Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/06/2026, 15:32
Behavioral task
behavioral1
Sample
deepseek_python_20260625_a89e04.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
deepseek_python_20260625_a89e04.exe
Resource
win11ltsc2024-20260618-en
2 signatures
150 seconds
General
- Target deepseek_python_20260625_a89e04.exe
- Size 10.0MB
- Sample260625-sys2eacz3z
- SHA256 30d0a866206281e3621ebb7175661220016dbf5a5b2faac1f0d2fe1ae33c8ac5
- MD5 434db71a0b356961c2e050d378b7a183
- SHA1 0ab98ccafdf6f83637604ce32b0e099845ff9ed9
- SHA512 e313fe89f36808afff1f5524b787f058e2e978f737e6c36a4affbc8d05a229c6406e3d1f6e236ffe375ba4b99a131960033c09586b18d28f8640d7fd2c7acf72
- SSDEEP 196608:rYmS0W8UACYfCEbvs+Hc/IDtT9OiJ4Jkz9Rwpr2Zwl6LumwwtmPCah:rPW8iuCMs+8ADtAiJLwq+weh
- TLSH T113B6338CB78409B4E4D7F27999D2942762B1702307B086DB57F50DA60D732E8FEB9B21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 10 IoCs
pid Process 1296 deepseek_python_20260625_a89e04.exe 1296 deepseek_python_20260625_a89e04.exe 1296 deepseek_python_20260625_a89e04.exe 1296 deepseek_python_20260625_a89e04.exe 1296 deepseek_python_20260625_a89e04.exe 1296 deepseek_python_20260625_a89e04.exe 1296 deepseek_python_20260625_a89e04.exe 1296 deepseek_python_20260625_a89e04.exe 1296 deepseek_python_20260625_a89e04.exe 1296 deepseek_python_20260625_a89e04.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4928 wrote to memory of 1296 4928 deepseek_python_20260625_a89e04.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\deepseek_python_20260625_a89e04.exe"C:\Users\Admin\AppData\Local\Temp\deepseek_python_20260625_a89e04.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\deepseek_python_20260625_a89e04.exe"C:\Users\Admin\AppData\Local\Temp\deepseek_python_20260625_a89e04.exe"2⤵
- Loads dropped DLL
PID:1296
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_MEI49282\VCRUNTIME140.dll
- Size 117KB
- SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
- MD5 32da96115c9d783a0769312c0482a62d
- SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
- SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
- SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
- TLSH T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI49282\_bz2.pyd
- Size 84KB
- SHA256 1bf985b54f529a3cbb3e52532791cc4d4c64009142d37b54eb3521adec203d5c
- MD5 0a18953eb45266704171cbe54c6dd261
- SHA1 15f7edd8d0ac559d912d64503fd68f1a8d4c58f7
- SHA512 e5f1bef48695b4fae556113a2ccc6ed1e1cf49fa319b94f052705e809eba2543db16fcf955ac9c01de4d81746c90abc85d717004b6b3b1071b27696c6838068b
- SSDEEP 1536:QVF5z780RCmmgKRF2OXvLJnmEmdBv8ZEs8iEEx0ZIILVfy7NsR9QfIbHbvTcE:yF5zIjmNAAOfLKdB0ZXjxx0ZIILVdTl
- TLSH T194838E47B76461F6F9AF81B496910353F730BE960710A3AFB24482953F13B91EE6831A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI49282\_ctypes.pyd
- Size 131KB
- SHA256 96b07339d52c74f2a1dd043df5eb931e4072eed90a3a8715ffec751d818e4117
- MD5 b865b6717d0bb9c909c21997e5e43878
- SHA1 6b7bc1d2d8a5fa1816b8c83806c8bda0d766c4f6
- SHA512 a1cd8e5e1bc5b5ee78226eb9a3dbc2054ae7ca2cddb592eb287606aae3ade7e76f821b036837aff15675a177938418d8030841b3fab667c0288235b2595abb75
- SSDEEP 3072:iuZHKSoKYuYz5sdf/FVzy4PKzblEUS1IIyP7Tv:doR8f/FVzyIKzKUS0v
- TLSH T1F5D38E0B776800AADAA78178C533AF47EFB1B453161057CF02A4C59A2F63B966E7F305
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI49282\_lzma.pyd
- Size 155KB
- SHA256 51815b6474d4216c6a2aeaffdae5d2ff4acb7a0236254f2cfe43247022f3d781
- MD5 8aab96a90295cac7b047fc706a118823
- SHA1 e9ce0ae765d65ba9c4d7d3f9cbf61622f5633ca2
- SHA512 2a10aeb5783bd1d99dea0200f577bdeb95f36dc328063fb8d3a54fb70e7ac74251f03d424f2ba4fcdd5359f92d6b9106a124403bde6dd154bebfc5c7b7fbf6f7
- SSDEEP 3072:mK1fxbqH1ZTffdFj+JnTqznfB9mNohPRHdZII01dkTB:m6Jbq7vsnTc5YOXHdwIB
- TLSH T1DCF34B86B794F0E5F3728C38D6624F57E6F5791A0320929E01CC936D2B1FB659A2E313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI49282\_tcl_data\encoding\cp1252.enc
- Size 1KB
- SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
- MD5 e9117326c06fee02c478027cb625c7d8
- SHA1 2ed4092d573289925a5b71625cf43cc82b901daf
- SHA512 d0a39bc41adc32f2f20b1a0ebad33bf48dfa6ed5cc1d8f92700cdd431db6c794c09d9f08bb5709b394acf54116c3a1e060e2abcc6b503e1501f8364d3eebcd52
- TLSH T13621362446A58CD8FA4F31D520ECFB70453B75F3D1DA629027B88308E789E8D0C897D9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI49282\_tkinter.pyd
- Size 68KB
- SHA256 0a24e5f2e8ba3b774a335385c4036791b56c1c217f4371385517a92bbaac3d0e
- MD5 e3d7308ddaa422e3e0a7a3d62ae4a0cd
- SHA1 7cf59a7bb868e4ffb4c72233f87c60df70c6fb76
- SHA512 b8c62b7fcb32adaecd1f27566776075c7e3558edfec75ef5fcf66292e2c115bfbaf8768b2922fd2c07e5da067db01d75c5d608041cf5ce9486fa36e62dcad74d
- SSDEEP 1536:v6f9aZoKcQpWhUDlU9oUq41su+46zyRIIvSE6y7NsR9kfILAy:v6lJKrlPb41o43RIIvSEoN
- TLSH T100637C8BA7A9008BDEA3D135C5B3DF13E675B6521A10920F02A4D35A2F333D393B9758
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI49282\base_library.zip
- Size 1.3MB
- SHA256 394246ec9801b3a431d45b4da7e38245fc76a2ea6d9c677a5ce74d1992d5a32c
- MD5 d39820c9689eb65ad580a69a3c45c3a6
- SHA1 8207084fc76fa31a5c2411769835d8c3480fdd2c
- SHA512 5e66d3ed1922cbfe096dae7a6e43504a478aabfe102810ea5f5539daace1cd8ef8075e14cfd1ce45cfa823a2d6a4d3b4760a98d26233a7b32963ebcaae4ddb70
- SSDEEP 12288:+djdTwi2cPPdxhY+jEAYfI5vyW7WpP6vLL+DIwt+tYzGN8TxZvMi/FUDqfBuIvaw:+dZw5cPPdxhY+jn7WpAASuTxV1l11
- TLSH T1C5551992B9527953FF64F37B80B7484CF31E86A2EF00C207355E42661EFE6B09E59588
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI49282\libffi-8.dll
- Size 38KB
- SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
- MD5 0f8e4992ca92baaf54cc0b43aaccce21
- SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
- SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
- SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
- TLSH T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI49282\python313.dll
- Size 5.8MB
- SHA256 6964e590037c41d631fd1215f05af154f7fa68105993c6f573a20689b473f1ac
- MD5 5a7cbaa796ee41e35b5e6bdf4e024e48
- SHA1 868b787184e90a277f065d7d0b830772bdd6e52f
- SHA512 69dded87aee32562f57c50c5b1a3f99c7f64089226d911751cae314bc451bbd2d3e4a9c9410a532f4fefffcc4687d7c26e609d5aea13b077aefd1070151d5f6f
- SSDEEP 98304:aE6YlbgK3Lv6PVN1Wgz52Wv3HDMiE9o1w:aE6M3j6PV/Git1w
- TLSH T1FB568C16729E51ACC97B8078CA13864BFBB27C053F60434B61E6BB5E2F73362466E705
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI49282\tcl86t.dll
- Size 1.8MB
- SHA256 a308beae8555cff5ac2aff7eaf0aef40b5fe173f047e246dc49da9a4d3ef62f9
- MD5 fa83a807131f3d4a6070eb884e682ad1
- SHA1 226bf1cd0fc289034d9579c95ee0fe4df50cc6b8
- SHA512 6e86f3725bb68af581e3e1b917c950f255e0f4348256fc02d8a560159cd225fe28303da2554c205636f2f82b9757072bf0c3460116bd7b09ef0bf01cc46125a2
- SSDEEP 49152:D0W4UbmMRbf0TIWn5SDf/qxF+PJJHmkY7C4wJreAJGP:YBUqMR7i6x9T+P
- TLSH T1E6859F1BE76410ACD8ABD1BCC227E60BDFF1B559136066DB51A08B912F23FE1277A305
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI49282\tk86t.dll
- Size 1.5MB
- SHA256 20f4876506bce7f89e53570e64fd1dce30a64548326b45f372871c7019560df4
- MD5 0da8eb1421517029c8d986519b0e5c63
- SHA1 daa8395b9d691b5dfbdaa1f63256555a14010891
- SHA512 f729f812901cc023111989d6e1eaa639d2ed2283bdb852c91abc283dee3d785295d3191f70f2ef535d268d454279a7ddd0339993f06be21b62d43d8ab27d70af
- SSDEEP 49152:A76DXYkBMhchLNqaJvARxr9DrTwylL1y62BEqkEH0CF2MT2JTBKa8SERGezf5:VQchLNqaJvARxr9DrTwylL1y5BEq8JTW
- TLSH T16E755A06B2A0C198C66FA134C91796BAE7F17C05931057DB72A0BE697F73BD2673A304
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI49282\zlib1.dll
- Size 142KB
- SHA256 1dd27f0411ebb31bd148a61589cee254410915f1e6c37aa3ffa52fac71a5426c
- MD5 eb3af30a0981219d851e6506db106bc2
- SHA1 fd7b1b01dc01a7f32bd51f9a31bf717f4d55d09c
- SHA512 8f55f4a86b747b5570d0f539c95dc1677eeba52bcd01850e8d86998b3415b99c92566ad9ece0e46b50e0e3a7eed6a4fe09604ec295f36f9bebf6e8f407ace468
- SSDEEP 3072:0vEO6FnGGVV1m4dkRR5Th2UgvGxbOUJCoV:0sVD+RrFgvi7J9
- TLSH T1C8E37D9BA6E228BDC67780B052E78776F932B8214B309DEF5148C7741B12E506B197FC
- MD5 SHA1 SHA512 SSDEEP TLSH