Analysis
- user interaction
yes - max time kernel
149s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/06/2026, 15:32
Behavioral task
behavioral1
Sample
deepseek_python_20260625_a89e04.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
deepseek_python_20260625_a89e04.exe
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target deepseek_python_20260625_a89e04.exe
- Size 10.0MB
- Sample260625-sys2eacz3z
- SHA256 30d0a866206281e3621ebb7175661220016dbf5a5b2faac1f0d2fe1ae33c8ac5
- MD5 434db71a0b356961c2e050d378b7a183
- SHA1 0ab98ccafdf6f83637604ce32b0e099845ff9ed9
- SHA512 e313fe89f36808afff1f5524b787f058e2e978f737e6c36a4affbc8d05a229c6406e3d1f6e236ffe375ba4b99a131960033c09586b18d28f8640d7fd2c7acf72
- SSDEEP 196608:rYmS0W8UACYfCEbvs+Hc/IDtT9OiJ4Jkz9Rwpr2Zwl6LumwwtmPCah:rPW8iuCMs+8ADtAiJLwq+weh
- TLSH T113B6338CB78409B4E4D7F27999D2942762B1702307B086DB57F50DA60D732E8FEB9B21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 10 IoCs
pid Process 800 deepseek_python_20260625_a89e04.exe 800 deepseek_python_20260625_a89e04.exe 800 deepseek_python_20260625_a89e04.exe 800 deepseek_python_20260625_a89e04.exe 800 deepseek_python_20260625_a89e04.exe 800 deepseek_python_20260625_a89e04.exe 800 deepseek_python_20260625_a89e04.exe 800 deepseek_python_20260625_a89e04.exe 800 deepseek_python_20260625_a89e04.exe 800 deepseek_python_20260625_a89e04.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3424 taskmgr.exe Token: SeSystemProfilePrivilege 3424 taskmgr.exe Token: SeCreateGlobalPrivilege 3424 taskmgr.exe Token: 33 3424 taskmgr.exe Token: SeIncBasePriorityPrivilege 3424 taskmgr.exe - Suspicious use of FindShellTrayWindow 31 IoCs
pid Process 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe - Suspicious use of SendNotifyMessage 31 IoCs
pid Process 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe 3424 taskmgr.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 824 wrote to memory of 800 824 deepseek_python_20260625_a89e04.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\deepseek_python_20260625_a89e04.exe"C:\Users\Admin\AppData\Local\Temp\deepseek_python_20260625_a89e04.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\deepseek_python_20260625_a89e04.exe"C:\Users\Admin\AppData\Local\Temp\deepseek_python_20260625_a89e04.exe"2⤵
- Loads dropped DLL
PID:800
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3424
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_MEI8242\VCRUNTIME140.dll
- Size 117KB
- SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
- MD5 32da96115c9d783a0769312c0482a62d
- SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
- SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
- SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
- TLSH T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI8242\_bz2.pyd
- Size 84KB
- SHA256 1bf985b54f529a3cbb3e52532791cc4d4c64009142d37b54eb3521adec203d5c
- MD5 0a18953eb45266704171cbe54c6dd261
- SHA1 15f7edd8d0ac559d912d64503fd68f1a8d4c58f7
- SHA512 e5f1bef48695b4fae556113a2ccc6ed1e1cf49fa319b94f052705e809eba2543db16fcf955ac9c01de4d81746c90abc85d717004b6b3b1071b27696c6838068b
- SSDEEP 1536:QVF5z780RCmmgKRF2OXvLJnmEmdBv8ZEs8iEEx0ZIILVfy7NsR9QfIbHbvTcE:yF5zIjmNAAOfLKdB0ZXjxx0ZIILVdTl
- TLSH T194838E47B76461F6F9AF81B496910353F730BE960710A3AFB24482953F13B91EE6831A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI8242\_ctypes.pyd
- Size 131KB
- SHA256 96b07339d52c74f2a1dd043df5eb931e4072eed90a3a8715ffec751d818e4117
- MD5 b865b6717d0bb9c909c21997e5e43878
- SHA1 6b7bc1d2d8a5fa1816b8c83806c8bda0d766c4f6
- SHA512 a1cd8e5e1bc5b5ee78226eb9a3dbc2054ae7ca2cddb592eb287606aae3ade7e76f821b036837aff15675a177938418d8030841b3fab667c0288235b2595abb75
- SSDEEP 3072:iuZHKSoKYuYz5sdf/FVzy4PKzblEUS1IIyP7Tv:doR8f/FVzyIKzKUS0v
- TLSH T1F5D38E0B776800AADAA78178C533AF47EFB1B453161057CF02A4C59A2F63B966E7F305
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI8242\_decimal.pyd
- Size 280KB
- SHA256 398117a6af493e34f56ec0d78ced9901b20b8e895686ce5966edeadb23507056
- MD5 0ba233f4afd6a256463b252e00bf4cb5
- SHA1 4a585ca379e1157c0124067a0f2c3bad87bf6688
- SHA512 24afacaf1db65f89eb62ad2fa17fb91c96354656e45ad595a1c84427c1ee31ab8bb87c509b9c119c4872b0a18792295600d8d1cab7664da2eef0aae2b001f6e0
- SSDEEP 6144:rL107gegKHJ/lvdr0bCGqqM33fIWeAssREsMbbd3:318gegKJlvSbSYN3
- TLSH T14F546C57A3890CA8EA7780749A579F47F7B278860360D38F43B48A973F93792236D744
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI8242\_hashlib.pyd
- Size 67KB
- SHA256 50f3ce7a2281fd32f378f3ba5067bdd13e18ee95877db5199c6a0babdc9c516a
- MD5 7715e3df55b6783704fdda2a3850919e
- SHA1 553bf2e027251497c2b40cbec2fade2c5952b5ab
- SHA512 f9b4774a34185425b630aabc6be70e5c974d2aa87690044695e9ae33368363321abd2505ace723f7ee1cf04041ff98dba0fb918b3d020419d9db7a66d3af3396
- SSDEEP 1536:9qXn1yAu1lEAXfXVfcV5TaSZ6CARIIvIcy7NsR9tfIksk:O1w1uAdfcySZ6CARIIvIVy
- TLSH T1FC637C95AA894092D96382B6C4A34F83F971F35217119BDFA2A8C0CD2F233C39777756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI8242\_lzma.pyd
- Size 155KB
- SHA256 51815b6474d4216c6a2aeaffdae5d2ff4acb7a0236254f2cfe43247022f3d781
- MD5 8aab96a90295cac7b047fc706a118823
- SHA1 e9ce0ae765d65ba9c4d7d3f9cbf61622f5633ca2
- SHA512 2a10aeb5783bd1d99dea0200f577bdeb95f36dc328063fb8d3a54fb70e7ac74251f03d424f2ba4fcdd5359f92d6b9106a124403bde6dd154bebfc5c7b7fbf6f7
- SSDEEP 3072:mK1fxbqH1ZTffdFj+JnTqznfB9mNohPRHdZII01dkTB:m6Jbq7vsnTc5YOXHdwIB
- TLSH T1DCF34B86B794F0E5F3728C38D6624F57E6F5791A0320929E01CC936D2B1FB659A2E313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI8242\_socket.pyd
- Size 84KB
- SHA256 8676f3cebd9d01c7ad51a29b3f7ff429c0a8f6bc564cab21eb6cdaa2e26fd259
- MD5 62b775fc816033e9df749b5fe77cc921
- SHA1 9966268c186c99db7dab32749fd7acb5f0d4c6d0
- SHA512 daa1cc564a67c431f3091b1658426cc019088f52d9dec8951c9620b442d6e3f401d37e9778133b63360f8e310e5e7635d676747761d6b5e202538b6a0fd9c0e7
- SSDEEP 1536:iFl/fFBFu9aBvtgYKyNEyJwRQlyJ+i+nzFQwLvxtq388Z1IIywDy7NsR9UfIbH7S:iFR1u9mvPEyJwRQlyJL+nzFQSvxSx1I1
- TLSH T10C835B01A66040F6EB73D175C2679E63FB74B1C01395A75F0066C65A2F33382BF7AA86
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI8242\_tcl_data\encoding\cp1252.enc
- Size 1KB
- SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
- MD5 e9117326c06fee02c478027cb625c7d8
- SHA1 2ed4092d573289925a5b71625cf43cc82b901daf
- SHA512 d0a39bc41adc32f2f20b1a0ebad33bf48dfa6ed5cc1d8f92700cdd431db6c794c09d9f08bb5709b394acf54116c3a1e060e2abcc6b503e1501f8364d3eebcd52
- TLSH T13621362446A58CD8FA4F31D520ECFB70453B75F3D1DA629027B88308E789E8D0C897D9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI8242\_tkinter.pyd
- Size 68KB
- SHA256 0a24e5f2e8ba3b774a335385c4036791b56c1c217f4371385517a92bbaac3d0e
- MD5 e3d7308ddaa422e3e0a7a3d62ae4a0cd
- SHA1 7cf59a7bb868e4ffb4c72233f87c60df70c6fb76
- SHA512 b8c62b7fcb32adaecd1f27566776075c7e3558edfec75ef5fcf66292e2c115bfbaf8768b2922fd2c07e5da067db01d75c5d608041cf5ce9486fa36e62dcad74d
- SSDEEP 1536:v6f9aZoKcQpWhUDlU9oUq41su+46zyRIIvSE6y7NsR9kfILAy:v6lJKrlPb41o43RIIvSEoN
- TLSH T100637C8BA7A9008BDEA3D135C5B3DF13E675B6521A10920F02A4D35A2F333D393B9758
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI8242\base_library.zip
- Size 1.3MB
- SHA256 394246ec9801b3a431d45b4da7e38245fc76a2ea6d9c677a5ce74d1992d5a32c
- MD5 d39820c9689eb65ad580a69a3c45c3a6
- SHA1 8207084fc76fa31a5c2411769835d8c3480fdd2c
- SHA512 5e66d3ed1922cbfe096dae7a6e43504a478aabfe102810ea5f5539daace1cd8ef8075e14cfd1ce45cfa823a2d6a4d3b4760a98d26233a7b32963ebcaae4ddb70
- SSDEEP 12288:+djdTwi2cPPdxhY+jEAYfI5vyW7WpP6vLL+DIwt+tYzGN8TxZvMi/FUDqfBuIvaw:+dZw5cPPdxhY+jn7WpAASuTxV1l11
- TLSH T1C5551992B9527953FF64F37B80B7484CF31E86A2EF00C207355E42661EFE6B09E59588
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI8242\libcrypto-3.dll
- Size 5.0MB
- SHA256 eaf6d613b95b61a39558d84c50e72630a66c99914292df88e7b54ebd60c5bd34
- MD5 7e8a8461fcd43c82841a99a2054711f1
- SHA1 a931808c56e3a117795491965cb3f679cdc05886
- SHA512 023c34e26b7dc7240d4571f8f808bdd0b749bd6e924948c3db9c5bb4f7acf24557d3a94bfe6ff82697f9747b35c13a73b94482dff3568e1dadb8fe08b598bc61
- SSDEEP 98304:on+c+4Vp8XhjqO58Pw1CPwDvt3uFlDCQ9p:mPTVpghjqO5841CPwDvt3uFlDCQ/
- TLSH T147367B6AA7A80189E4BAC13CC9534617D2B1F81A57B097CF18A156BD0F37FDA2B3D740
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI8242\libffi-8.dll
- Size 38KB
- SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
- MD5 0f8e4992ca92baaf54cc0b43aaccce21
- SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
- SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
- SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
- TLSH T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI8242\python313.dll
- Size 5.8MB
- SHA256 6964e590037c41d631fd1215f05af154f7fa68105993c6f573a20689b473f1ac
- MD5 5a7cbaa796ee41e35b5e6bdf4e024e48
- SHA1 868b787184e90a277f065d7d0b830772bdd6e52f
- SHA512 69dded87aee32562f57c50c5b1a3f99c7f64089226d911751cae314bc451bbd2d3e4a9c9410a532f4fefffcc4687d7c26e609d5aea13b077aefd1070151d5f6f
- SSDEEP 98304:aE6YlbgK3Lv6PVN1Wgz52Wv3HDMiE9o1w:aE6M3j6PV/Git1w
- TLSH T1FB568C16729E51ACC97B8078CA13864BFBB27C053F60434B61E6BB5E2F73362466E705
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI8242\select.pyd
- Size 32KB
- SHA256 ddf1221851814943a82ed8a986d228463404da2ada969661bdd69223f14fc050
- MD5 aa8843971de4ca77a14a895da3fa579b
- SHA1 95812c71a6dcdbbb1d2fdf8fb0032d00e90f1d44
- SHA512 2411886cec792df496846c0119aa9330edf7229eebe73b97145afc722961d41a6433c03420c4d23728bdc047e4efafc332a341b82eba1337e0b4bd2fbc1ae32a
- SSDEEP 768:rpX5WHfPLTaP1II9GQhy5RNLaRYT2Ip4MfTxf1ml6Z+7UbFgGHl:dX5W/P/aP1II9Gwy7NsR9GfILEzl
- TLSH T1FEE26CCA5F685047E6A3CA31C6E2DE43F939B3A35611869F30B992991E177C0E337358
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI8242\tcl86t.dll
- Size 1.8MB
- SHA256 a308beae8555cff5ac2aff7eaf0aef40b5fe173f047e246dc49da9a4d3ef62f9
- MD5 fa83a807131f3d4a6070eb884e682ad1
- SHA1 226bf1cd0fc289034d9579c95ee0fe4df50cc6b8
- SHA512 6e86f3725bb68af581e3e1b917c950f255e0f4348256fc02d8a560159cd225fe28303da2554c205636f2f82b9757072bf0c3460116bd7b09ef0bf01cc46125a2
- SSDEEP 49152:D0W4UbmMRbf0TIWn5SDf/qxF+PJJHmkY7C4wJreAJGP:YBUqMR7i6x9T+P
- TLSH T1E6859F1BE76410ACD8ABD1BCC227E60BDFF1B559136066DB51A08B912F23FE1277A305
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI8242\tk86t.dll
- Size 1.5MB
- SHA256 20f4876506bce7f89e53570e64fd1dce30a64548326b45f372871c7019560df4
- MD5 0da8eb1421517029c8d986519b0e5c63
- SHA1 daa8395b9d691b5dfbdaa1f63256555a14010891
- SHA512 f729f812901cc023111989d6e1eaa639d2ed2283bdb852c91abc283dee3d785295d3191f70f2ef535d268d454279a7ddd0339993f06be21b62d43d8ab27d70af
- SSDEEP 49152:A76DXYkBMhchLNqaJvARxr9DrTwylL1y62BEqkEH0CF2MT2JTBKa8SERGezf5:VQchLNqaJvARxr9DrTwylL1y5BEq8JTW
- TLSH T16E755A06B2A0C198C66FA134C91796BAE7F17C05931057DB72A0BE697F73BD2673A304
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI8242\unicodedata.pyd
- Size 695KB
- SHA256 b965a80346ee95dbec0b147faab329f3276ba24fceb8df5df171367649f116f3
- MD5 d5ca99b1befd647ee910150bf751967d
- SHA1 331fc08a5f29f5f9ff726db4eaa1a0e9b0b44ba2
- SHA512 384c2456febd975399ff66b4ef80531190bcdc9ed5c785158551cc273f9ba002fac1e8a2f5af282ed475d03af27e75f352cd4f0fbe61f19b2ee64f602e013815
- SSDEEP 12288:GSYUdLI/X77mvfldCK1ihH32W3cnPSqrUgGgIS:GSYUW7qNxq3cnPXGgJ
- TLSH T1EFE4F5D9BBCF8D26E69B363948E3710F5171C3735F0A863AB2182361D85B3B449D582E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI8242\zlib1.dll
- Size 142KB
- SHA256 1dd27f0411ebb31bd148a61589cee254410915f1e6c37aa3ffa52fac71a5426c
- MD5 eb3af30a0981219d851e6506db106bc2
- SHA1 fd7b1b01dc01a7f32bd51f9a31bf717f4d55d09c
- SHA512 8f55f4a86b747b5570d0f539c95dc1677eeba52bcd01850e8d86998b3415b99c92566ad9ece0e46b50e0e3a7eed6a4fe09604ec295f36f9bebf6e8f407ace468
- SSDEEP 3072:0vEO6FnGGVV1m4dkRR5Th2UgvGxbOUJCoV:0sVD+RrFgvi7J9
- TLSH T1C8E37D9BA6E228BDC67780B052E78776F932B8214B309DEF5148C7741B12E506B197FC
- MD5 SHA1 SHA512 SSDEEP TLSH