c2627e4cfb2704a1e843ced77c252552787f530b18b080939746a4676a50bcae

Analysis

max time kernel
149s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 08:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
植物娘大战僵尸电脑版1.1.0(1).exe
Size 795.0MB
Sample260604-krlpracw7k
SHA256 c2627e4cfb2704a1e843ced77c252552787f530b18b080939746a4676a50bcae
MD5 e1c235d9798c6b8f656946c6cc30d1e7
SHA1 136d5e63a544328a4af361655e3bde8b7d54c90d
SHA512 9e05e98153f01a70a9e6ac65e85a495f4de65b368627d73eb5a73ef931fd65dbc8e49dd6af6cab92b67dea6bde11aeb1628c83dcd59b15ef4c7069688245e8ea
SSDEEP 25165824:WvI6eX6nEK14S6N4recyPkOouzG6Rs7CZHilmrry9B1u:gIbKEK143AecyPkOoqGGs6HiyrL
TLSH
T198893390A186ABAFE12B343CE435A84577DC17BB788175E03194A3EC16EBF95C270C79
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4272	植物娘大战僵尸电脑版1.1.0(1).exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	植物娘大战僵尸电脑版1.1.0(1).exe

C:\Users\Admin\AppData\Local\Temp\植物娘大战僵尸电脑版1.1.0(1).exe
"C:\Users\Admin\AppData\Local\Temp\植物娘大战僵尸电脑版1.1.0(1).exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nso5C35.tmp\nsDialogs.dll
Size 9KB
SHA256 9a4a803f39fcf90f71d0d52b04030914ba4e1689f3d8d5ba91209bba1bcc1148
MD5 7c2a48cf2e50747ef5fc14bd5b7e216f
SHA1 a05b28cf56f5529844e633138fa057b6b1fee422
SHA512 b72ad8dc55743fea9b545b39b541c8b750403d537495fe96ea1988b9723c866323a8eb600025f4b7e20f1824dd75cdea52cedd77220dbb77a3754ce7549fabf4
SSDEEP 192:AaBOXrK3v76wuechIJgQhWku8yeNGdvCyikhYK5:AaEG/7m8hoeNGdvCJK
TLSH
T1B812E69772A8C4F6CA9F51312A866B27C374D354B0E17C0BD7774A4E696B28A3D3D302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download