06abb5b4b3b37f96e169fbe6b776e1adae89c0f725018dd52839e239a881e3bd

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 15:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
06abb5b4b3b37f96e169fbe6b776e1adae89c0f725018dd52839e239a881e3bd.exe
Size 68KB
Sample260825-sshcqahf95
SHA256 06abb5b4b3b37f96e169fbe6b776e1adae89c0f725018dd52839e239a881e3bd
MD5 05d0844e0383de98e11ce47fa9454474
SHA1 47f587d2c42a804d7549bc4e7a470395d22617de
SHA512 020c8871f5426256c25bb884b1f13af623e9b25661fd344e24ebb49b2e12203d68c6763cf542b73324ea1a958974a4e2d411b37958ac1fe76376750a0bc136d1
SSDEEP 1536:tHoSCdeVMCT6ggMw4Y7FgG2xV89mTr39w6XJJzVtWc++JCZqoV:tHoLde/OgV432UcP39hXJZnWcPJBw
TLSH
T11263123FE34290D6CBD0E7B9EF57A32C56724D6A2F1805228C901F3FAF9984D84A4139
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1432-0-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral1/files/0x0007000000024465-5.dat	upx
behavioral1/memory/1432-103-0x0000000000400000-0x0000000000428000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\dextor32.exe	06abb5b4b3b37f96e169fbe6b776e1adae89c0f725018dd52839e239a881e3bd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	06abb5b4b3b37f96e169fbe6b776e1adae89c0f725018dd52839e239a881e3bd.exe

C:\Users\Admin\AppData\Local\Temp\06abb5b4b3b37f96e169fbe6b776e1adae89c0f725018dd52839e239a881e3bd.exe
"C:\Users\Admin\AppData\Local\Temp\06abb5b4b3b37f96e169fbe6b776e1adae89c0f725018dd52839e239a881e3bd.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CKY3 - Bam Margera World Industries Alien Workshop Full Downloader.exe

Path C:\Windows\Temp\CKY3 - Bam Margera World Industries Alien Workshop Full Downloader.exe
Size 68KB
SHA256 06abb5b4b3b37f96e169fbe6b776e1adae89c0f725018dd52839e239a881e3bd
MD5 05d0844e0383de98e11ce47fa9454474
SHA1 47f587d2c42a804d7549bc4e7a470395d22617de
SHA512 020c8871f5426256c25bb884b1f13af623e9b25661fd344e24ebb49b2e12203d68c6763cf542b73324ea1a958974a4e2d411b37958ac1fe76376750a0bc136d1
SSDEEP 1536:tHoSCdeVMCT6ggMw4Y7FgG2xV89mTr39w6XJJzVtWc++JCZqoV:tHoLde/OgV432UcP39hXJZnWcPJBw
TLSH
T11263123FE34290D6CBD0E7B9EF57A32C56724D6A2F1805228C901F3FAF9984D84A4139
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1432-0-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1432-103-0x0000000000400000-0x0000000000428000-memory.dmp