Overview

overview

8

Static

static

3

deepseek_p...3b.exe

windows10-2004-x64

8

deepseek_p...3b.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260618-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    25/06/2026, 16:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    deepseek_python_20260625_d1d53b.exe
  • Size 73.1MB
  • Sample260625-trc72sdw2q
  • SHA256 e0020227f28aabd279daa6541663cc34b3629fde9a4f400c5adca169a07fa2e1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasionransomware

Malware Config

Signatures

  • Disables Task Manager via registry modification
    defense_evasion
  • Drops startup file 2 IoCs
  • Loads dropped DLL 57 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\deepseek_python_20260625_d1d53b.exe
    "C:\Users\Admin\AppData\Local\Temp\deepseek_python_20260625_d1d53b.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3556
    • C:\Users\Admin\AppData\Local\Temp\deepseek_python_20260625_d1d53b.exe
      "C:\Users\Admin\AppData\Local\Temp\deepseek_python_20260625_d1d53b.exe"
      2⤵
      • Drops startup file
      • Loads dropped DLL
      • Sets desktop wallpaper using registry
      PID:5972

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        _imaging.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35562\PIL\_imaging.cp313-win_amd64.pyd
        • Size 2.5MB
        • SHA256 34b9fbd040c46776f343c65b9ecd252c1cf30e84def79294d7e2675feef1a363
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _imagingft.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35562\PIL\_imagingft.cp313-win_amd64.pyd
        • Size 2.1MB
        • SHA256 b45eeae50c452afd5fe54f475ba14b3a543cf4124752dccfad12a24b6ebec86f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35562\VCRUNTIME140.dll
        • Size 117KB
        • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35562\VCRUNTIME140_1.dll
        • Size 48KB
        • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35562\_bz2.pyd
        • Size 84KB
        • SHA256 1bf985b54f529a3cbb3e52532791cc4d4c64009142d37b54eb3521adec203d5c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35562\_ctypes.pyd
        • Size 131KB
        • SHA256 96b07339d52c74f2a1dd043df5eb931e4072eed90a3a8715ffec751d818e4117
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35562\_lzma.pyd
        • Size 155KB
        • SHA256 51815b6474d4216c6a2aeaffdae5d2ff4acb7a0236254f2cfe43247022f3d781
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35562\_socket.pyd
        • Size 84KB
        • SHA256 8676f3cebd9d01c7ad51a29b3f7ff429c0a8f6bc564cab21eb6cdaa2e26fd259
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cp1252.enc
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35562\_tcl_data\encoding\cp1252.enc
        • Size 1KB
        • SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        _tkinter.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35562\_tkinter.pyd
        • Size 68KB
        • SHA256 0a24e5f2e8ba3b774a335385c4036791b56c1c217f4371385517a92bbaac3d0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35562\_wmi.pyd
        • Size 38KB
        • SHA256 9a7255064ea143895b28efea6d78e9e518bac290900aec52a6a0435c36a172fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35562\base_library.zip
        • Size 1.3MB
        • SHA256 96e87fa5a531f6cccf52d4bd02ad2edba70238133e493093f3e748bf546c8f0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        __init__.py
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35562\cv2\__init__.py
        • Size 6KB
        • SHA256 957a91bfd98ffb07a10cd789b7c5c46806568476b61e34c7ad56a00092b981a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        config-3.py
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35562\cv2\config-3.py
        • Size 748B
        • SHA256 de28c7b5213cca148f09469916584611b3d66c1c8c432880259d6a3a92380213
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        config.py
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35562\cv2\config.py
        • Size 123B
        • SHA256 6c6367abce55995ae4a8d3c199420ec53afab287cb17dfc2f430378af75dd301
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        __init__.py
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35562\cv2\data\__init__.py
        • Size 73B
        • SHA256 f4ce16721ed7f623a4dcc443ba600d1856db610cb2c3d53c13a8ca028cc68f6d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        __init__.py
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35562\cv2\gapi\__init__.py
        • Size 10KB
        • SHA256 74f5fd2a142a31b0a4707b70c0be3637f0fbf8a940eec4372e7ba87e5a5cedb8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        load_config_py3.py
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35562\cv2\load_config_py3.py
        • Size 253B
        • SHA256 074dfaf20ac94f2ca3815393de3a394944470334c51a85b9521f452e0e17bb85
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        __init__.py
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35562\cv2\mat_wrapper\__init__.py
        • Size 1KB
        • SHA256 c44707ea1c76f35518ae572b6c1989d76c2ada7e850432e41805dfe112d4e306
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        __init__.py
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35562\cv2\misc\__init__.py
        • Size 38B
        • SHA256 495bd79594cce174673e372c85c4dd8f4ffdf2b3a73fd4623955b0d55de0d462
        • MD5 SHA1 SHA512
        Submit Download

        version.py
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35562\cv2\misc\version.py
        • Size 95B
        • SHA256 c93a418793fcb15b9b4316c0741b8336740e490e94f3b7d1ebe8cd5f6f23815c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        __init__.py
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35562\cv2\typing\__init__.py
        • Size 5KB
        • SHA256 ea34b321bd7ec0c970170056923cfa24c7100f94c7fb80bcf07e923c43db2036
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        __init__.py
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35562\cv2\utils\__init__.py
        • Size 344B
        • SHA256 2b16990b35b569af1ca7239dc10f7b24ec62f27a46626b1e2f1271d2e1aa3554
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        version.py
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35562\cv2\version.py
        • Size 97B
        • SHA256 a0f4881984ab057437cf5692d2d5ec35049698f4acc2b43c755f2d276df45a7a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35562\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libscipy_openblas64_-63c857e738469261263c764a36be9436.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35562\numpy.libs\libscipy_openblas64_-63c857e738469261263c764a36be9436.dll
        • Size 19.5MB
        • SHA256 63c857e738469261263c764a36be9436ebdeaa272e340a828f42047a97131080
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35562\numpy.libs\msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll
        • Size 561KB
        • SHA256 a4c2229bdc2a2a630acdc095b4d86008e5c3e3bc7773174354f3da4f5beb9cde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _multiarray_umath.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35562\numpy\_core\_multiarray_umath.cp313-win_amd64.pyd
        • Size 3.5MB
        • SHA256 4341f3ad7cfd58450ea46ea874dfe0842aa085ba363ed3aa699db7ac1bc57eac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _umath_linalg.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35562\numpy\linalg\_umath_linalg.cp313-win_amd64.pyd
        • Size 109KB
        • SHA256 b6f830db2fadf00142c074cb106e6d74c1cd0d6045467a6251727f7b46d8f139
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SDL2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35562\pygame\SDL2.dll
        • Size 2.4MB
        • SHA256 520d0459b91efa32fbccf9027a9ca1fc5aae657e679ce8e90f179f9cf5afd279
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35562\pygame\base.cp313-win_amd64.pyd
        • Size 30KB
        • SHA256 66d997da2dd61b2f20cb042bcdf4e50ce9e76af8cfa23ba0130aafe25ac407ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        constants.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35562\pygame\constants.cp313-win_amd64.pyd
        • Size 49KB
        • SHA256 c346ee23b6695ed6280f71d13cd4c5ecef569e12f331508008e60371e4350207
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35562\python3.DLL
        • Size 70KB
        • SHA256 cbc4876275178244905ee45a9ee6ec9fa4bfb9aad6209a03b756d38a186f80d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python313.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35562\python313.dll
        • Size 5.8MB
        • SHA256 6964e590037c41d631fd1215f05af154f7fa68105993c6f573a20689b473f1ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35562\select.pyd
        • Size 32KB
        • SHA256 ddf1221851814943a82ed8a986d228463404da2ada969661bdd69223f14fc050
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tcl86t.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35562\tcl86t.dll
        • Size 1.8MB
        • SHA256 a308beae8555cff5ac2aff7eaf0aef40b5fe173f047e246dc49da9a4d3ef62f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tk86t.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35562\tk86t.dll
        • Size 1.5MB
        • SHA256 20f4876506bce7f89e53570e64fd1dce30a64548326b45f372871c7019560df4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        zlib1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35562\zlib1.dll
        • Size 106KB
        • SHA256 b1f58a17f3bfd55523e7bef685acf5b32d1c2a6f25abdcd442681266fd26ab08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/5972-1142-0x0000000062E80000-0x0000000062EA4000-memory.dmp
        Download

        memory/5972-1144-0x00007FFE757C0000-0x00007FFE75A2C000-memory.dmp
        Download

        memory/5972-1143-0x00007FFE76C80000-0x00007FFE78001000-memory.dmp
        Download

        memory/5972-1150-0x00007FFE757C0000-0x00007FFE75A2C000-memory.dmp
        Download

        memory/5972-1151-0x0000000062E80000-0x0000000062EA4000-memory.dmp
        Download

        memory/5972-1153-0x00007FFE757C0000-0x00007FFE75A2C000-memory.dmp
        Download

        memory/5972-1152-0x00007FFE76C80000-0x00007FFE78001000-memory.dmp
        Download