887ad06d345ad2d07fa990b2cb4f48585f7dfbfb67079cc020a7cd6bec27bc65

Analysis

user interaction
yes
max time kernel
598s
max time network
454s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 11:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
deepseek_batch_20260822_d39fe5.bat
Size 12KB
Sample260822-nbfeksgm3s
SHA256 887ad06d345ad2d07fa990b2cb4f48585f7dfbfb67079cc020a7cd6bec27bc65
MD5 07d3171463f3ec0f28268b77c68f2d04
SHA1 ba8b1b34d07807969076188be20ad2aaed831c4e
SHA512 201e8b9c3cea2244662779436ac710a62a2e1ff980a8a575f5a730b7401f3eafce9c2ee52c11476572ed382d7c823e5dc094a49dfe422b10cc97d321641d7896
SSDEEP 384:A/aXl91UIWaj3aJdq8vMELDNavB+xDoqW4:B6IW2wQs
TLSH
T11B42C6333D21701531868A616EA5E6583358C98B41039C047E9FA1BADFCDBE1F2FE6E4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 13 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4800	cmd.exe
2260	cmd.exe
1860	cmd.exe
124	cmd.exe
808	cmd.exe
5232	cmd.exe
5884	cmd.exe
3372	cmd.exe
1816	cmd.exe
3976	cmd.exe
464	cmd.exe
4712	cmd.exe
3168	cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 1860	2260	cmd.exe	90
PID 2260 wrote to memory of 3976	2260	cmd.exe	91
PID 2260 wrote to memory of 464	2260	cmd.exe	92
PID 2260 wrote to memory of 124	2260	cmd.exe	93
PID 2260 wrote to memory of 808	2260	cmd.exe	94
PID 2260 wrote to memory of 5232	2260	cmd.exe	95
PID 2260 wrote to memory of 4712	2260	cmd.exe	96
PID 2260 wrote to memory of 3168	2260	cmd.exe	97
PID 2260 wrote to memory of 5884	2260	cmd.exe	98
PID 2260 wrote to memory of 3372	2260	cmd.exe	99
PID 2260 wrote to memory of 1816	2260	cmd.exe	100
PID 2260 wrote to memory of 4800	2260	cmd.exe	101

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260822_d39fe5.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Windows\system32\cmd.exe
  cmd /c exit /b 76
  2⤵
  - Executes a command shell one-liner
  PID:1860
- C:\Windows\system32\cmd.exe
  cmd /c exit /b 84
  2⤵
  - Executes a command shell one-liner
  PID:3976
- C:\Windows\system32\cmd.exe
  cmd /c exit /b 85
  2⤵
  - Executes a command shell one-liner
  PID:464
- C:\Windows\system32\cmd.exe
  cmd /c exit /b 68
  2⤵
  - Executes a command shell one-liner
  PID:124
- C:\Windows\system32\cmd.exe
  cmd /c exit /b 82
  2⤵
  - Executes a command shell one-liner
  PID:808
- C:\Windows\system32\cmd.exe
  cmd /c exit /b 79
  2⤵
  - Executes a command shell one-liner
  PID:5232
- C:\Windows\system32\cmd.exe
  cmd /c exit /b 78
  2⤵
  - Executes a command shell one-liner
  PID:4712
- C:\Windows\system32\cmd.exe
  cmd /c exit /b 79
  2⤵
  - Executes a command shell one-liner
  PID:3168
- C:\Windows\system32\cmd.exe
  cmd /c exit /b 80
  2⤵
  - Executes a command shell one-liner
  PID:5884
- C:\Windows\system32\cmd.exe
  cmd /c exit /b 85
  2⤵
  - Executes a command shell one-liner
  PID:3372
- C:\Windows\system32\cmd.exe
  cmd /c exit /b 70
  2⤵
  - Executes a command shell one-liner
  PID:1816
- C:\Windows\system32\cmd.exe
  cmd /c exit /b 79
  2⤵
  - Executes a command shell one-liner
  PID:4800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads