Overview

overview

8

Static

static

8

OperaInsta...1).exe

windows10-2004-x64

8

OperaInsta...1).exe

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    15/08/2026, 11:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    OperaInstaller (1).exe
  • Size 178KB
  • Sample260815-nbspxavcph
  • SHA256 20b545c7b0b0cb56926972b7fc2a94f428b7aa3e4f9f4e65d1bd0ad800fb60b7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoveryspywarestealer

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\OperaInstaller (1).exe
    "C:\Users\Admin\AppData\Local\Temp\OperaInstaller (1).exe"
    1⤵
    • Downloads MZ/PE file
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3588
    • C:\Users\Admin\AppData\Local\Temp\OpInst.exe
      "C:\Users\Admin\AppData\Local\Temp\OpInst.exe" --silent --allusers=0 --setdefaultbrowser=1
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5944
      • C:\Users\Admin\AppData\Local\Temp\7zS837D5999\installer.exe
        C:\Users\Admin\AppData\Local\Temp\7zS837D5999\installer.exe --silent --allusers=0 --setdefaultbrowser=1 --server-tracking-blob=YjVhZTUyOWViMjBmYmRhMDk3NDE5MDllMDkzOGJlMTJmMGRkNThiZmYwNDQ1NzZjODNiYTVhOWJlNTNiNjI4MDp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdyayZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1zcG90aWZ5X29wZXJhIiwidGltZXN0YW1wIjoiMTc4Njc5MjQ4Ni41MzQ4IiwidXNlcmFnZW50IjoiT3BlcmEgSW5zdGFsbGVyLzEuMCIsInV0bSI6eyJjYW1wYWlnbiI6InNwb3RpZnlfb3BlcmEiLCJtZWRpdW0iOiJwYiIsInNvdXJjZSI6IndyayJ9LCJ1dWlkIjoiYWY1YjJkNzktN2QwNi00OGU2LWEyN2YtYjdlYTQxOTM0Y2Y1In0=
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Enumerates system info in registry
        • Suspicious use of WriteProcessMemory
        PID:3888
        • C:\Users\Admin\AppData\Local\Temp\7zS837D5999\installer.exe
          C:\Users\Admin\AppData\Local\Temp\7zS837D5999\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=134.0.5954.56 --initial-client-data=0x2ac,0x2b0,0x2b4,0x288,0x2b8,0x7ff6fd4ead88,0x7ff6fd4ead94,0x7ff6fd4eada0
          4⤵
          • Executes dropped EXE
          PID:1880
        • C:\Users\Admin\AppData\Local\Temp\.opera\f25e11f4-eba8-4624-9317-81f51d7a866e Opera Installer Temp\installer.exe
          "C:\Users\Admin\AppData\Local\Temp\.opera\f25e11f4-eba8-4624-9317-81f51d7a866e Opera Installer Temp\installer.exe" --version
          4⤵
          • Executes dropped EXE
          PID:5536
        • C:\Users\Admin\AppData\Local\Temp\7zS837D5999\installer.exe
          "C:\Users\Admin\AppData\Local\Temp\7zS837D5999\installer.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=3888 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\f25e11f4-eba8-4624-9317-81f51d7a866e Opera Installer Temp\opera_package_20260815121449" --session-guid=f83603fb-00cb-42f5-b3fd-88295e1a483c --server-tracking-blob=YzgyM2VhMjM2OTZhODJjODA0ZjRlODZmNGQ3YmEyNWFmMjlmYjk0Y2YxMzQxMGEwZDBmMDk4MTFmMDRlMjkzZTp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdyayZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1zcG90aWZ5X29wZXJhIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTEiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzg2NzkyNDg2LjUzNDgiLCJ1c2VyYWdlbnQiOiJPcGVyYSBJbnN0YWxsZXIvMS4wIiwidXRtIjp7ImNhbXBhaWduIjoic3BvdGlmeV9vcGVyYSIsIm1lZGl1bSI6InBiIiwic291cmNlIjoid3JrIn0sInV1aWQiOiJhZjViMmQ3OS03ZDA2LTQ4ZTYtYTI3Zi1iN2VhNDE5MzRjZjUifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=8C07000000000000
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Enumerates system info in registry
          • Suspicious use of WriteProcessMemory
          PID:2668
          • C:\Users\Admin\AppData\Local\Temp\7zS837D5999\installer.exe
            C:\Users\Admin\AppData\Local\Temp\7zS837D5999\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=134.0.5954.56 --initial-client-data=0x2c0,0x2c4,0x2c8,0x294,0x2cc,0x7ff6fd4ead88,0x7ff6fd4ead94,0x7ff6fd4eada0
            5⤵
            • Executes dropped EXE
            PID:4804

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
        • Size 471B
        • SHA256 ca178ade85272cbf7d3f8c9e1efcd216eadbab55d8b9802aacbfe3e9c009dfdb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
        • Size 416B
        • SHA256 3ea34303bc9053fbd329dacc8c90362e8dddd55124104dc3825a98d9be47bbe0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        installer.exe
        • Path C:\Users\Admin\AppData\Local\Temp\7zS837D5999\installer.exe
        • Size 8.3MB
        • SHA256 3e1ee4a6d766e4e155d4818034c8e55efcfa743368a4e96a3b966badd7e09e14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OpInst.exe
        • Path C:\Users\Admin\AppData\Local\Temp\OpInst.exe
        • Size 3.1MB
        • SHA256 85996c39edaf5caec7c10f076facdf36a286828384332ddaa58fd996109b0b95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        bg.png
        • Path C:\Users\Admin\AppData\Local\Temp\bg.png
        • Size 224KB
        • SHA256 5fa976ea5780439175bb696817cd6eab3625ba5ccfe5b220587130ed5e1da855
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        settings.dat
        • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
        • Size 40B
        • SHA256 e85e56f488ea66a38badc422b2362aa808ab069beae77ede1bf2f4f11745a8b8
        • MD5 SHA1 SHA512
        Submit Download