20b545c7b0b0cb56926972b7fc2a94f428b7aa3e4f9f4e65d1bd0ad800fb60b7

General

Target
OperaInstaller (2).exe
Size 178KB
Sample260809-gvrtdsha68
SHA256 20b545c7b0b0cb56926972b7fc2a94f428b7aa3e4f9f4e65d1bd0ad800fb60b7
MD5 4ef32b114eaa6f05340b46d0f48154c7
SHA1 a07219dc2a0fa96f5f9a03b1bb350c9ab2679d3f
SHA512 6631937f30fcfdc536bd14735870c9c4592f4414e9c1d71ec69c718bf341ff286174b782c6a23a6c29744be940bcac34aa93845e60727e090bee8423d738ea9d
SSDEEP 3072:IYHHEa1Lz5KhEwh5kc9+5sFoq0X/r6LGV4RxJ0OZnS+Rl//bRRlTHGVJp99vqRy:IYEwP5KhVyc9esFoBvum4RvGJTEy
TLSH
T1EB046B823AC184B5E5B244321864DBB19A7DFC700F65D9DB73987A3B5DB02C09932F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
77	3144	OperaInstaller (2).exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	OperaInstaller (2).exe

Executes dropped EXE 6 IoCs

pid	Process
1740	OpInst.exe
2032	installer.exe
2224	installer.exe
460	installer.exe
4548	installer.exe
216	installer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	installer.exe
File opened (read-only)	\??\D:	installer.exe
File opened (read-only)	\??\F:	installer.exe
File opened (read-only)	\??\D:	installer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaInstaller (2).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OpInst.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3144 wrote to memory of 1740	3144	OperaInstaller (2).exe	104
PID 1740 wrote to memory of 2032	1740	OpInst.exe	106
PID 2032 wrote to memory of 2224	2032	installer.exe	107
PID 2032 wrote to memory of 460	2032	installer.exe	108
PID 2032 wrote to memory of 4548	2032	installer.exe	109
PID 4548 wrote to memory of 216	4548	installer.exe	110

C:\Users\Admin\AppData\Local\Temp\OperaInstaller (2).exe
"C:\Users\Admin\AppData\Local\Temp\OperaInstaller (2).exe"
1⤵
- Downloads MZ/PE file
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Users\Admin\AppData\Local\Temp\OpInst.exe
  "C:\Users\Admin\AppData\Local\Temp\OpInst.exe" --silent --allusers=0 --setdefaultbrowser=1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\Users\Admin\AppData\Local\Temp\7zSCC6F80D9\installer.exe
    C:\Users\Admin\AppData\Local\Temp\7zSCC6F80D9\installer.exe --silent --allusers=0 --setdefaultbrowser=1 --server-tracking-blob=NDJkNWQ2ODEyM2NiNzhkMDQ3NjFhODY5ZDEzYTNhYTI3OWNhYjFiZTNiMDA1ODQ2MWVlOTQ5M2U0NWZjODEzNDp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdyayZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1zcG90aWZ5X29wZXJhIiwidGltZXN0YW1wIjoiMTc4NjI1NTc2NC45MjgwIiwidXNlcmFnZW50IjoiT3BlcmEgSW5zdGFsbGVyLzEuMCIsInV0bSI6eyJjYW1wYWlnbiI6InNwb3RpZnlfb3BlcmEiLCJtZWRpdW0iOiJwYiIsInNvdXJjZSI6IndyayJ9LCJ1dWlkIjoiNjZkYjI5YmEtYTVmNi00NTVlLWFjYzgtMjc3YWZjODFiMWY5In0=
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:2032
  - - C:\Users\Admin\AppData\Local\Temp\7zSCC6F80D9\installer.exe
      C:\Users\Admin\AppData\Local\Temp\7zSCC6F80D9\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=134.0.5954.46 --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x7ff63981ad88,0x7ff63981ad94,0x7ff63981ada0
      4⤵
      Executes dropped EXE
      PID:2224
  - - C:\Users\Admin\AppData\Local\Temp\.opera\ee794c6d-fc16-4ca4-9d61-b3494685bd5b Opera Installer Temp\installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\ee794c6d-fc16-4ca4-9d61-b3494685bd5b Opera Installer Temp\installer.exe" --version
      4⤵
      Executes dropped EXE
      PID:460
  - - C:\Users\Admin\AppData\Local\Temp\7zSCC6F80D9\installer.exe
      "C:\Users\Admin\AppData\Local\Temp\7zSCC6F80D9\installer.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=2032 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\ee794c6d-fc16-4ca4-9d61-b3494685bd5b Opera Installer Temp\opera_package_20260809070928" --session-guid=4073594c-cc10-4292-8d53-b68205a335d9 --server-tracking-blob=ZWI4NDBjZWEzODhmOTA4ZmVkYjY4ZjY4M2EwN2NjZjhiMTZlNDI5MGRkZTdkM2EyZGUyZWZkYzMyN2JmMDVjNjp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdyayZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1zcG90aWZ5X29wZXJhIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzg2MjU1NzY0LjkyODAiLCJ1c2VyYWdlbnQiOiJPcGVyYSBJbnN0YWxsZXIvMS4wIiwidXRtIjp7ImNhbXBhaWduIjoic3BvdGlmeV9vcGVyYSIsIm1lZGl1bSI6InBiIiwic291cmNlIjoid3JrIn0sInV1aWQiOiI2NmRiMjliYS1hNWY2LTQ1NWUtYWNjOC0yNzdhZmM4MWIxZjkifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=5808000000000000
      4⤵
      Executes dropped EXE
      Enumerates connected drives
      Enumerates system info in registry
      Suspicious use of WriteProcessMemory
      PID:4548
    - - C:\Users\Admin\AppData\Local\Temp\7zSCC6F80D9\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC6F80D9\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=134.0.5954.46 --initial-client-data=0x288,0x28c,0x29c,0x264,0x2a0,0x7ff63981ad88,0x7ff63981ad94,0x7ff63981ada0
        5⤵
        Executes dropped EXE
        
        PID:216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

4

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
Size 471B
SHA256 5ea73e46d4d2a45a24b689bd156e299ecf330317f54f087d1da238f060dc8ed2
MD5 b3da231c6d22b133cb9974e0b6927358
SHA1 30b6bf59f66bfb89b802cffe8e6f363d68b778b2
SHA512 28ec2ce730543f6d1b428d81c013926d72807f5897316f9c088ac1155f4e4cda5e084671d9806e2de8d2eea76c81ef3c1b119fd1727dd2448b5573827e2d67c6
TLSH
T1BEF0DCA268EEE8A56080C8AC25E145767816E02992A65142F01F04F08526AECAF3D536
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
Size 416B
SHA256 15254b36be8fd1223260c053004deec6f5dd8243f6d8cfd309e14734eaa31b16
MD5 14a045ffa2b463ed0fdeca900764927e
SHA1 5bc9ec9c78b32fd5bdcf8a5932cc39014d8102e9
SHA512 b88ea0a3196821726ab209a59e5f3ce1091f5fc786a6239b22669c197e15a7238de8ab804872af0c8960ded0328b5a8731f0c8f928b21f44c41e8d84c96ee386
TLSH
T1E6E0682515FA016EF2F4D4B44BDEA6310996F0260468A2B40BF057057603900AE12A34
MD5 SHA1 SHA512 TLSH

Submit Download

installer.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSCC6F80D9\installer.exe
Size 8.3MB
SHA256 c2a6825b895b245bab9774e69a450a11a4352eafa8d4da5fdad0e81341d4e67e
MD5 9dbf6590b693218b7ef20ae8de7eef6f
SHA1 6d8a4f3e48bbeab782da7166a8700bc35ad39416
SHA512 ebe898c89ec43db14a2744078941647737350cc27bb515fa83713e372576c0ce77e5ede72b227d2dfc369bca1c6244b3ceca5ee443259023c05d636ba81f8147
SSDEEP 98304:2h6i+ubH0SElWmLmgm3yrglOgw+Mne2ZQYNY8AFH:Ti+ubH0SElWEZmXFH
TLSH
T1EF967C53F2A601E8D06FCA748B7A523299757C464B31A3EF0A943A251E75FD46F3CB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OpInst.exe

Path C:\Users\Admin\AppData\Local\Temp\OpInst.exe
Size 3.1MB
SHA256 3d3d67b81574a1567049eee1864627fb2cfea44fa11563f87d2598b79a892b61
MD5 dd1c148eb34f99278331f09b3f16c689
SHA1 a76fc16f43fe7ebc66cb18c053ad586f1ab6b13d
SHA512 27cfebd0ff91e11011599805415531e772c8b7b282cd10af40d195ad0f326c2bdebba90b352b4d170016d5d96990d9c9a9d9b40109c5cce062cd087acd63fcdb
SSDEEP 49152:JVAbwXR+eb2jcWlFwfYud53AgGKP9u1ce+UhAOlY+FGXVRrmUFL8:/AO6IWzwQuddo11ce+UnlpFGG
TLSH
T125E523127A81C835C5B311334F89F659A17DF9621F32D6CB37981A6F8EB06C09929F4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.png

Path C:\Users\Admin\AppData\Local\Temp\bg.png
Size 224KB
SHA256 5fa976ea5780439175bb696817cd6eab3625ba5ccfe5b220587130ed5e1da855
MD5 21eb6b8232802f32b6483eedb96677bb
SHA1 b390f01600e521586e210936a4b57a6b89e66a7b
SHA512 5cfcb0278e5e7473dde396ee34115a3f50a9ad195d99b53cc5cc33a169a42c8f729806491fc0fb607719139081fa3c774c37b1638de1289b73c0c4c80768cfcd
SSDEEP 3072:7MuA+f6FJxlUhyLg2cugpbM5Q+jBre6cAJqmm6nkrw8sGaDy7y8bRzUnKdh8BfM9:7MuAWojcVdGSf+4BML49RzUnKUuLZ
TLSH
T1E92423876BC391F4590BD65FE9386BEC3CD4E7EC82AB113C931A42424D8416B85DE8F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
Size 40B
SHA256 ac5dc16c58b35fa01743b93820053d03949f7858073ec5e8a557b31febdcad62
MD5 411bc70566bd9340ea3ffed777b55567
SHA1 acca7bda79d465f7a0a7458464c2ac6032704a65
SHA512 59482938279f37546b4d30bacc60eb9aba9f141e45bc6808de254c8c224c769d6a974a328447a9c8481ba744609529aab6f563f01eaf7d2938e0f4fbb142d03e
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads