caad8d9c1023311cf8ab4a1eb34b11ed48fb56b4c364e1e4f906d5101704694f

Analysis

user interaction
yes
max time kernel
150s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/10/2026, 23:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OperaGXSetup.exe
Size 4.0MB
Sample261016-3fv36acb32
SHA256 caad8d9c1023311cf8ab4a1eb34b11ed48fb56b4c364e1e4f906d5101704694f
MD5 6fdab4aa1211921676332ff1f4d4607f
SHA1 193b328268bf574daa696ee3e46fc06b9a1d0666
SHA512 08af4f5e35ffaa1bb4a6faeaf9f3a560f3b2f33d8da62d687975a6777c37403679d3c051667f1a841d91b316ab58ebadf47ac635f93bd5b8a5cbfa4ebc5fb869
SSDEEP 98304:rAwZklcvHDqM0Ujii51yhiCnFKElv3ORW+daIGYYFciHYL+:/lHDqxcd51yhtJPX+dBGYk4L+
TLSH
T10A163322B7449072E1B326334E68F7A855FEF0650E5A4A6B33D10A5D8F70742F938F66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
20	1148	installer.exe

Executes dropped EXE 6 IoCs

pid	Process
1148	installer.exe
5008	installer.exe
3712	installer.exe
6000	Opera_GX_assistant_137.0.6036.65_Setup.exe_sfx.exe
3016	assistant_installer.exe
4468	assistant_installer.exe

Loads dropped DLL 4 IoCs

pid	Process
3016	assistant_installer.exe
3016	assistant_installer.exe
4468	assistant_installer.exe
4468	assistant_installer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Writes a Windows system DLL name to a user directory 2 TTPs 1 IoCs

A module named after a system DLL outside System32 can be loaded instead of the real one by a program searching that directory.

defense_evasion

DLL Search Order Hijacking

T1574.001

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\.opera\f155da55-6721-41ab-bd0c-02481ce4cac5 Opera GX Installer Temp\opera_package_202610170027571\assistant\dbghelp.dll	Opera_GX_assistant_137.0.6036.65_Setup.exe_sfx.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	installer.exe
File opened (read-only)	\??\F:	installer.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	installer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	installer.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	assistant_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OperaGXSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Opera_GX_assistant_137.0.6036.65_Setup.exe_sfx.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	assistant_installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	assistant_installer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1148	installer.exe
1148	installer.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 1148	2456	OperaGXSetup.exe	89
PID 1148 wrote to memory of 5008	1148	installer.exe	90
PID 1148 wrote to memory of 3712	1148	installer.exe	91
PID 1148 wrote to memory of 6000	1148	installer.exe	92
PID 1148 wrote to memory of 3016	1148	installer.exe	93
PID 3016 wrote to memory of 4468	3016	assistant_installer.exe	94

C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe
"C:\Users\Admin\AppData\Local\Temp\OperaGXSetup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Users\Admin\AppData\Local\Temp\7zS89956439\installer.exe
  C:\Users\Admin\AppData\Local\Temp\7zS89956439\installer.exe --server-tracking-blob=ZWJkMmVmYmEyODRiZDU1M2E3MTJkNzM2ODA2MGVjNjVlOTQ2OTZjOTZlZjQ2M2IxMGFhOTJhZDE5YTNjYTllODp7ImNvdW50cnkiOiJVUyIsImZhc3Rfb25ib2FyZGluZyI6e30sImh0dHBfcmVmZXJyZXIiOiJodHRwczovL3d3dy5vcGVyYS5jb20vIiwiaW5zdGFsbGVyX25hbWUiOiJPcGVyYUdYU2V0dXAuZXhlIiwicHJvZHVjdCI6Im9wZXJhX2d4IiwicXVlcnkiOiIvb3BlcmFfZ3gvc3RhYmxlL3dpbmRvd3M/dXRtX3NvdXJjZT1iaW5nJnV0bV9tZWRpdW09YmFfb3NlJnV0bV9jYW1wYWlnbj1PR1hfVVNfU2VhcmNoX0VOX1QxX0JyYW5kX1YyX21zYWRzX1dJUCZ1dG1faWQ9bXNjbGtpZF84YzQ4Y2ZkZmU5ZTIxMzk2MmM5Y2E1Njc0ZTg1YjFhYSZodHRwX3JlZmVycmVyPWh0dHBzJTNBJTJGJTJGd3d3Lm9wZXJhLmNvbSUyRmd4JTJGZ3gtYnJvd3NlciUzRnV0bV9pZCUzRCUyNnV0bV9tZWRpdW0lM0RwYSUyNnV0bV9zb3VyY2UlM0RiaW5nJTI2dXRtX2NhbXBhaWduJTNET0dYX1VTX1NlYXJjaF9FTl9UMV9CcmFuZF9WMl9tc2Fkc19XSVAlMjZ1dG1fY29udGVudCUzRCUyNm1zY2xraWQlM0Q4YzQ4Y2ZkZmU5ZTIxMzk2MmM5Y2E1Njc0ZTg1YjFhYSZ1dG1fc2l0ZT1vcGVyYV9jb20mdXRtX2xhc3RwYWdlPW9wZXJhLmNvbSUyRmd4JTJGZ3gtYnJvd3NlciZ1dG1faWQ9JmRsX3Rva2VuPTI4NTMyODEyIiwidGltZXN0YW1wIjoiMTc5MDQ5NTIyNi40ODg0IiwidXNlcmFnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzE1My4wLjAuMCBTYWZhcmkvNTM3LjM2IiwidXRtIjp7ImNhbXBhaWduIjoiT0dYX1VTX1NlYXJjaF9FTl9UMV9CcmFuZF9WMl9tc2Fkc19XSVAiLCJpZCI6IiIsImxhc3RwYWdlIjoib3BlcmEuY29tL2d4L2d4LWJyb3dzZXIiLCJtZWRpdW0iOiJiYV9vc2UiLCJzaXRlIjoib3BlcmFfY29tIiwic291cmNlIjoiYmluZyJ9LCJ1dWlkIjoiZDc2YWY4ODgtMTI2My00Y2YyLTkwZTUtMThjNjFkNzAyYWJlIn0=
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Enumerates connected drives
  - Reads the TCP/IP host and domain name from the registry
  - Enumerates system info in registry
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1148
- - C:\Users\Admin\AppData\Local\Temp\7zS89956439\installer.exe
    C:\Users\Admin\AppData\Local\Temp\7zS89956439\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=136.0.6008.67 --initial-client-data=0x2a8,0x2ac,0x2b0,0x27c,0x2b4,0x7ff6c7d17998,0x7ff6c7d179a8,0x7ff6c7d179b8
    3⤵
    - Executes dropped EXE
    PID:5008
- - C:\Users\Admin\AppData\Local\Temp\.opera\f155da55-6721-41ab-bd0c-02481ce4cac5 Opera GX Installer Temp\installer.exe
    "C:\Users\Admin\AppData\Local\Temp\.opera\f155da55-6721-41ab-bd0c-02481ce4cac5 Opera GX Installer Temp\installer.exe" --version
    3⤵
    - Executes dropped EXE
    PID:3712
- - C:\Users\Admin\AppData\Local\Temp\.opera\f155da55-6721-41ab-bd0c-02481ce4cac5 Opera GX Installer Temp\opera_package_202610170027571\assistant\Opera_GX_assistant_137.0.6036.65_Setup.exe_sfx.exe
    "C:\Users\Admin\AppData\Local\Temp\.opera\f155da55-6721-41ab-bd0c-02481ce4cac5 Opera GX Installer Temp\opera_package_202610170027571\assistant\Opera_GX_assistant_137.0.6036.65_Setup.exe_sfx.exe"
    3⤵
    - Executes dropped EXE
    - Writes a Windows system DLL name to a user directory
    - System Location Discovery: System Language Discovery
    PID:6000
- - C:\Users\Admin\AppData\Local\Temp\.opera\f155da55-6721-41ab-bd0c-02481ce4cac5 Opera GX Installer Temp\opera_package_202610170027571\assistant\assistant_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\.opera\f155da55-6721-41ab-bd0c-02481ce4cac5 Opera GX Installer Temp\opera_package_202610170027571\assistant\assistant_installer.exe" --version
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:3016
  - - C:\Users\Admin\AppData\Local\Temp\.opera\f155da55-6721-41ab-bd0c-02481ce4cac5 Opera GX Installer Temp\opera_package_202610170027571\assistant\assistant_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\f155da55-6721-41ab-bd0c-02481ce4cac5 Opera GX Installer Temp\opera_package_202610170027571\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=137.0.6036.65 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0xa2b950,0xa2b95c,0xa2b968
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:4468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Hijack Execution Flow

T1574

DLL Search Order Hijacking

T1574.001

Privilege Escalation

Hijack Execution Flow

T1574

DLL Search Order Hijacking

T1574.001

Defense Evasion

Hijack Execution Flow

T1574

DLL Search Order Hijacking

T1574.001

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Opera_GX_assistant_137.0.6036.65_Setup.exe_sfx.exe

Path C:\Users\Admin\AppData\Local\Temp\.opera\f155da55-6721-41ab-bd0c-02481ce4cac5 Opera GX Installer Temp\opera_package_202610170027571\assistant\Opera_GX_assistant_137.0.6036.65_Setup.exe_sfx.exe
Size 3.2MB
SHA256 cd8129a92e34618206b386216a307a768ba8770cb76b4c16a08b35ac23c1228d
MD5 f5cedf5646d96ac3e4554d058a37de60
SHA1 2cde51206f36d00f0903ca47b7ba62f1fb24b895
SHA512 a9318118a7d4181efd23639636c3ad2494f2557efa817bf212d381c764d2e684cef54f9e551b9d2f88fd16ee47ceb6157f87d6894f19be51f2aa9a21528fbed0
SSDEEP 98304:4kio6wa48dBWXYtQLws6P1bI30vzgtzupl:4NNdtqwsOytyT
TLSH
T1B9F533237E914831D93309334D91F7BA2A7FF1611DA62D5733D80F2E6EE0293672598A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

assistant_installer.exe

Path C:\Users\Admin\AppData\Local\Temp\.opera\f155da55-6721-41ab-bd0c-02481ce4cac5 Opera GX Installer Temp\opera_package_202610170027571\assistant\assistant_installer.exe
Size 2.5MB
SHA256 d1bebcbda51c7869eebf33275e4b6c3d2b3d37df6fae74a0561cdf2dffb5b293
MD5 a672623a902efc070296061da956b435
SHA1 1eb2fc2af2a4d0c2146f9ea6619fc28af53c9981
SHA512 0ff39f11aa7ae191c8849157e769a2f768f35da3216985dcd91d5ed58c986cee742c7f8170a9b67259667de01fe63182b954dbbc1c3a8421c210380277606082
SSDEEP 49152:7qjohLttBeTJrKpGDVXCQnpWFbPFEL9ZFv1i1XTEop05MQSv:7NBeVrXV9npIbPFwvi1XT7p6M
TLSH
T1DAC59E01B860D0B5D8563072752CAB3E9E209E068735D9CBDB987CC46FB46E3267B35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

browser_assistant.exe

Path C:\Users\Admin\AppData\Local\Temp\.opera\f155da55-6721-41ab-bd0c-02481ce4cac5 Opera GX Installer Temp\opera_package_202610170027571\assistant\browser_assistant.exe
Size 5.3MB
SHA256 ca7d5883a0d16362f9adcc9787d84c3b6d0535b5c8625f44cf80b1a665f6cb63
MD5 cb353563f277957413f2166c5f29d314
SHA1 dbce83c341d573f7f3ab4b74d0aa09d646699af2
SHA512 8b0909c6e8bc3aec0a27f21255e0dbe52d598e5e712c8d4b77af4fef3de2ce084f227047f9d028e3d09937ded94218c0ff41dbc30bc73c67d945ef2e0a7c0944
SSDEEP 98304:l6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwww3:83Hk/2APJoO2akkOgyeRIK4aVP
TLSH
T17246AF82F7516078C8076571653D7B7B48285D67A722C7EF9AD83CA01BB09C2273EB4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbgcore.DLL

Path C:\Users\Admin\AppData\Local\Temp\.opera\f155da55-6721-41ab-bd0c-02481ce4cac5 Opera GX Installer Temp\opera_package_202610170027571\assistant\dbgcore.DLL
Size 238KB
SHA256 65a487c32b2b0fdb5a022a7ed54dcf6b6f8271985d50c45c432fc8acb1bdf115
MD5 5afba74463884e766afb4c41131eee7b
SHA1 975a56a7b075866fa4d9651e0b2039a7113c6af9
SHA512 f9169d42824bc88af2a3643afdcecfdab72ce070564b45437ea82f1ee24abf480ac26fba6e59720e8c6fa3bffd8239d2d23c772a2fc869566fc28a6ca7d71deb
SSDEEP 6144:PgIASx0NdOiN9a1WpPNmiFZr09fgPczwishfCpkIJnwsnpb/xetMUG:lWDFDi7yIJnwA3aMb
TLSH
T126347C61A6C48475CECB11B4724C7A3682FDD2B223E080D392549BECE9656D5AF3C2DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbghelp.dll

Path C:\Users\Admin\AppData\Local\Temp\.opera\f155da55-6721-41ab-bd0c-02481ce4cac5 Opera GX Installer Temp\opera_package_202610170027571\assistant\dbghelp.dll
Size 589KB
SHA256 2ec4dcc1209a7f59c9215c5d8f17d7b35a91b2faf84d63ca5666cb6b02e46050
MD5 7755121a98731dc9006a23e535590f5e
SHA1 6980c8cc8d8dc711a7fbb0183798ec67ab9698ec
SHA512 db905cb33cb1b3228aa26d382fa0b9eecdfc89e50a5f734e95915539d497c980fad878c46b6975f538ec4c98a07f910875e4461f5c07f0850c0c6d5653111bcf
SSDEEP 12288:OUfvs6QXZkBkp5qbhmJLKAilH77ht8YO6EIE:FfvfQXZkBkp5q1mJLKOYOd
TLSH
T110D47D71A9C04074D5EB22B0296DE73987BDF6614B3091CB63444AEDBA607F06F3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

files_list

Path C:\Users\Admin\AppData\Local\Temp\.opera\f155da55-6721-41ab-bd0c-02481ce4cac5 Opera GX Installer Temp\opera_package_202610170027571\assistant\files_list
Size 86B
SHA256 403b9075eb28634cb9000e1029fbfb968274642e3a2356d9fbc18c2ab3c60eaa
MD5 33151ad85f370b17515cfb991ba64582
SHA1 c40eabbfd28e0f93f69270958057bdf4c39f2935
SHA512 15bb590da74a00905c9acc98a4d4d93244a44868d6a148ee08e416cd9a0fd939322ffbaaebc06393aa225a59dd72ef73292b6aa055990e5143e74472222d20ea
TLSH
T15AA01204C00E048C6A802056420085FF26C324041664C280025E04C80412017074A731
MD5 SHA1 SHA512 TLSH

Submit Download

msdia140.dll

Path C:\Users\Admin\AppData\Local\Temp\.opera\f155da55-6721-41ab-bd0c-02481ce4cac5 Opera GX Installer Temp\opera_package_202610170027571\assistant\msdia140.dll
Size 2.5MB
SHA256 261c8cea0752fdbc241c9a02be493cb0dd53b033a686a2c5eb6cc24d7bd74b5a
MD5 c0034e978ffcb945a8323a0700e746ea
SHA1 8b74886d0cd0403b1fca38750333917514e2a2af
SHA512 7395ffcae7cc45bbdf605504dbea80a052d81629f19655f5a5d11afd7ee186099ed619a648a2d9ca1030b82c0da1b94208809ce7b83902e9147bf035fa26307d
SSDEEP 49152:pbrg2fTIsOXnuf7VSxLrah+N0Pl8xW/e2d5FOGB+p:W2EsOef700h+ilX/
TLSH
T126C56C70E60E8634DA8E2031DC7E6B5F52ADAAAB0B7104C773689E7D5C22CC27735587
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS89956439\installer.exe
Size 9.2MB
SHA256 b8560abe46e62b48e2c72a827928f062b4f748632284a22c497f77dd317c5bae
MD5 8f453471f3749d6c8147b1f65f1bc4bc
SHA1 1f45b61e0db69afd5ecbe195cfcf21c13b0ebb3e
SHA512 a43ae3f54776d47d66b4d38f1f0bc3f4e9ba1f7efd7f8e8cc4346aef12a6422b2f27e3866810215a21402c45982137fb0d9bbd4f8b3695a24d98f187e0b40ff3
SSDEEP 98304:ylkT8NVBZsalrvRje7nSRS0mvX1tFBI3++wteEmg:CkgN5s4Mf0w1C3+Bqg
TLSH
T194A69D53F3A601E8D06FCA749B7A5232A9357C464B30A3EF0A943A251E75FD45B3CB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat
Size 40B
SHA256 d0873ce00254b2d871d76d2d7e24f592fbd5dd7dada2f140a86e911a42b1a21c
MD5 a32bc266494edfa40f6cddd72cbfdfc1
SHA1 d513d6e9f0eff3690066773af3e54ca9ebc7b7db
SHA512 8c24114349ee699a0f9a6a246c522e922c9215dcafcbe6bd4b1e3f3eb71b896f6306e02ba92a2c9273791ce12221f7fc35f3624f525524d9aec721a439695abe
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads