sInV1aWQiOiJlYzdkMWZmMC1mMWM4LTQ3NzEtYmNkNS02YzEwNGM1MDkyMTEifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=C807000000000000
      4⤵
      Executes dropped EXE
      Enumerates connected drives
      Enumerates system info in registry
      Suspicious use of WriteProcessMemory
      PID:1348
    - - C:\Users\Admin\AppData\Local\Temp\7zS49509D89\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS49509D89\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=133.0.5932.85 --initial-client-data=0x2a4,0x2a8,0x2ac,0x280,0x2b0,0x7ff79ad4ad88,0x7ff79ad4ad94,0x7ff79ad4ada0
        5⤵
        Executes dropped EXE
        
        PID:4772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 1KB
SHA256 63b14543360f5e89942ea8d5113526e64fbc71c1207328f0136b3a495d921dd0
MD5 adac67e1d2da2d706db151c2db316b2d
SHA1 5f6e301d23e33132209707945d0e740d5bcb8996
SHA512 9371b62ac25c6ea8fb6fca19ac47b873ced9b3d0cb45ce4de5ea974b93c12684c65aa23c7d83331c77502853258a08dff73ce5e3fb6170bd3ab1c5b3283a86a9
TLSH
T1DE31AD4EA2153027D5427F72D8CEBE83CEB1364667CAD46B18046E4229AAFC25FC80C9
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
Size 528B
SHA256 d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
MD5 047f3e9d21d6b325d592b1959e4362e6
SHA1 5aeef5f985171cd69da397fd039854e44ebecdd2
SHA512 4523896ed4a03afafd2075d8c8947236d34fe1da2c246a3f90c2be2a5c151c18bc58a6cde5a209abb8e06e80f662e24d0149640b3e98e8a872bfa8a04ef592a4
TLSH
T147F0500990082252C855FF55DFD6AC97DC76336136E595036D458E410C12F96AF950F5
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
Size 471B
SHA256 298978175f1f793a33ff66538230bab2707c97edb443fa23dd4483178d7aeb32
MD5 bf6e5e1438241f5985fc7e8afa000762
SHA1 e0c1485cb3eb46a44e1801f0953279c7e8a567dd
SHA512 f799756711ade256624625202603fb4fe69eaaae7d2b0e359c2c99ad66fdd799635420160b2b49da6637e716c4060a80fdbbef322d2ffbeefe0627dec9f74c5f
TLSH
T17EF0D44905BDA8606715D4DC18D428363821506D54653455B05D45F494256FB2F31497
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 174B
SHA256 2b71fe6bd4673fe20f81030d468c4d4824d04fd6f7cf75e9122645661ef7f3d5
MD5 51a580eb6e77f60b87d63e5dac45a97b
SHA1 b8fcb25813f33bcd70efe5b905c61f97b9dd82a1
SHA512 e061924d53244cbcdedf0b9956d646240165d17d61dcc09c18114361f51764b7c9d8fca595f22bbd4286d47b4907fd8989c890859e02de1e7731791486e15695
TLSH
T101C09B4437B54595F2304D7F1653531147FAE705CD4183540F705259D55DB525CF5D06
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Size 170B
SHA256 d0f205607fd483a6fce254f5e1aad715a556791d3f00d61498299b1410a84c3b
MD5 8738243deaf6ad9c5e11bb6b7f0c7493
SHA1 b64f4d90c5ccb1f349a2e5a36f7ed7cf48c50ab7
SHA512 5e6ae9f2ce1130c400d1dda3b34082eaf5b8296672788afe2534a35e12be41becf2740eaec97b8a8c335bcb257c61f617702cee2eb93d0c73d9c4950bb1a1412
TLSH
T1CCC09254B3A98B5AF10E213E79E61B042BBA824AF6CAC3444BB811789968A4008B2D09
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
Size 416B
SHA256 8db9524329e68c202d426a97ca1aa8f1ed106eecb39836ba88d4a3623f845134
MD5 da973217fe926d3c8c4a170b5afaf0b1
SHA1 e17c65652a982b036da73c38359af07f855541d1
SHA512 cf44a72359abe0e59afa02d9ea4098c8cf0343f7912df884f8968d4cb51c32d1e2a16c8603b5c1825c26ac41776745bbe7c3b923196b21dc7fbc29d82544713c
TLSH
T128E0C03465F7406EF1F4D0745BD5B9310D66F026041D93B01BE527047606D00FE93A34
MD5 SHA1 SHA512 TLSH

Submit Download

installer.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS49509D89\installer.exe
Size 8.3MB
SHA256 3a849bcab0ee94873a4cd5d14906cfcd242257b5f23c1029fe901d6b902fcfa5
MD5 18348621dc86f326e834d517fe797d08
SHA1 d784448ad64b8156288c1d2d4480145781fcfb11
SHA512 83c5faba185d93601100f97de67e913c3b0ea6b2cffc76a0da7c274f585730e022ceca73d23b8f180ad11899a1c60ec10af203892e0be0301b0287e2a96918c0
SSDEEP 98304:k/06Gb0nq73PcI/Ztlg1RbdsuJXMZ+sUYNY8AF4:S03b0o3x/zwVC+NXF4
TLSH
T1EE967C53F2E601F8D06FDA748B7A5232A9357C464B35A2EF0A9436251E71FD46B3CB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OpInst.exe

Path C:\Users\Admin\AppData\Local\Temp\OpInst.exe
Size 3.1MB
SHA256 7f93a4fe7ea06d1cb79351e423efd7f96acc78f9e1bedb7e5b2e2c8d19146dca
MD5 9e7d9795a1e2ac987fc3b2ae8155d003
SHA1 c3e001426a1bcbd49cac85e4fec102a46dbb590f
SHA512 7a8f496d9a758e434947cb974ddb700ef9c382f558a44deed698ff24c955beef8899cb48061adca1afdc6939a36333376bf24b6d89158bc9ed0d8170b4852433
SSDEEP 98304:vA1p2uPKsuXudDjsnDdOlPmZr4JFTxe6HRn5CoZhx:OpI8cDdOcUj9xb9
TLSH
T191E5232277C0C874C62321335F1DFFA8A5BDBC601E62964B77886A6E8FB0581D635F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.png

Path C:\Users\Admin\AppData\Local\Temp\bg.png
Size 224KB
SHA256 5fa976ea5780439175bb696817cd6eab3625ba5ccfe5b220587130ed5e1da855
MD5 21eb6b8232802f32b6483eedb96677bb
SHA1 b390f01600e521586e210936a4b57a6b89e66a7b
SHA512 5cfcb0278e5e7473dde396ee34115a3f50a9ad195d99b53cc5cc33a169a42c8f729806491fc0fb607719139081fa3c774c37b1638de1289b73c0c4c80768cfcd
SSDEEP 3072:7MuA+f6FJxlUhyLg2cugpbM5Q+jBre6cAJqmm6nkrw8sGaDy7y8bRzUnKdh8BfM9:7MuAWojcVdGSf+4BML49RzUnKUuLZ
TLSH
T1E92423876BC391F4590BD65FE9386BEC3CD4E7EC82AB113C931A42424D8416B85DE8F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
Size 40B
SHA256 c9fd544c47559f0f018ee88df754a0a25f8e4b28da3f77a14ad3756fa74947e4
MD5 2177a8006fb5acc6b07ef91ae0b072fd
SHA1 4772bdc88adc34f26f584b81af28c2f6fee31a75
SHA512 89372e68b5cbda43363231ca0daea0724dc09353008545bdf7b35716b2dcbea42d0b3f5adcb1d9f48cd14fe0f8f2071139bc36ff7d22e01310f7a45681f1261c
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads