312ed184f28e7cb04396cdccb5de4a0e11b0034d83acf3028941f5944cb8fbf4

General

Target
OperaGXSetup.exe
Size 4.0MB
Sample261014-pxmapass5j
SHA256 312ed184f28e7cb04396cdccb5de4a0e11b0034d83acf3028941f5944cb8fbf4
MD5 89eba0157765c7e21f48d0beb585b9a6
SHA1 62a85d9fd0161837a040632fdebbdb73ae649b97
SHA512 e3e1da0bd55ecedb8f481cc761af043b1c3fea94d436fa9d88e83d92e9779c2e4de4e93c2b77398006be19bb16dd30996bbb986170f69b6c23c04667c10ae1e8
SSDEEP 98304:tAD38/xFDrGcOv5ZUgmydCC69yOK/Gu99VuZbe:C38/x1kvjTCT9yOK/Gsso
TLSH
T1191623127BC140B2C69224374F79F75A87BEF2410E6616DFA3980E9C9F60193A935F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
19	6052	installer.exe

Executes dropped EXE 6 IoCs

pid	Process
6052	installer.exe
4896	installer.exe
552	installer.exe
2052	Opera_GX_assistant_136.0.6008.111_Setup.exe_sfx.exe
6020	assistant_installer.exe
4276	assistant_installer.exe

Loads dropped DLL 4 IoCs

pid	Process
6020	assistant_installer.exe
6020	assistant_installer.exe
4276	assistant_installer.exe
4276	assistant_installer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Writes a Windows system DLL name to a user directory 2 TTPs 1 IoCs

A module named after a system DLL outside System32 can be loaded instead of the real one by a program searching that directory.

defense_evasion

DLL Search Order Hijacking

T1574.001

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\.opera\73c2040f-7015-4bcf-969a-4d48f26dfd89 Opera GX Installer Temp\opera_package_202610141342421\assistant\dbghelp.dll	Opera_GX_assistant_136.0.6008.111_Setup.exe_sfx.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	installer.exe
File opened (read-only)	\??\F:	installer.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	installer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	installer.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaGXSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opera_GX_assistant_136.0.6008.111_Setup.exe_sfx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	assistant_installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	assistant_installer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
6052	installer.exe
6052	installer.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 6052	4636	OperaGXSetup.exe	90
PID 6052 wrote to memory of 4896	6052	installer.exe	91
PID 6052 wrote to memory of 552	6052	installer.exe	92
PID 6052 wrote to memory of 2052	6052	installer.exe	93
PID 6052 wrote to memory of 6020	6052	installer.exe	94
PID 6020 wrote to memory of 4276	6020	assistant_installer.exe	95

C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
"C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Users\Admin\AppData\Local\Temp\7zSC1245829\installer.exe
  C:\Users\Admin\AppData\Local\Temp\7zSC1245829\installer.exe --server-tracking-blob=YzJmNzViMWQwOGEyMjMzZGNjOTk4NTRhOWJjMWFjYTI2MjEwZGYwY2U2MzNlMGZlNDQyYjc1OWI5YzZlZTg3OTp7ImNvdW50cnkiOiJCRSIsImZhc3Rfb25ib2FyZGluZyI6e30sImh0dHBfcmVmZXJyZXIiOiJodHRwczovL3d3dy5vcGVyYS5jb20vIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYUdYU2V0dXAuZXhlIiwicHJvZHVjdCI6Im9wZXJhX2d4IiwicXVlcnkiOiIvb3BlcmFfZ3gvc3RhYmxlL3dpbmRvd3M/dXRtX3NvdXJjZT1UaGVOb2RlJnV0bV9tZWRpdW09YWZmaWxpYXRlJnV0bV9jYW1wYWlnbj1jODFfVGhlTm9kZV9neF9lc19HYWxsZXRhYTRhZmYmdXRtX2lkPWd4X2NyZWF0b3JzX2hlcm9fZXhwZXJpbWVudF92YXJpYW50LTEmaHR0cF9yZWZlcnJlcj1odHRwcyUzQSUyRiUyRnd3dy5vcGVyYS5jb20lMkZneCUyRmd4LWNyZWF0b3JzJTNGdXRtX2NhbXBhaWduJTNEYzgxX1RoZU5vZGVfZ3hfZXNfR2FsbGV0YWE0YWZmJTI2dXRtX21lZGl1bSUzRGFmZmlsaWF0ZSUyNnV0bV9zb3VyY2UlM0RUaGVOb2RlJTI2b25lbGlua19pZCUzRE9jV3klMjZjJTNER2FsbGV0YWE0YWZmJTI2cGlkJTNEVGhlTm9kZSUyNnNob3J0bGluayUzRHJuaXF4OGxhJTI2c291cmNlX2NhbGxlciUzRGFwaV92MiZ1dG1fc2l0ZT1vcGVyYV9jb20mdXRtX2xhc3RwYWdlPW9wZXJhLmNvbSUyRmd4JTJGZ3gtY3JlYXRvcnMmZGxfdG9rZW49MzczMTUyNzQiLCJ0aW1lc3RhbXAiOiIxNzkxOTgxNjU1LjM2OTEiLCJ1c2VyYWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTU1LjAuMC4wIFNhZmFyaS81MzcuMzYgRWRnLzE1NS4wLjAuMCIsInV0bSI6eyJjYW1wYWlnbiI6ImM4MV9UaGVOb2RlX2d4X2VzX0dhbGxldGFhNGFmZiIsImlkIjoiZ3hfY3JlYXRvcnNfaGVyb19leHBlcmltZW50X3ZhcmlhbnQtMSIsImxhc3RwYWdlIjoib3BlcmEuY29tL2d4L2d4LWNyZWF0b3JzIiwibWVkaXVtIjoiYWZmaWxpYXRlIiwic2l0ZSI6Im9wZXJhX2NvbSIsInNvdXJjZSI6IlRoZU5vZGUifSwidXVpZCI6ImFmNjMyYjNiLWFjNWMtNDc4OS04YjY4LWRkMzZkMzdlY2Y1ZCJ9
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Enumerates connected drives
  - Reads the TCP/IP host and domain name from the registry
  - Enumerates system info in registry
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:6052
- - C:\Users\Admin\AppData\Local\Temp\7zSC1245829\installer.exe
    C:\Users\Admin\AppData\Local\Temp\7zSC1245829\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.111 --initial-client-data=0x2a8,0x2ac,0x2b0,0x288,0x2b4,0x7ff78fb5c998,0x7ff78fb5c9a8,0x7ff78fb5c9b8
    3⤵
    - Executes dropped EXE
    PID:4896
- - C:\Users\Admin\AppData\Local\Temp\.opera\73c2040f-7015-4bcf-969a-4d48f26dfd89 Opera GX Installer Temp\installer.exe
    "C:\Users\Admin\AppData\Local\Temp\.opera\73c2040f-7015-4bcf-969a-4d48f26dfd89 Opera GX Installer Temp\installer.exe" --version
    3⤵
    - Executes dropped EXE
    PID:552
- - C:\Users\Admin\AppData\Local\Temp\.opera\73c2040f-7015-4bcf-969a-4d48f26dfd89 Opera GX Installer Temp\opera_package_202610141342421\assistant\Opera_GX_assistant_136.0.6008.111_Setup.exe_sfx.exe
    "C:\Users\Admin\AppData\Local\Temp\.opera\73c2040f-7015-4bcf-969a-4d48f26dfd89 Opera GX Installer Temp\opera_package_202610141342421\assistant\Opera_GX_assistant_136.0.6008.111_Setup.exe_sfx.exe"
    3⤵
    - Executes dropped EXE
    - Writes a Windows system DLL name to a user directory
    - System Location Discovery: System Language Discovery
    PID:2052
- - C:\Users\Admin\AppData\Local\Temp\.opera\73c2040f-7015-4bcf-969a-4d48f26dfd89 Opera GX Installer Temp\opera_package_202610141342421\assistant\assistant_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\.opera\73c2040f-7015-4bcf-969a-4d48f26dfd89 Opera GX Installer Temp\opera_package_202610141342421\assistant\assistant_installer.exe" --version
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:6020
  - - C:\Users\Admin\AppData\Local\Temp\.opera\73c2040f-7015-4bcf-969a-4d48f26dfd89 Opera GX Installer Temp\opera_package_202610141342421\assistant\assistant_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\73c2040f-7015-4bcf-969a-4d48f26dfd89 Opera GX Installer Temp\opera_package_202610141342421\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.111 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x98d9cc,0x98d9d8,0x98d9e4
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:4276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Hijack Execution Flow

1

T1574

DLL Search Order Hijacking

1

T1574.001

Privilege Escalation

Hijack Execution Flow

1

T1574

DLL Search Order Hijacking

1

T1574.001

Defense Evasion

Hijack Execution Flow

1

T1574

DLL Search Order Hijacking

1

T1574.001

Masquerading

1

T1036

Match Legitimate Name or Location

1

T1036.005

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Opera_GX_assistant_136.0.6008.111_Setup.exe_sfx.exe

Path C:\Users\Admin\AppData\Local\Temp\.opera\73c2040f-7015-4bcf-969a-4d48f26dfd89 Opera GX Installer Temp\opera_package_202610141342421\assistant\Opera_GX_assistant_136.0.6008.111_Setup.exe_sfx.exe
Size 2.9MB
SHA256 9a154db5e47d28470453ea69f3d7a9771af48d3eafd71b4fc62538aa2c19f92d
MD5 f41b1d7cd0329cdfd8448bb29be91d93
SHA1 b4f61dac9af5ea6e6d5570c1646d8f10aa56a45a
SHA512 53a18f0278f1e3f4c76099ec987ccbde9b01751d3b8e70291458a16fca726fb95bd4bb7961b80f6cda46a0aaa20059420e325303137d561eec76017df8255bc2
SSDEEP 49152:ykinohVcbXNLyXSewwkt8Dla5bSI+oGRqfz5wk0K7nnJ4mSB4Hbr2mx:ykio4LNuXSfVGDM5bSI8ozmZK1PAmi+
TLSH
T135D533217A958438D23312334CC8E6FA5AFEF1B51B258BAF2B940F2ECF74451D31665A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

assistant_installer.exe

Path C:\Users\Admin\AppData\Local\Temp\.opera\73c2040f-7015-4bcf-969a-4d48f26dfd89 Opera GX Installer Temp\opera_package_202610141342421\assistant\assistant_installer.exe
Size 2.5MB
SHA256 510ce6cf7d9bd4932e8188e0810073def5ccc9b783f90cdfbf4d7e3bda8de967
MD5 97bb97fa0d23085e8442747ce3aa5cf5
SHA1 8c12ccd8baff4c0c7aa987f585ba95033006a95c
SHA512 4d4bebce5793c13491bfc23227d58e23bc412fa31051c5f034e7e7cd5912e71a2f22ad9b18bacfa0ae13c9d8b58bf184de9b6e9ec86d5b90d9065541963c64d4
SSDEEP 49152:PX9gjkKUh7V/qxMfL5/Dfm4o0ela9uGZMXkOjEffxI+z787:PtCkKUpV/qxMTZfnsawGZMXkOYfZH2
TLSH
T183C59D02A95064B8DC263072723DE73EDE245E1267354EC7DAA4BDC5ABB46D2303B35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

browser_assistant.exe

Path C:\Users\Admin\AppData\Local\Temp\.opera\73c2040f-7015-4bcf-969a-4d48f26dfd89 Opera GX Installer Temp\opera_package_202610141342421\assistant\browser_assistant.exe
Size 5.3MB
SHA256 c2848c2d4a0ad23b9949597630f8035bed56aba27cf3efa203af18f503a80f30
MD5 9a1dfbcf82826158220c398ae0540c5b
SHA1 5f5ae5ecbb9ded57c48725489efa25bec66cfdd5
SHA512 bbc0e2cf0ab4b776052a798c3cfb25db9e0b6d976368146a10a66da6e7897248dd91387fe6bed87bfecc0a8e5b181e8a0c771be6f0fabfbe63ee78bcb874662f
SSDEEP 98304:J6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwww/:raEmlxEB86WdnEOhoqfk1BGYUBDKF
TLSH
T12A46BF52A2113078C84ABA71653D7B7B48281D63572187DF8DD83DA21BB4AC22B3DF5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbgcore.dll

Path C:\Users\Admin\AppData\Local\Temp\.opera\73c2040f-7015-4bcf-969a-4d48f26dfd89 Opera GX Installer Temp\opera_package_202610141342421\assistant\dbgcore.dll
Size 196KB
SHA256 49ef54a43abea102f40f0f6628192b0a8ecddeea33339f04ff536de7383782e6
MD5 95d866bde083118295ee50f44370245c
SHA1 cffa74c757c395abd19d4bb78857d92b810348ad
SHA512 aade0c650b65f6fc7afb8049df1cc3ece17bdd68f01a1f6ed07ac09a8eea75954ede8daed789b7ceadb13942847fe18eb68a22d46ba848dacc45aacc5590111f
SSDEEP 6144:6ASh0NdOkBakZykbp/eyhr+SJors+k0L3nTEw:1YIqFLnTn
TLSH
T108148D6296840833DD9F11B8729F333795FEAFB0139194C362549AE4E5647C06E3A2DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbghelp.dll

Path C:\Users\Admin\AppData\Local\Temp\.opera\73c2040f-7015-4bcf-969a-4d48f26dfd89 Opera GX Installer Temp\opera_package_202610141342421\assistant\dbghelp.dll
Size 1.8MB
SHA256 9df3c15a741948a19b6cf3ea511ec703a1eef673af230fd99fe4dffde7e663e1
MD5 6cc7b86dcad091a36bd0ec41e7c975a8
SHA1 6a85755a3ac8d3f043c404b543c67bfb97c6fb99
SHA512 b3485ff03d726b3c1b7dc46404ed06c9f9dac5598ba615b904161f03b3af59a51e1f25626be216dd5715d3f7929f09a0124659e911592c8959c8c2e1758546f0
SSDEEP 24576:WDOSE7VspFPxh+EqYbt6lyn2GyQWKACVOxHTdMgh9IVbMAQyvyXiuVKHeeKKwsfa:WqhRcFPxhHYCBRnyHO6W6NIyX/kQs2Os
TLSH
T1C0856A20E784813CE4EA0177E67D7A79866DE134073440CBAAD45B69782D7C3AF386DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

files_list

Path C:\Users\Admin\AppData\Local\Temp\.opera\73c2040f-7015-4bcf-969a-4d48f26dfd89 Opera GX Installer Temp\opera_package_202610141342421\assistant\files_list
Size 72B
SHA256 5b3741e12f14d0ae54d450fff585c5fbfa7b360800c863722472d320c26b4ef4
MD5 7c375531029e3e1e14e204850417eb74
SHA1 086ccee638fbb7dcad3d21627c4f32386490f456
SHA512 8411bf285d334a51b51993487148d0b53f6cf9439a9250b71cce9718250bbb226825e3a1be832443b84ace59e43f3fb77c4f4741f0d376543ca32d9ab40f4a67
TLSH
T169A00204C51E089CAFC53595831146FF67D765145AB89655075F10CC5926027478F776
MD5 SHA1 SHA512 TLSH

Submit Download

installer.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC1245829\installer.exe
Size 9.2MB
SHA256 7451506a62bf3792c250d641d560bbc98274904703075509514bb4e36bdd3ad1
MD5 2a4468d8e8bd992d83b461f3e5b44fb3
SHA1 501563dc0f858a81328f4f807060cd382154fdcf
SHA512 79baaef403a9df52402b65145ca2cf820033165077c2e8ea6e4484e9013a0a5508a7d9dced2c3474173a41a65aa5286e337c23b1d99210e321bbf25bc84f28b6
SSDEEP 98304:V+OlKGIVleIYBK2zlBFUDWQZ2UFPTMMi7tFBI3++wteEmC:AOlDCEBhDFErMXC3+BqC
TLSH
T1E3A69D53F3A601E8D06FDA788B7A523299757C464B30A3EF0A943A250E75FD45B3CB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat
Size 40B
SHA256 664f89627c5a465eb9597526dd7ddf44db4f50152c60bdb60e079613801d5707
MD5 246f1e12dd0f07568887252375b69c27
SHA1 8cfbeb3267104c4d7050825ab2f19b3cfbf3c759
SHA512 8159b0c1646028e4d1cae2c7c2681dc0ea81e61218834a8fdb544988f2a78f60d8cb31f7bf7a6abb3d4aa3bcee5fc0ee18768bba7d89ce2f344338a224d29c30
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads