54fb8b73adcd8ffb543ed9ddf242fc5fc574c6660869de153a85551b28be1710

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 11:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
54fb8b73adcd8ffb543ed9ddf242fc5fc574c6660869de153a85551b28be1710.exe
Size 65KB
Sample260826-nb6xjacn5t
SHA256 54fb8b73adcd8ffb543ed9ddf242fc5fc574c6660869de153a85551b28be1710
MD5 b72e19fb6dcde3addf4c634329c2889e
SHA1 47ecc23ce198ba9b21eee9761b06d0becb519e3b
SHA512 c1641b1b0116a152ef5edd790119fad566cfd9b144ad0f7329393166a103c47891056917dc3bd2e470de32797ff39b0ad193e549c8d8badb1ac04e1e40f39a10
SSDEEP 1536:tHoSCdeVMCT6ggMw4Y7FgG2xV89mTr39w6XJJzVtWc++hVh:tHoLde/OgV432UcP39hXJZnWcPJ
TLSH
T18F63023EE34290E6C7D0B778AF57936E45320D6B2F1506674CA01B3F6B9E84E88E4139
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4600-0-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral1/files/0x0007000000024689-5.dat	upx
behavioral1/memory/4600-103-0x0000000000400000-0x0000000000428000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\dextor32.exe	54fb8b73adcd8ffb543ed9ddf242fc5fc574c6660869de153a85551b28be1710.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	54fb8b73adcd8ffb543ed9ddf242fc5fc574c6660869de153a85551b28be1710.exe

C:\Users\Admin\AppData\Local\Temp\54fb8b73adcd8ffb543ed9ddf242fc5fc574c6660869de153a85551b28be1710.exe
"C:\Users\Admin\AppData\Local\Temp\54fb8b73adcd8ffb543ed9ddf242fc5fc574c6660869de153a85551b28be1710.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CKY3 - Bam Margera World Industries Alien Workshop Full Downloader.exe

Path C:\Windows\Temp\CKY3 - Bam Margera World Industries Alien Workshop Full Downloader.exe
Size 65KB
SHA256 54fb8b73adcd8ffb543ed9ddf242fc5fc574c6660869de153a85551b28be1710
MD5 b72e19fb6dcde3addf4c634329c2889e
SHA1 47ecc23ce198ba9b21eee9761b06d0becb519e3b
SHA512 c1641b1b0116a152ef5edd790119fad566cfd9b144ad0f7329393166a103c47891056917dc3bd2e470de32797ff39b0ad193e549c8d8badb1ac04e1e40f39a10
SSDEEP 1536:tHoSCdeVMCT6ggMw4Y7FgG2xV89mTr39w6XJJzVtWc++hVh:tHoLde/OgV432UcP39hXJZnWcPJ
TLSH
T18F63023EE34290E6C7D0B778AF57936E45320D6B2F1506674CA01B3F6B9E84E88E4139
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4600-0-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4600-103-0x0000000000400000-0x0000000000428000-memory.dmp