13e57220e4882912f4e7be57364833f695ec3d0e9a9ecc06b1d6d5f803708c66

General

Target
OperaGXSetup.exe
Size 4.0MB
Sample260928-psfmcavyew
SHA256 13e57220e4882912f4e7be57364833f695ec3d0e9a9ecc06b1d6d5f803708c66
MD5 914b65c83cdf3f7f0430ce6b377c408e
SHA1 e7083f7484531ab91032bf7d30fb84884743227a
SHA512 fb58e0a7c3fbd8ae145b73b5d8948769a73911373cd3071b0dfa18dd5401136de087f4ee0feaf3f3be423ff0b749d112a9bb85c162c388e22d3d4ec57e768eea
SSDEEP 98304:QAwZklcvHDqM0Ujii51yhiCnFKElv3ORW+daIGYYFciHYLc:KlHDqxcd51yhtJPX+dBGYk4Lc
TLSH
T1B2163322B7449072E1B326334E68F7A855FEF0650E5A4A6B33D10A5D8F70742F938F66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
17	3312	installer.exe

Executes dropped EXE 6 IoCs

pid	Process
3312	installer.exe
1192	installer.exe
5244	installer.exe
616	Opera_GX_assistant_136.0.6008.50_Setup.exe_sfx.exe
4444	assistant_installer.exe
5644	assistant_installer.exe

Loads dropped DLL 4 IoCs

pid	Process
4444	assistant_installer.exe
4444	assistant_installer.exe
5644	assistant_installer.exe
5644	assistant_installer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Writes a Windows system DLL name to a user directory 2 TTPs 1 IoCs

A module named after a system DLL outside System32 can be loaded instead of the real one by a program searching that directory.

defense_evasion

DLL Search Order Hijacking

T1574.001

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\.opera\3dfd7cbf-fe82-4212-9ae6-e693f6c7039a Opera GX Installer Temp\opera_package_202609281335231\assistant\dbghelp.dll	Opera_GX_assistant_136.0.6008.50_Setup.exe_sfx.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	installer.exe
File opened (read-only)	\??\F:	installer.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	installer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	installer.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaGXSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opera_GX_assistant_136.0.6008.50_Setup.exe_sfx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	assistant_installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	assistant_installer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3312	installer.exe
3312	installer.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 3312	4100	OperaGXSetup.exe	89
PID 3312 wrote to memory of 1192	3312	installer.exe	90
PID 3312 wrote to memory of 5244	3312	installer.exe	91
PID 3312 wrote to memory of 616	3312	installer.exe	93
PID 3312 wrote to memory of 4444	3312	installer.exe	94
PID 4444 wrote to memory of 5644	4444	assistant_installer.exe	95

C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
"C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Users\Admin\AppData\Local\Temp\7zS400DF719\installer.exe
  C:\Users\Admin\AppData\Local\Temp\7zS400DF719\installer.exe --server-tracking-blob=N2E2MDlkODk0Zjg0MDQxNjczZDlmNmVlNzZlY2Q1MWFjMzlkMTZjMGEwNmYyN2QwMWIwYzg5Y2E0YzNlOTQxODp7ImNvdW50cnkiOiJERSIsImVkaXRpb24iOiJzdGQtMiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYV9neCIsInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS93aW5kb3dzP2VkaXRpb249c3RkLTImdXRtX3NvdXJjZT1QV05nYW1lcyZ1dG1fbWVkaXVtPXBhJnV0bV9jYW1wYWlnbj1QV05fSU5fSFZSXzkzOTZfV0VCXzM5NDYmZWRpdGlvbj1zdGQtMiZ1dG1faWQ9OWUzNWM4N2FlODhmNGNiM2IxZDFkOTFkMjA2YjY5NjQmaHR0cF9yZWZlcnJlcj1odHRwcyUzQSUyRiUyRnd3dy5vcGVyYS5jb20lMkZnZXQlMkZvcGVyYS1neCUzRnV0bV9zb3VyY2UlM0RQV05nYW1lcyUyNnV0bV9tZWRpdW0lM0RwYSUyNnV0bV9jYW1wYWlnbiUzRFBXTl9JTl9IVlJfOTM5Nl9XRUJfMzk0NiUyNnV0bV9pZCUzRGY0MWFiYjBhODYxZDRiYzc5NDIxNDE0NjEyMzQ1NmExJTI2ZWRpdGlvbiUzRHN0ZC0yJnV0bV9zaXRlPW9wZXJhX2NvbSZ1dG1fbGFzdHBhZ2U9b3BlcmEuY29tJTJGZ2V0JTJGb3BlcmEtZ3gmdXRtX2lkPWY0MWFiYjBhODYxZDRiYzc5NDIxNDE0NjEyMzQ1NmExJmRsX3Rva2VuPTE1ODUyMDIyIiwidGltZXN0YW1wIjoiMTc5MDU5ODkxNi4zODQ3IiwidXNlcmFnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEzMS4wLjAuMCBTYWZhcmkvNTM3LjM2IEVkZy8xMzEuMC4wLjAiLCJ1dG0iOnsiY2FtcGFpZ24iOiJQV05fSU5fSFZSXzkzOTZfV0VCXzM5NDYiLCJpZCI6ImY0MWFiYjBhODYxZDRiYzc5NDIxNDE0NjEyMzQ1NmExIiwibGFzdHBhZ2UiOiJvcGVyYS5jb20vZ2V0L29wZXJhLWd4IiwibWVkaXVtIjoicGEiLCJzaXRlIjoib3BlcmFfY29tIiwic291cmNlIjoiUFdOZ2FtZXMifSwidXVpZCI6ImI1ZmEwM2UyLTg2NzYtNDYwOC1hOGFlLTBmMjc4ZmRiZDNjYSJ9
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Enumerates connected drives
  - Reads the TCP/IP host and domain name from the registry
  - Enumerates system info in registry
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3312
- - C:\Users\Admin\AppData\Local\Temp\7zS400DF719\installer.exe
    C:\Users\Admin\AppData\Local\Temp\7zS400DF719\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.67 --initial-client-data=0x2a8,0x2ac,0x2b0,0x284,0x2b4,0x7ff751977998,0x7ff7519779a8,0x7ff7519779b8
    3⤵
    - Executes dropped EXE
    PID:1192
- - C:\Users\Admin\AppData\Local\Temp\.opera\3dfd7cbf-fe82-4212-9ae6-e693f6c7039a Opera GX Installer Temp\installer.exe
    "C:\Users\Admin\AppData\Local\Temp\.opera\3dfd7cbf-fe82-4212-9ae6-e693f6c7039a Opera GX Installer Temp\installer.exe" --version
    3⤵
    - Executes dropped EXE
    PID:5244
- - C:\Users\Admin\AppData\Local\Temp\.opera\3dfd7cbf-fe82-4212-9ae6-e693f6c7039a Opera GX Installer Temp\opera_package_202609281335231\assistant\Opera_GX_assistant_136.0.6008.50_Setup.exe_sfx.exe
    "C:\Users\Admin\AppData\Local\Temp\.opera\3dfd7cbf-fe82-4212-9ae6-e693f6c7039a Opera GX Installer Temp\opera_package_202609281335231\assistant\Opera_GX_assistant_136.0.6008.50_Setup.exe_sfx.exe"
    3⤵
    - Executes dropped EXE
    - Writes a Windows system DLL name to a user directory
    - System Location Discovery: System Language Discovery
    PID:616
- - C:\Users\Admin\AppData\Local\Temp\.opera\3dfd7cbf-fe82-4212-9ae6-e693f6c7039a Opera GX Installer Temp\opera_package_202609281335231\assistant\assistant_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\.opera\3dfd7cbf-fe82-4212-9ae6-e693f6c7039a Opera GX Installer Temp\opera_package_202609281335231\assistant\assistant_installer.exe" --version
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:4444
  - - C:\Users\Admin\AppData\Local\Temp\.opera\3dfd7cbf-fe82-4212-9ae6-e693f6c7039a Opera GX Installer Temp\opera_package_202609281335231\assistant\assistant_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\3dfd7cbf-fe82-4212-9ae6-e693f6c7039a Opera GX Installer Temp\opera_package_202609281335231\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.50 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x39c9cc,0x39c9d8,0x39c9e4
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:5644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Hijack Execution Flow

1

T1574

DLL Search Order Hijacking

1

T1574.001

Privilege Escalation

Hijack Execution Flow

1

T1574

DLL Search Order Hijacking

1

T1574.001

Defense Evasion

Hijack Execution Flow

1

T1574

DLL Search Order Hijacking

1

T1574.001

Masquerading

1

T1036

Match Legitimate Name or Location

1

T1036.005

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

additional_file0.tmp

Path C:\Users\Admin\AppData\Local\Temp\.opera\3dfd7cbf-fe82-4212-9ae6-e693f6c7039a Opera GX Installer Temp\opera_package_202609281335231\additional_file0.tmp
Size 2.9MB
SHA256 cdb600359a2ee392e9ff11e680770171531760b6d64319cf6bffc5c1341a0dc0
MD5 8eed32cc2459d015ed87ad9b787698ef
SHA1 1480a48669504d8f669b76bc64da3f8cabec0cd1
SHA512 acad63ce796ca1d22296d218770c2c66f7b959f71be47aca4014791196684eb01d22c1d1b337dbb058f4d2f5668029dea0b6335efd5ef062d9450c06e2ba7162
SSDEEP 49152:lkinoc7mzJK2Im2Ali492Ob/WJltY0flMg1NK0mdZQGCD17099yIR2PZRPdLBVEu:lkioKr2I6aVj8QB709Ar7PpB7
TLSH
T174D53331BA818875D97312338E6CFBBC68BD76B16FB65DCB77D40B1C8F20552A608192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

assistant_installer.exe

Path C:\Users\Admin\AppData\Local\Temp\.opera\3dfd7cbf-fe82-4212-9ae6-e693f6c7039a Opera GX Installer Temp\opera_package_202609281335231\assistant\assistant_installer.exe
Size 2.5MB
SHA256 5dda5f3ca9e230e79dc6c74ab74afe8d027cbd4db293ab0260dcf71010f6ff9b
MD5 6f783a3eec7a1f6e3670329ad74bb1c6
SHA1 dc5d8e2003040ae3bf35e09a7f7ba443d67a9207
SHA512 42e8869fdf7ad54bc249e3433d2213d030ba2b59ba51162a21fbf2b6eb4e4c1468a0aad861fa07008604d9cc4fe5ad17e6f5efb9c93510c92ac4ac36dcc9c0f5
SSDEEP 49152:sWhqGl4SUVGhxKdiVjvIKenrYGDiTXnoe6vBnqNXh7B63:saqGl4/VGhxKIxIB5D+XnoeqBqpw
TLSH
T166C5AE02A99094B5DCA63032721CE77D9A355E114F364EC7AB90BCC17FB4AD2613B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

browser_assistant.exe

Path C:\Users\Admin\AppData\Local\Temp\.opera\3dfd7cbf-fe82-4212-9ae6-e693f6c7039a Opera GX Installer Temp\opera_package_202609281335231\assistant\browser_assistant.exe
Size 5.3MB
SHA256 4d033b0d0804e98418d736c57aef51d502bc131637e688a8381f2b8133a5856b
MD5 a5f5aa1006460704553e62b268448fe0
SHA1 e46c82c94ca923a2a35eb7027b6df8d27aea5dbf
SHA512 9bfc3e13065e69868378309a996011093148056a1c4158edb02cc0ad149e916ae02e1f1881ccfd2621f37bc0f1cec96435d21628400d878c412fecbb162a6700
SSDEEP 98304:56666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwq:VMQ2nHhxdqX1n6TbSO9eKALZykIZ
TLSH
T16246AE52B621207CC84B68B1643D6B7B4C281973972186DFC9E83CE25B749C26E3D76F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbgcore.dll

Path C:\Users\Admin\AppData\Local\Temp\.opera\3dfd7cbf-fe82-4212-9ae6-e693f6c7039a Opera GX Installer Temp\opera_package_202609281335231\assistant\dbgcore.dll
Size 196KB
SHA256 0a08d02dbba60e940694a2c154d4b78969df546d40d8ec314cf6be1753f009d1
MD5 90853f386554492716bce7eb06571fd7
SHA1 e5e1ff295975d3cd50182abddaea26dbde0d79c4
SHA512 0c60587c2266747134e8c7812013ac1a14e8cafaa171452fec9273a796831eacd5effdc7dbbaa0bf254c4502f9076fdbddc9b5f85527b62a236a4f624f8469f4
SSDEEP 6144:VASh0NdOkBakZykbp/eyhr+SJors+k0L3nTd:oYIqFLnT
TLSH
T154148D6296840833DD9F11B8B29F333795FEDFB013A494D362509AE4E5647C06E3A2DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbghelp.dll

Path C:\Users\Admin\AppData\Local\Temp\.opera\3dfd7cbf-fe82-4212-9ae6-e693f6c7039a Opera GX Installer Temp\opera_package_202609281335231\assistant\dbghelp.dll
Size 1.8MB
SHA256 bb4c23816f445ae5122ba5fc7d8cdd77bb9e519ab107f450320829a98df52175
MD5 f71549450b55a8ba83df14ee3ab5d04d
SHA1 f55dd46aa976283e632c32acc82dd9c68eb1b687
SHA512 b04c7750879dd17db489b790dd2e7be3f35b383a4bb95aff4c900301d48f4d84e6b69f59b0e0bdb12e76711ccb672d9fe7c45c162f7e04d4fe8f4fc18bdf2abb
SSDEEP 24576:YDOSE7VspFPxh+EqYbt6lyn2GyQWKACVOxHTdMgh9IVbMAQyvyXiuVKHeeKKwsfs:YqhRcFPxhHYCBRnyHO6W6NIyX/kQs2Rd
TLSH
T140856A20E784813CE4EA0177E67D7A79866DE134073440CBAAD45B69782D7C3AF386DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

files_list

Path C:\Users\Admin\AppData\Local\Temp\.opera\3dfd7cbf-fe82-4212-9ae6-e693f6c7039a Opera GX Installer Temp\opera_package_202609281335231\assistant\files_list
Size 72B
SHA256 5b3741e12f14d0ae54d450fff585c5fbfa7b360800c863722472d320c26b4ef4
MD5 7c375531029e3e1e14e204850417eb74
SHA1 086ccee638fbb7dcad3d21627c4f32386490f456
SHA512 8411bf285d334a51b51993487148d0b53f6cf9439a9250b71cce9718250bbb226825e3a1be832443b84ace59e43f3fb77c4f4741f0d376543ca32d9ab40f4a67
TLSH
T169A00204C51E089CAFC53595831146FF67D765145AB89655075F10CC5926027478F776
MD5 SHA1 SHA512 TLSH

Submit Download

installer.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS400DF719\installer.exe
Size 9.2MB
SHA256 b8560abe46e62b48e2c72a827928f062b4f748632284a22c497f77dd317c5bae
MD5 8f453471f3749d6c8147b1f65f1bc4bc
SHA1 1f45b61e0db69afd5ecbe195cfcf21c13b0ebb3e
SHA512 a43ae3f54776d47d66b4d38f1f0bc3f4e9ba1f7efd7f8e8cc4346aef12a6422b2f27e3866810215a21402c45982137fb0d9bbd4f8b3695a24d98f187e0b40ff3
SSDEEP 98304:ylkT8NVBZsalrvRje7nSRS0mvX1tFBI3++wteEmg:CkgN5s4Mf0w1C3+Bqg
TLSH
T194A69D53F3A601E8D06FCA749B7A5232A9357C464B30A3EF0A943A251E75FD45B3CB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat
Size 40B
SHA256 b2e8019c45a05d81319006d162ca4f52102a18e876b1ccbed44455efef739c14
MD5 fe53b5b2faa4f1a7c3f2dd9e9d6efe28
SHA1 cf63e8980cd9a756919b0ab3733f68b7ab3cab14
SHA512 99a41eb405ef972e316a1e2ae2833863e0fb82b68b433561afb1c8d897b06f7d0d86c0ac7ab9f34c941cf760e6baf79ef5f0decb70ee4d1d6e51da2ae9b89fc0
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads