887ad06d345ad2d07fa990b2cb4f48585f7dfbfb67079cc020a7cd6bec27bc65

Analysis

user interaction
yes
max time kernel
22s
max time network
18s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/08/2026, 11:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
deepseek_batch_20260822_d39fe5.bat
Size 12KB
Sample260822-nbfeksgm3s
SHA256 887ad06d345ad2d07fa990b2cb4f48585f7dfbfb67079cc020a7cd6bec27bc65
MD5 07d3171463f3ec0f28268b77c68f2d04
SHA1 ba8b1b34d07807969076188be20ad2aaed831c4e
SHA512 201e8b9c3cea2244662779436ac710a62a2e1ff980a8a575f5a730b7401f3eafce9c2ee52c11476572ed382d7c823e5dc094a49dfe422b10cc97d321641d7896
SSDEEP 384:A/aXl91UIWaj3aJdq8vMELDNavB+xDoqW4:B6IW2wQs
TLSH
T11B42C6333D21701531868A616EA5E6583358C98B41039C047E9FA1BADFCDBE1F2FE6E4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1724	cmd.exe
1744	cmd.exe
1824	cmd.exe
400	cmd.exe
3584	cmd.exe
4524	cmd.exe
1416	cmd.exe
1520	cmd.exe
1768	cmd.exe
1536	cmd.exe
3424	cmd.exe
4988	cmd.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3424 wrote to memory of 4988	3424	cmd.exe	86
PID 3424 wrote to memory of 1416	3424	cmd.exe	87
PID 3424 wrote to memory of 1724	3424	cmd.exe	88
PID 3424 wrote to memory of 1520	3424	cmd.exe	89
PID 3424 wrote to memory of 1744	3424	cmd.exe	90
PID 3424 wrote to memory of 1768	3424	cmd.exe	91
PID 3424 wrote to memory of 1824	3424	cmd.exe	92
PID 3424 wrote to memory of 400	3424	cmd.exe	93
PID 3424 wrote to memory of 1536	3424	cmd.exe	94
PID 3424 wrote to memory of 3584	3424	cmd.exe	95
PID 3424 wrote to memory of 4524	3424	cmd.exe	96

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260822_d39fe5.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Windows\system32\cmd.exe
  cmd /c exit /b 81
  2⤵
  - Executes a command shell one-liner
  PID:4988
- C:\Windows\system32\cmd.exe
  cmd /c exit /b 76
  2⤵
  - Executes a command shell one-liner
  PID:1416
- C:\Windows\system32\cmd.exe
  cmd /c exit /b 77
  2⤵
  - Executes a command shell one-liner
  PID:1724
- C:\Windows\system32\cmd.exe
  cmd /c exit /b 75
  2⤵
  - Executes a command shell one-liner
  PID:1520
- C:\Windows\system32\cmd.exe
  cmd /c exit /b 65
  2⤵
  - Executes a command shell one-liner
  PID:1744
- C:\Windows\system32\cmd.exe
  cmd /c exit /b 66
  2⤵
  - Executes a command shell one-liner
  PID:1768
- C:\Windows\system32\cmd.exe
  cmd /c exit /b 68
  2⤵
  - Executes a command shell one-liner
  PID:1824
- C:\Windows\system32\cmd.exe
  cmd /c exit /b 70
  2⤵
  - Executes a command shell one-liner
  PID:400
- C:\Windows\system32\cmd.exe
  cmd /c exit /b 82
  2⤵
  - Executes a command shell one-liner
  PID:1536
- C:\Windows\system32\cmd.exe
  cmd /c exit /b 72
  2⤵
  - Executes a command shell one-liner
  PID:3584
- C:\Windows\system32\cmd.exe
  cmd /c exit /b 69
  2⤵
  - Executes a command shell one-liner
  PID:4524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads