82d26bac8be0c7528fcaa32097592723593d63608e11bf6ed3b1836575b6a615

General

Target
OperaGXSetup.exe
Size 3.9MB
Sample260808-v8trssef98
SHA256 82d26bac8be0c7528fcaa32097592723593d63608e11bf6ed3b1836575b6a615
MD5 e9af8ba0fdd274ccd0e100860d7fc58a
SHA1 5335331d803b501ff3119b9f6e5dae843e766c58
SHA512 61546c49d7d5aab4a1b6aaca1b15cb4606074e71f288694ed94fc404f917ece33bf198dcb3565d8736e04a73321bcf52f0d36fd5aaabb052741038a7ad817efa
SSDEEP 98304:sAb040qivICiDQ9ZE17YyTl38lMEXxuKGDe5+alZIA:97ivIrk9ZE+yB38lMNDJalV
TLSH
T163163332BB81D4B2E67322320FA9F22956BDF1604E3A019F23D44F5E8E70691E634F55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4144	installer.exe
3868	installer.exe
4116	installer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	installer.exe
File opened (read-only)	\??\F:	installer.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaGXSetup.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4144	installer.exe
4144	installer.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 4144	2784	OperaGXSetup.exe	89
PID 4144 wrote to memory of 3868	4144	installer.exe	90
PID 4144 wrote to memory of 4116	4144	installer.exe	91

C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
"C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Users\Admin\AppData\Local\Temp\7zS0EAC6649\installer.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0EAC6649\installer.exe --server-tracking-blob=ZTk3MTc0YjFhZmFlNDUxNWJkNTJhYzA5OWNmMmYzYzliMGVkNmJlYzQzZjE2OWFmY2E2MmI2M2U2NzlmNmNjYTp7ImNvdW50cnkiOiJVUyIsImZhc3Rfb25ib2FyZGluZyI6e30sImh0dHBfcmVmZXJyZXIiOiJodHRwczovL3d3dy5vcGVyYS5jb20vIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYUdYU2V0dXAuZXhlIiwicHJvZHVjdCI6Im9wZXJhX2d4IiwicXVlcnkiOiIvb3BlcmFfZ3gvc3RhYmxlL3dpbmRvd3M/dXRtX3NvdXJjZT1yb2Jsb3hfZ2FtZV9zbGFwX2JhdHRsZXMmdXRtX21lZGl1bT1wZCZ1dG1fY2FtcGFpZ249c2xhcC1iYXR0bGVzXzEmaHR0cF9yZWZlcnJlcj1odHRwcyUzQSUyRiUyRnd3dy5vcGVyYS5jb20lMkZneCUyRnJvYmxveCUyRnNsYXAtYmF0dGxlcyUzRnV0bV9tZWRpdW0lM0RwZCUyNnV0bV9zb3VyY2UlM0Ryb2Jsb3hfZ2FtZV9zbGFwX2JhdHRsZXMlMjZ1dG1fY2FtcGFpZ24lM0RzbGFwLWJhdHRsZXNfMSZ1dG1fc2l0ZT1vcGVyYV9jb20mdXRtX2xhc3RwYWdlPW9wZXJhLmNvbSUyRmd4JTJGcm9ibG94JTJGc2xhcC1iYXR0bGVzJmRsX3Rva2VuPTI4MzA3NTQ5IiwidGltZXN0YW1wIjoiMTc4NjIxMDc3OC43OTU3IiwidXNlcmFnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzE1MS4wLjAuMCBTYWZhcmkvNTM3LjM2IEVkZy8xNTEuMC4wLjAiLCJ1dG0iOnsiY2FtcGFpZ24iOiJzbGFwLWJhdHRsZXNfMSIsImxhc3RwYWdlIjoib3BlcmEuY29tL2d4L3JvYmxveC9zbGFwLWJhdHRsZXMiLCJtZWRpdW0iOiJwZCIsInNpdGUiOiJvcGVyYV9jb20iLCJzb3VyY2UiOiJyb2Jsb3hfZ2FtZV9zbGFwX2JhdHRsZXMifSwidXVpZCI6IjY1NzFmMjg1LWY2MzAtNDhkNy05MTdkLWI4NTUwY2ZiNDE4MCJ9
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Enumerates system info in registry
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4144
- - C:\Users\Admin\AppData\Local\Temp\7zS0EAC6649\installer.exe
    C:\Users\Admin\AppData\Local\Temp\7zS0EAC6649\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=134.0.5954.44 --initial-client-data=0x2a0,0x2a4,0x2a8,0x27c,0x2ac,0x7ff61521bd88,0x7ff61521bd94,0x7ff61521bda0
    3⤵
    - Executes dropped EXE
    PID:3868
- - C:\Users\Admin\AppData\Local\Temp\.opera\bf4d0d77-c26a-4c90-b76c-e92994e7b6cd Opera GX Installer Temp\installer.exe
    "C:\Users\Admin\AppData\Local\Temp\.opera\bf4d0d77-c26a-4c90-b76c-e92994e7b6cd Opera GX Installer Temp\installer.exe" --version
    3⤵
    - Executes dropped EXE
    PID:4116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

installer.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS0EAC6649\installer.exe
Size 9.1MB
SHA256 b7c6b1b417864b64d5395c287a819398038b27290db3f85bf89c770a81a4cc5a
MD5 b890777cef0d6e691b43c16380c166cf
SHA1 996815781aaf54175f81acbf083daa7ebc3a5170
SHA512 4e1d4b62732810f76f5d5618493c2115cecd5fc9c6792f60ee695558a569c5f1ff2b9498d03bb204f20833601c865b27a562d414cdbf427a65b5b996b525ca14
SSDEEP 98304:AwzgYsHxSMQzFdZJ2spXK8/Dd9c7zjFBI3++wteEmQ:HgYsRSMQzTgc3+BqQ
TLSH
T1F8A68D53F3AA01E8D06FCA748B7A523299757C464B30A3DF0A943A251E75ED49F3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3868-19-0x000001DA9C650000-0x000001DA9C891000-memory.dmp

Download

memory/4116-11-0x00000228439B0000-0x0000022843BF1000-memory.dmp

Download

memory/4144-18-0x00000212F7C90000-0x00000212F7ED1000-memory.dmp

Download

memory/4144-26-0x00000212F7C90000-0x00000212F7ED1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads