20b545c7b0b0cb56926972b7fc2a94f428b7aa3e4f9f4e65d1bd0ad800fb60b7

Analysis

user interaction
yes
max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 18:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OperaInstaller.exe
Size 178KB
Sample260804-wmtqcabl6v
SHA256 20b545c7b0b0cb56926972b7fc2a94f428b7aa3e4f9f4e65d1bd0ad800fb60b7
MD5 4ef32b114eaa6f05340b46d0f48154c7
SHA1 a07219dc2a0fa96f5f9a03b1bb350c9ab2679d3f
SHA512 6631937f30fcfdc536bd14735870c9c4592f4414e9c1d71ec69c718bf341ff286174b782c6a23a6c29744be940bcac34aa93845e60727e090bee8423d738ea9d
SSDEEP 3072:IYHHEa1Lz5KhEwh5kc9+5sFoq0X/r6LGV4RxJ0OZnS+Rl//bRRlTHGVJp99vqRy:IYEwP5KhVyc9esFoBvum4RvGJTEy
TLSH
T1EB046B823AC184B5E5B244321864DBB19A7DFC700F65D9DB73987A3B5DB02C09932F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
69	2076	installer.exe
20	5096	OperaInstaller.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	OperaInstaller.exe

Executes dropped EXE 9 IoCs

pid	Process
5104	OpInst.exe
2076	installer.exe
4800	installer.exe
3580	installer.exe
2200	installer.exe
2052	installer.exe
1052	Assistant_130.0.5847.41_Setup.exe_sfx.exe
2472	assistant_installer.exe
3740	assistant_installer.exe

Loads dropped DLL 4 IoCs

pid	Process
2472	assistant_installer.exe
2472	assistant_installer.exe
3740	assistant_installer.exe
3740	assistant_installer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	installer.exe
File opened (read-only)	\??\F:	installer.exe
File opened (read-only)	\??\D:	installer.exe
File opened (read-only)	\??\F:	installer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OpInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Assistant_130.0.5847.41_Setup.exe_sfx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	assistant_installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe

Modifies system certificate store 2 TTPs 5 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4	installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b90f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e404000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c00000001000000040000000010000004000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	installer.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 5104	5096	OperaInstaller.exe	86
PID 5104 wrote to memory of 2076	5104	OpInst.exe	88
PID 2076 wrote to memory of 4800	2076	installer.exe	89
PID 2076 wrote to memory of 3580	2076	installer.exe	90
PID 2076 wrote to memory of 2200	2076	installer.exe	94
PID 2200 wrote to memory of 2052	2200	installer.exe	95
PID 2076 wrote to memory of 1052	2076	installer.exe	101
PID 2076 wrote to memory of 2472	2076	installer.exe	102
PID 2472 wrote to memory of 3740	2472	assistant_installer.exe	103

C:\Users\Admin\AppData\Local\Temp\OperaInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\OperaInstaller.exe"
1⤵
- Downloads MZ/PE file
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Users\Admin\AppData\Local\Temp\OpInst.exe
  "C:\Users\Admin\AppData\Local\Temp\OpInst.exe" --silent --allusers=0 --setdefaultbrowser=1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5104
- - C:\Users\Admin\AppData\Local\Temp\7zS0F3F2688\installer.exe
    C:\Users\Admin\AppData\Local\Temp\7zS0F3F2688\installer.exe --silent --allusers=0 --setdefaultbrowser=1 --server-tracking-blob=M2EzZmNhZDQ5Y2QyYjNkZjVkMzkwYmYwMGFhNDUyNjgwNTM5ZWQxMDhkYjExNTAwNjgxNzNhZjNmZTdiNDRhYTp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdyayZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1zcG90aWZ5X29wZXJhIiwidGltZXN0YW1wIjoiMTc4NTg2NjU4OS4xMTQ3IiwidXNlcmFnZW50IjoiT3BlcmEgSW5zdGFsbGVyLzEuMCIsInV0bSI6eyJjYW1wYWlnbiI6InNwb3RpZnlfb3BlcmEiLCJtZWRpdW0iOiJwYiIsInNvdXJjZSI6IndyayJ9LCJ1dWlkIjoiMTlkNDJlMzYtMzkzMy00Mzc0LWEwNTItZWUxZGRhN2Y0NDNjIn0=
    3⤵
    - Downloads MZ/PE file
    - Executes dropped EXE
    - Enumerates connected drives
    - Enumerates system info in registry
    - Modifies system certificate store
    - Suspicious use of WriteProcessMemory
    PID:2076
  - - C:\Users\Admin\AppData\Local\Temp\7zS0F3F2688\installer.exe
      C:\Users\Admin\AppData\Local\Temp\7zS0F3F2688\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=134.0.5954.26 --initial-client-data=0x288,0x28c,0x290,0x264,0x294,0x7ff601769d88,0x7ff601769d94,0x7ff601769da0
      4⤵
      Executes dropped EXE
      PID:4800
  - - C:\Users\Admin\AppData\Local\Temp\.opera\356d407d-eec3-4d25-ac4f-b60cd0afa063 Opera Installer Temp\installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\356d407d-eec3-4d25-ac4f-b60cd0afa063 Opera Installer Temp\installer.exe" --version
      4⤵
      Executes dropped EXE
      PID:3580
  - - C:\Users\Admin\AppData\Local\Temp\7zS0F3F2688\installer.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS0F3F2688\installer.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=2076 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\356d407d-eec3-4d25-ac4f-b60cd0afa063 Opera Installer Temp\opera_package_20260804190312" --session-guid=d6f0d74a-bfd8-4c35-8908-bf88f8417bb1 --server-tracking-blob=ZWFlZGYzNmFhZTFjNzI4NjQwYjRhYWEzNDdhMjg5OGI3MTM3Y2E3NmU2NzAxYWFhMDM0OTE0ZGMyMjljNjdhZTp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdyayZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1zcG90aWZ5X29wZXJhIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzg1ODY2NTg5LjExNDciLCJ1c2VyYWdlbnQiOiJPcGVyYSBJbnN0YWxsZXIvMS4wIiwidXRtIjp7ImNhbXBhaWduIjoic3BvdGlmeV9vcGVyYSIsIm1lZGl1bSI6InBiIiwic291cmNlIjoid3JrIn0sInV1aWQiOiIxOWQ0MmUzNi0zOTMzLTQzNzQtYTA1Mi1lZTFkZGE3ZjQ0M2MifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=5C07000000000000
      4⤵
      Executes dropped EXE
      Enumerates connected drives
      Enumerates system info in registry
      Suspicious use of WriteProcessMemory
      PID:2200
    - - C:\Users\Admin\AppData\Local\Temp\7zS0F3F2688\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS0F3F2688\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=134.0.5954.26 --initial-client-data=0x29c,0x2a0,0x2a4,0x26c,0x2a8,0x7ff601769d88,0x7ff601769d94,0x7ff601769da0
        5⤵
        Executes dropped EXE
        
        PID:2052
  - - C:\Users\Admin\AppData\Local\Temp\.opera\356d407d-eec3-4d25-ac4f-b60cd0afa063 Opera Installer Temp\opera_package_202608041903121\assistant\Assistant_130.0.5847.41_Setup.exe_sfx.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\356d407d-eec3-4d25-ac4f-b60cd0afa063 Opera Installer Temp\opera_package_202608041903121\assistant\Assistant_130.0.5847.41_Setup.exe_sfx.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1052
  - - C:\Users\Admin\AppData\Local\Temp\.opera\356d407d-eec3-4d25-ac4f-b60cd0afa063 Opera Installer Temp\opera_package_202608041903121\assistant\assistant_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\356d407d-eec3-4d25-ac4f-b60cd0afa063 Opera Installer Temp\opera_package_202608041903121\assistant\assistant_installer.exe" --version
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Enumerates system info in registry
      Suspicious use of WriteProcessMemory
      PID:2472
    - - C:\Users\Admin\AppData\Local\Temp\.opera\356d407d-eec3-4d25-ac4f-b60cd0afa063 Opera Installer Temp\opera_package_202608041903121\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\356d407d-eec3-4d25-ac4f-b60cd0afa063 Opera Installer Temp\opera_package_202608041903121\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=130.0.5847.41 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x364040,0x36404c,0x364058
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:3740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
Size 471B
SHA256 cba55116b1cabdcf56cabb9ddfda1ac7eb27d06cfe0dedc07cad410490dbca1b
MD5 99f8c638a89cbc2cd8fc0226654c728f
SHA1 625250b1c58af5a9e29d206bc20f4a0bc5e35375
SHA512 d34f4068fbdd03eb3eb5e77f8f5f9e133aa5bed2b8ed7f6f158c6b0c7dff38031ecad83ec11f4080b603e6e308e3cfbac17ab31e820b7b670088fc57e4532645
TLSH
T192F0D4D148FCF9702F01C4CC12D0CE763814C199D555994DF41C95FE81565D06D2643A
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
Size 416B
SHA256 0d12ada09320d2db97eaa211e26e79950934db9994062e29ca7b2a595584b237
MD5 f67dd61bd69c67e355dda056b7e4066f
SHA1 652688bbb5a0d8d0548ef1cf3d3e32b7ea3bb32e
SHA512 3b80617f4e65203eed879fd110eded0b3b377b3cb504d332677c11391603b785ce790cab837fbaae0c05895d877677c44bf84f57f25da1a024ac3a7290338336
TLSH
T155E0C02421FB017EF4F4F0B44FD9B5360A46F0260428D2F00BE457087642E00AF12B35
MD5 SHA1 SHA512 TLSH

Submit Download

additional_file0.tmp

Path C:\Users\Admin\AppData\Local\Temp\.opera\356d407d-eec3-4d25-ac4f-b60cd0afa063 Opera Installer Temp\opera_package_202608041903121\additional_file0.tmp
Size 2.8MB
SHA256 71a4cc628fd1716fd994689c4808d2ebbc00e8bd2ecb7600b9921baa8916c752
MD5 3b028b1188ac321e66add16f8ebadbec
SHA1 086bcb2b1c0d300be15c1390841aadadcec4eac7
SHA512 17c390e0df8e29ff9ad43e581db298ada2d8378fbb890dc5f4b17df8fbe21134f99ab203ea4752a419215d289c128a1d8bc14721bde80042e5bb4c3901dffb72
SSDEEP 49152:+kinoIZOrzV7AlDfo7eT/uAtH00raHx774jx4aGhcr0glyGIGE1HVyVNW272DS/Z:+kiocQzV89Tmeradk2ha0gdIT11yVQ2w
TLSH
T167D5233275A48C34D62312321CE0FAEDA5BE72701E6347DB73A42B1F9EB01979A1D562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

assistant_installer.exe

Path C:\Users\Admin\AppData\Local\Temp\.opera\356d407d-eec3-4d25-ac4f-b60cd0afa063 Opera Installer Temp\opera_package_202608041903121\assistant\assistant_installer.exe
Size 2.4MB
SHA256 63187b388e01fb05d8c29957e1c566324af67aff2f7a2e3da9132248c79375a8
MD5 b0408fa2a406f483e42c3ac102d35e9b
SHA1 fbaca900ad54abc65ec2cb34d63727c87132d16b
SHA512 2e8b9af626fff68ecd0204d6a3151b4518749143ec78a2f8f99f959399d1c8ea59987f99c38c9e48fe38b518fd8c91381356daf3f17944fa3432337b882e5401
SSDEEP 49152:wJv8lBbu91xwyiZSwRDzWEibQojjHLQDpizF:wR8lBbu91xwyiZSwRWEKQWjHLOpc
TLSH
T10AC5AE12A86094B5D8563132321DEB3E9A30BE1657354DDBDB90BCC1BBB86E2353734B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbgcore.DLL

Path C:\Users\Admin\AppData\Local\Temp\.opera\356d407d-eec3-4d25-ac4f-b60cd0afa063 Opera Installer Temp\opera_package_202608041903121\assistant\dbgcore.DLL
Size 222KB
SHA256 7bb46348c2ec97ef9ee7a8e0ae28c8e069513e8acaee2689134a2d906b5fdecf
MD5 b26ebc5cde9b1726ee9f9534dd6107d0
SHA1 de00af3ec4de63a158bcd50c6e95b046669d3353
SHA512 2e01c65b58369c1f5f4081cf377c3fedd87ae5fca63cfbc44dd7859a1e10a849d1bbdbb592349d793166f577dbd954cd8660f625dcbc9adc4d936d6a44f062bf
SSDEEP 6144:FASh0NdOEQzFh0ekr6nzwBaQGdppLIg2dFl96Fl:4MHZn1n+P96Fl
TLSH
T14C247C2269401533DCEF12F062AF363A96AEDD90239490C359A05BDDD6D4BC12E3D6EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbghelp.dll

Path C:\Users\Admin\AppData\Local\Temp\.opera\356d407d-eec3-4d25-ac4f-b60cd0afa063 Opera Installer Temp\opera_package_202608041903121\assistant\dbghelp.dll
Size 1.8MB
SHA256 6fd2b4bfc275ed306ce09008ff8437818b3373e69e4b3db3cbb79be91b2b9308
MD5 021b11c0fc1a09e49a2046ef07d1747a
SHA1 4b955c1e7150db4f07528929fc529fde9738a2b3
SHA512 6ca94fdf2b92928859152aa23f31df46944eeeac7988f6bb5d647341843d8d2aa91c2c810d17c8b58a03c99e4ca7d7e1ae6b6c2d9ea5029616d870b89794d6c8
SSDEEP 49152:xEDlXSohR86M5NKBlv/2yOFVnzM9F0KM7:uFhR86MHyl0fb
TLSH
T128856B20E784813CE4EA1177E67C7A7D85ADE524073440CBAAC45BA978297D32F387DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS0F3F2688\installer.exe
Size 8.3MB
SHA256 49d33a257c47d2e32cbb967ef1c088c0ff5d71ced60950d902c9aa82311e306c
MD5 d9534337f6a0f2c96b59dc571e694474
SHA1 6e706ab155031e936ff35eff549d51b815c4de5b
SHA512 becf6953874c49d217482a211ed9fd50e3075506390d4f1c33ea88665fe529f4c8e9fbad6057dc63f3ec546171886f98de6ce8ba13b906b96a9ffce012c846fb
SSDEEP 98304:ZhLx1oEDfLTV7fi0obDaW6oTTOFO7g53QxheYNY8AFk:jLx1oKLTV7fYeDQxgXFk
TLSH
T1D9967C53F2A601E8D06FCA748B7A5232A9757C465B30A3EF0A943A251E75FD45F3CB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OpInst.exe

Path C:\Users\Admin\AppData\Local\Temp\OpInst.exe
Size 3.1MB
SHA256 47adf8acfa1ef801208210d3d0cfcfa73e670f9a99721aabe7fbe514552d17c8
MD5 499168a7e12b35b2d7e8013598cd8f02
SHA1 9cefd11cce7427d14b455a9f91c32a586c853581
SHA512 f768be6570f08fb768562439d963ae08fe40bfca87c3367c7b08aa3c6676559a2e6de083e7e8ce70c8e666979324c23cacff1c399a1be1db3d138aab626c9325
SSDEEP 49152:QVAbwtDkQC3x3XyayaN+KYUkAjHMZ/buhf0R8sx/ggeOV2MsAwZu8DbALMKMeVP6:8AYgh3XyFaN+QiOy/ggJl3w0PLTL+r
TLSH
T1D2E5231237448475C67312320F15E7A8A5BDF9652F72878733A47A5FCEF0582EA26B0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.png

Path C:\Users\Admin\AppData\Local\Temp\bg.png
Size 224KB
SHA256 5fa976ea5780439175bb696817cd6eab3625ba5ccfe5b220587130ed5e1da855
MD5 21eb6b8232802f32b6483eedb96677bb
SHA1 b390f01600e521586e210936a4b57a6b89e66a7b
SHA512 5cfcb0278e5e7473dde396ee34115a3f50a9ad195d99b53cc5cc33a169a42c8f729806491fc0fb607719139081fa3c774c37b1638de1289b73c0c4c80768cfcd
SSDEEP 3072:7MuA+f6FJxlUhyLg2cugpbM5Q+jBre6cAJqmm6nkrw8sGaDy7y8bRzUnKdh8BfM9:7MuAWojcVdGSf+4BML49RzUnKUuLZ
TLSH
T1E92423876BC391F4590BD65FE9386BEC3CD4E7EC82AB113C931A42424D8416B85DE8F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
Size 40B
SHA256 b511c0d1f7f0388e5566966729bad8104a596402422733025c17b7eb38adb32f
MD5 399d9f207988686cc686f665402d800c
SHA1 10c56dd35aabae28a859abd80645f4d73c5fdd2f
SHA512 575c99efe1610e5dd75e330e6297e155eb833733b3242c331c6b8acfd768ebd012ffc6d70df4cf87716c46b9eac560c6ba1d88663cb4205d2d7e3744d8bf705f
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads