20b545c7b0b0cb56926972b7fc2a94f428b7aa3e4f9f4e65d1bd0ad800fb60b7

General

Target
OperaInstaller (1).exe
Size 178KB
Sample260817-cf2b3a1fka
SHA256 20b545c7b0b0cb56926972b7fc2a94f428b7aa3e4f9f4e65d1bd0ad800fb60b7
MD5 4ef32b114eaa6f05340b46d0f48154c7
SHA1 a07219dc2a0fa96f5f9a03b1bb350c9ab2679d3f
SHA512 6631937f30fcfdc536bd14735870c9c4592f4414e9c1d71ec69c718bf341ff286174b782c6a23a6c29744be940bcac34aa93845e60727e090bee8423d738ea9d
SSDEEP 3072:IYHHEa1Lz5KhEwh5kc9+5sFoq0X/r6LGV4RxJ0OZnS+Rl//bRRlTHGVJp99vqRy:IYEwP5KhVyc9esFoBvum4RvGJTEy
TLSH
T1EB046B823AC184B5E5B244321864DBB19A7DFC700F65D9DB73987A3B5DB02C09932F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
14	4836	OperaInstaller (1).exe
35	1792	installer.exe

Executes dropped EXE 6 IoCs

pid	Process
6092	OpInst.exe
1792	installer.exe
5348	installer.exe
5356	installer.exe
2960	installer.exe
5180	installer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	installer.exe
File opened (read-only)	\??\F:	installer.exe
File opened (read-only)	\??\E:	installer.exe
File opened (read-only)	\??\F:	installer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaInstaller (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OpInst.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 6092	4836	OperaInstaller (1).exe	90
PID 6092 wrote to memory of 1792	6092	OpInst.exe	91
PID 1792 wrote to memory of 5348	1792	installer.exe	92
PID 1792 wrote to memory of 5356	1792	installer.exe	93
PID 1792 wrote to memory of 2960	1792	installer.exe	94
PID 2960 wrote to memory of 5180	2960	installer.exe	95

C:\Users\Admin\AppData\Local\Temp\OperaInstaller (1).exe
"C:\Users\Admin\AppData\Local\Temp\OperaInstaller (1).exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Users\Admin\AppData\Local\Temp\OpInst.exe
  "C:\Users\Admin\AppData\Local\Temp\OpInst.exe" --silent --allusers=0 --setdefaultbrowser=1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6092
- - C:\Users\Admin\AppData\Local\Temp\7zSCC7849C9\installer.exe
    C:\Users\Admin\AppData\Local\Temp\7zSCC7849C9\installer.exe --silent --allusers=0 --setdefaultbrowser=1 --server-tracking-blob=OWRmYzBhMGQ2ODRjYjZlYzkyZDBlYmNjNGEwZmVlNGQxZGZiMmIzYTQ2OGM1Mjk5Yzk4NzRlYzgyMDAwODIwOTp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdyayZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1zcG90aWZ5X29wZXJhIiwidGltZXN0YW1wIjoiMTc4NjkzMjE4Ni44NjIwIiwidXNlcmFnZW50IjoiT3BlcmEgSW5zdGFsbGVyLzEuMCIsInV0bSI6eyJjYW1wYWlnbiI6InNwb3RpZnlfb3BlcmEiLCJtZWRpdW0iOiJwYiIsInNvdXJjZSI6IndyayJ9LCJ1dWlkIjoiNmQxNzBkMjktNzZiMC00YmJlLWFjYjYtZjMyMTU4ZTRmNTczIn0=
    3⤵
    - Downloads MZ/PE file
    - Executes dropped EXE
    - Enumerates connected drives
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:1792
  - - C:\Users\Admin\AppData\Local\Temp\7zSCC7849C9\installer.exe
      C:\Users\Admin\AppData\Local\Temp\7zSCC7849C9\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=134.0.5954.56 --initial-client-data=0x2b4,0x2b8,0x2bc,0x290,0x2c0,0x7ff68dfdad88,0x7ff68dfdad94,0x7ff68dfdada0
      4⤵
      Executes dropped EXE
      PID:5348
  - - C:\Users\Admin\AppData\Local\Temp\.opera\89d59a8d-1a0e-48fe-8749-5690a6f96f4c Opera Installer Temp\installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\89d59a8d-1a0e-48fe-8749-5690a6f96f4c Opera Installer Temp\installer.exe" --version
      4⤵
      Executes dropped EXE
      PID:5356
  - - C:\Users\Admin\AppData\Local\Temp\7zSCC7849C9\installer.exe
      "C:\Users\Admin\AppData\Local\Temp\7zSCC7849C9\installer.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=1792 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\89d59a8d-1a0e-48fe-8749-5690a6f96f4c Opera Installer Temp\opera_package_20260817030308" --session-guid=0c254c3b-3197-489a-903d-8324a1f7237e --server-tracking-blob=NDhmY2Y4NzljNDI5Y2EwOWY2YTA2NTNjYzU4MGFkNzdjYWFhMjFlZDE5Y2UxYWU1MWRlMDU5N2E5ZDgwZmViYTp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXdyayZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1zcG90aWZ5X29wZXJhIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTEiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzg2OTMyMTg2Ljg2MjAiLCJ1c2VyYWdlbnQiOiJPcGVyYSBJbnN0YWxsZXIvMS4wIiwidXRtIjp7ImNhbXBhaWduIjoic3BvdGlmeV9vcGVyYSIsIm1lZGl1bSI6InBiIiwic291cmNlIjoid3JrIn0sInV1aWQiOiI2ZDE3MGQyOS03NmIwLTRiYmUtYWNiNi1mMzIxNThlNGY1NzMifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=F807000000000000
      4⤵
      Executes dropped EXE
      Enumerates connected drives
      Enumerates system info in registry
      Suspicious use of WriteProcessMemory
      PID:2960
    - - C:\Users\Admin\AppData\Local\Temp\7zSCC7849C9\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC7849C9\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=134.0.5954.56 --initial-client-data=0x2c0,0x2c4,0x2c8,0x294,0x2cc,0x7ff68dfdad88,0x7ff68dfdad94,0x7ff68dfdada0
        5⤵
        Executes dropped EXE
        
        PID:5180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
Size 471B
SHA256 e586ccd13cf3673c04e6723169864594e8ed1aeddb8fc504d68b7353ef564c19
MD5 0e31ba19474d12dd8f16145769c14182
SHA1 2c44e7d0d92cda8eccced5510d7c637bc723c659
SHA512 52e41ed17a98016fa2b799f8f0006b32d9cb4fe8e28716bf2eabe134454140d789a990e32c69e09761b069619d73f0ef7d035273ad81bf9ebd57791687e97f9f
TLSH
T185F0DCE261AC84582BC648A81DD0863F7530F4A906052A9A620C45F542841EC9F6F03A
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CB77E3D8FE906716C4DEE1FAFFCB74A5
Size 416B
SHA256 1f4a4965413f2104e3ac0db55a13564cfaf8b97efbf54cc22211dd65d6cb83b4
MD5 68f050dc0493f7a28b8a1c92e2b54069
SHA1 f92053acdf3d9acec4a8e2582756abbff055c0d0
SHA512 7cc9b5f5d222c024d6a63621f717b4e13182fd0bf41a605a79e5e4d544ffaa42753b39d9121f2de0e4cc720c60bf53c45c6e3a03d52a97070b807100a56aa845
TLSH
T1C0E0C03419F7007EF4F4E0744FD5B6394E4AF0360818A2B01EE087047603900AF13E74
MD5 SHA1 SHA512 TLSH

Submit Download

installer.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSCC7849C9\installer.exe
Size 8.3MB
SHA256 3e1ee4a6d766e4e155d4818034c8e55efcfa743368a4e96a3b966badd7e09e14
MD5 36152668ab7d4db9a0015916f2eebfd4
SHA1 7f551a41bb0c09ef1dbf56b76bcd68682c059435
SHA512 0d1ba9f9533c23f5b089ea5b2bf21ef74e310b64e04ce39742ca7a0a32cf8937ad4bd579cfa56668ef232e3ea569fc0a293ced570d7d85311018c0ced893f1d2
SSDEEP 98304:WfyPB3Qm1BgiwINXE9ynI81WT7cG8BAzFYNY8AF9:0yPB3Qm1BgDueXF9
TLSH
T114967C53F2A601E8D06FCA748B7A523299757C464B31A3EF0A943A251E75FD46F3CB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OpInst.exe

Path C:\Users\Admin\AppData\Local\Temp\OpInst.exe
Size 3.1MB
SHA256 bc484ff7518a2c424483697277b55bb1790515f78173aad0dc4b4f3cfa93f273
MD5 5fbe0e5f47401477185d4f45f22c74e2
SHA1 4222a6d164a38fe459fa659f3b646eee5faf03c3
SHA512 eb3445b118c8495d2e77386191bed7c8810ab10e203bd820719db709aa6af5ac1033becb121468bca7b35e1e747a2a924c2767d96e1fc03716c1992380a93cb5
SSDEEP 98304:9A3624H6UA7suEqszIwzNfnKXevaMGP/OUYX3:W6FaUMdcmtlq3
TLSH
T1B5E523127B80D8B9E62210335F15E659977DB9201F26DA8BB3D41D5F8FB0282B636F43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.png

Path C:\Users\Admin\AppData\Local\Temp\bg.png
Size 224KB
SHA256 5fa976ea5780439175bb696817cd6eab3625ba5ccfe5b220587130ed5e1da855
MD5 21eb6b8232802f32b6483eedb96677bb
SHA1 b390f01600e521586e210936a4b57a6b89e66a7b
SHA512 5cfcb0278e5e7473dde396ee34115a3f50a9ad195d99b53cc5cc33a169a42c8f729806491fc0fb607719139081fa3c774c37b1638de1289b73c0c4c80768cfcd
SSDEEP 3072:7MuA+f6FJxlUhyLg2cugpbM5Q+jBre6cAJqmm6nkrw8sGaDy7y8bRzUnKdh8BfM9:7MuAWojcVdGSf+4BML49RzUnKUuLZ
TLSH
T1E92423876BC391F4590BD65FE9386BEC3CD4E7EC82AB113C931A42424D8416B85DE8F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
Size 40B
SHA256 7eef9506459019957215661ad57e6b757fd2a1b61118e4985eab0d7e0812c1f8
MD5 4617df462f234332e0ca92d3b4939b86
SHA1 6760306d1fd10900e556db29f25caae0d607b59b
SHA512 ee22de31bc7103bab3732519bdc36351255f55243a3858e0e4d26fa83d4d7302c94143cf2656b8c18ef0813ea328e7b09839e526e3edf62483049340707c11c1
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads