20b545c7b0b0cb56926972b7fc2a94f428b7aa3e4f9f4e65d1bd0ad800fb60b7

General

Target
OperaInstaller.exe
Size 178KB
Sample260804-wmtqcabl6v
SHA256 20b545c7b0b0cb56926972b7fc2a94f428b7aa3e4f9f4e65d1bd0ad800fb60b7
MD5 4ef32b114eaa6f05340b46d0f48154c7
SHA1 a07219dc2a0fa96f5f9a03b1bb350c9ab2679d3f
SHA512 6631937f30fcfdc536bd14735870c9c4592f4414e9c1d71ec69c718bf341ff286174b782c6a23a6c29744be940bcac34aa93845e60727e090bee8423d738ea9d
SSDEEP 3072:IYHHEa1Lz5KhEwh5kc9+5sFoq0X/r6LGV4RxJ0OZnS+Rl//bRRlTHGVJp99vqRy:IYEwP5KhVyc9esFoBvum4RvGJTEy
TLSH
T1EB046B823AC184B5E5B244321864DBB19A7DFC700F65D9DB73987A3B5DB02C09932F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
11	5900	OperaInstaller.exe

Executes dropped EXE 6 IoCs

pid	Process
5172	OpInst.exe
2008	installer.exe
2388	installer.exe
2320	installer.exe
1836	installer.exe
5636	installer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	installer.exe
File opened (read-only)	\??\E:	installer.exe
File opened (read-only)	\??\F:	installer.exe
File opened (read-only)	\??\E:	installer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OpInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaInstaller.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5900 wrote to memory of 5172	5900	OperaInstaller.exe	90
PID 5172 wrote to memory of 2008	5172	OpInst.exe	91
PID 2008 wrote to memory of 2388	2008	installer.exe	92
PID 2008 wrote to memory of 2320	2008	installer.exe	93
PID 2008 wrote to memory of 1836	2008	installer.exe	94
PID 1836 wrote to memory of 5636	1836	installer.exe	95

C:\Users\Admin\AppData\Local\Temp\OperaInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\OperaInstaller.exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5900
- C:\Users\Admin\AppData\Local\Temp\OpInst.exe
  "C:\Users\Admin\AppData\Local\Temp\OpInst.exe" --silent --allusers=0 --setdefaultbrowser=1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5172
- - C:\Users\Admin\AppData\Local\Temp\7zS4342945A\installer.exe
    C:\Users\Admin\AppData\Local\Temp\7zS4342945A\installer.exe --silent --allusers=0 --setdefaultbrowser=1 --server-tracking-blob=ZTJmMDhmZWZkMmM5YWFjYTBhYzE5MGRjMTc0NzE0YWJlNWRhNjkxNDBlY2JiMjM2OWVlNGQ5NjUxMTgzNzY4Mzp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdyayZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1zcG90aWZ5X29wZXJhIiwidGltZXN0YW1wIjoiMTc4NTg2NjYxMi4xMjk4IiwidXNlcmFnZW50IjoiT3BlcmEgSW5zdGFsbGVyLzEuMCIsInV0bSI6eyJjYW1wYWlnbiI6InNwb3RpZnlfb3BlcmEiLCJtZWRpdW0iOiJwYiIsInNvdXJjZSI6IndyayJ9LCJ1dWlkIjoiOGQyOGUzODctZDQwNi00MWJhLThlYWMtMDYyYzczNmE4Yjg1In0=
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:2008
  - - C:\Users\Admin\AppData\Local\Temp\7zS4342945A\installer.exe
      C:\Users\Admin\AppData\Local\Temp\7zS4342945A\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=134.0.5954.26 --initial-client-data=0x2ac,0x2b0,0x2b4,0x288,0x2b8,0x7ff774fb9d88,0x7ff774fb9d94,0x7ff774fb9da0
      4⤵
      Executes dropped EXE
      PID:2388
  - - C:\Users\Admin\AppData\Local\Temp\.opera\8fe1ce86-f79f-4389-81bd-b32b425d9275 Opera Installer Temp\installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\8fe1ce86-f79f-4389-81bd-b32b425d9275 Opera Installer Temp\installer.exe" --version
      4⤵
      Executes dropped EXE
      PID:2320
  - - C:\Users\Admin\AppData\Local\Temp\7zS4342945A\installer.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS4342945A\installer.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=2008 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\8fe1ce86-f79f-4389-81bd-b32b425d9275 Opera Installer Temp\opera_package_20260804190334" --session-guid=37be7690-ea83-48cd-81a1-94337ff52be1 --server-tracking-blob=ZDhkZWVjZWU1M2I0NGUyNTkxYjUzNzExNTYwMDJkZjViNTUyNTU1NTI5NTAwNDBiYmQ5MGNiNWJlNDE0NjI0NTp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdyayZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1zcG90aWZ5X29wZXJhIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTEiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzg1ODY2NjEyLjEyOTgiLCJ1c2VyYWdlbnQiOiJPcGVyYSBJbnN0YWxsZXIvMS4wIiwidXRtIjp7ImNhbXBhaWduIjoic3BvdGlmeV9vcGVyYSIsIm1lZGl1bSI6InBiIiwic291cmNlIjoid3JrIn0sInV1aWQiOiI4ZDI4ZTM4Ny1kNDA2LTQxYmEtOGVhYy0wNjJjNzM2YThiODUifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=F407000000000000
      4⤵
      Executes dropped EXE
      Enumerates connected drives
      Enumerates system info in registry
      Suspicious use of WriteProcessMemory
      PID:1836
    - - C:\Users\Admin\AppData\Local\Temp\7zS4342945A\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4342945A\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=134.0.5954.26 --initial-client-data=0x2c0,0x2c4,0x2c8,0x290,0x2cc,0x7ff774fb9d88,0x7ff774fb9d94,0x7ff774fb9da0
        5⤵
        Executes dropped EXE
        
        PID:5636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
Size 471B
SHA256 cba55116b1cabdcf56cabb9ddfda1ac7eb27d06cfe0dedc07cad410490dbca1b
MD5 99f8c638a89cbc2cd8fc0226654c728f
SHA1 625250b1c58af5a9e29d206bc20f4a0bc5e35375
SHA512 d34f4068fbdd03eb3eb5e77f8f5f9e133aa5bed2b8ed7f6f158c6b0c7dff38031ecad83ec11f4080b603e6e308e3cfbac17ab31e820b7b670088fc57e4532645
TLSH
T192F0D4D148FCF9702F01C4CC12D0CE763814C199D555994DF41C95FE81565D06D2643A
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
Size 416B
SHA256 9175c2657c6d84454f92a9f177579319a67d5a166fc55f8d647e6bb86037acc8
MD5 7cb5dc438bedaec8c7a783e2d525f63f
SHA1 1e19f5a57113dcb9c9abc47a255f2545cd9ad5d3
SHA512 cd0ab5a235f3618fbbf97a569352c834015856afd35c520146e347f9644f8e777b51d1960f97fd38923e812aa5bd6ad6685135011fc621b8257a6e891278f0c3
TLSH
T18BE0C02411FB017EF4F5F4744FD9B53B094AF026042892F04BE457087602E00AE12B35
MD5 SHA1 SHA512 TLSH

Submit Download

installer.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS4342945A\installer.exe
Size 8.3MB
SHA256 49d33a257c47d2e32cbb967ef1c088c0ff5d71ced60950d902c9aa82311e306c
MD5 d9534337f6a0f2c96b59dc571e694474
SHA1 6e706ab155031e936ff35eff549d51b815c4de5b
SHA512 becf6953874c49d217482a211ed9fd50e3075506390d4f1c33ea88665fe529f4c8e9fbad6057dc63f3ec546171886f98de6ce8ba13b906b96a9ffce012c846fb
SSDEEP 98304:ZhLx1oEDfLTV7fi0obDaW6oTTOFO7g53QxheYNY8AFk:jLx1oKLTV7fYeDQxgXFk
TLSH
T1D9967C53F2A601E8D06FCA748B7A5232A9757C465B30A3EF0A943A251E75FD45F3CB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OpInst.exe

Path C:\Users\Admin\AppData\Local\Temp\OpInst.exe
Size 3.1MB
SHA256 d703480a848aa5863474a30b2b22b38688e3549eb392120315c197a2280f1c07
MD5 e5f285194f4457d57ea9099b923945bc
SHA1 0a9338e8af3f817f3f9096d10ab34cf6c017130b
SHA512 3d9ab5f8084bd45064fa1fb37173cacb09794b1e87518bfedd9838e8c355590d7d00985b202fe33bfdf13b1a98e5601652b6affb49c33ec7c608ff2c48a036bf
SSDEEP 49152:JVAbwtDkQC3x3XyayaN+KYUkAjHMZ/buhf0R8sx/ggeOV2MsAwZu8DbALMKMeVPk:/AYgh3XyFaN+QiOy/ggJl3w0PLTL+N
TLSH
T1A2E5231237448475C67312320F15E7A8A5BDF9652F72878733A47A5FCEF0582EA26B0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.png

Path C:\Users\Admin\AppData\Local\Temp\bg.png
Size 224KB
SHA256 5fa976ea5780439175bb696817cd6eab3625ba5ccfe5b220587130ed5e1da855
MD5 21eb6b8232802f32b6483eedb96677bb
SHA1 b390f01600e521586e210936a4b57a6b89e66a7b
SHA512 5cfcb0278e5e7473dde396ee34115a3f50a9ad195d99b53cc5cc33a169a42c8f729806491fc0fb607719139081fa3c774c37b1638de1289b73c0c4c80768cfcd
SSDEEP 3072:7MuA+f6FJxlUhyLg2cugpbM5Q+jBre6cAJqmm6nkrw8sGaDy7y8bRzUnKdh8BfM9:7MuAWojcVdGSf+4BML49RzUnKUuLZ
TLSH
T1E92423876BC391F4590BD65FE9386BEC3CD4E7EC82AB113C931A42424D8416B85DE8F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
Size 40B
SHA256 d25785264c4d42fdfcd92d18d71638e756642d97d9b0e0a4d9f83a5d5f09c306
MD5 8a0e35f2e4686f5af8179cef044e4538
SHA1 60e4a1189cf2cfc1431f0d764d499d358e517beb
SHA512 24565d3752ae498113e1ca32582d1df944bbd2611047dfccbd46309a335674c935ee3f11d0cdfa189a9248d4cba7d28d45b9b15f1b561c2f9f57b599f37747d9
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads