Analysis
- user interaction
yes - max time kernel
149s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/10/2026, 12:36
Static task
static1
Behavioral task
behavioral1
Sample
deepseek_batch_20261002_53e2b1.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target deepseek_batch_20261002_53e2b1.bat
- Size 26KB
- Sample261002-ps5apsvt4n
- SHA256 22245aecf52f615b6405b69eb6fe9c9e46ab89049e5db0b847f498189f21a89a
- MD5 0043fd830de0793f39d8e412ff77d630
- SHA1 9c7d9f669c3fd200676e2898c2c2b0c13f49fe3f
- SHA512 82b204f5cfcb86f1520acb02d40366186acc2933e4e64ec62b9d0fb68af0fc1c367d5e473beeb9d7db028906ac60cbc98174127658670f41c334ab9c4552ca06
- SSDEEP 384:5jZjB69QNxgKsNQegxMRuVgZhvWQfmZsRsaATXbS9R+iuqWfriEI1MINzl3qGjlF:9X6BTi6RdCcTsoQm
- TLSH T193C2521378151C2B9816E221DAF74853B7A5C08300163EE4B5EB71A8276BB8593FDFED
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4808 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe - Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 1660 WMIC.exe - Runs net.exe
- Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1660 WMIC.exe Token: SeSecurityPrivilege 1660 WMIC.exe Token: SeTakeOwnershipPrivilege 1660 WMIC.exe Token: SeLoadDriverPrivilege 1660 WMIC.exe Token: SeSystemProfilePrivilege 1660 WMIC.exe Token: SeSystemtimePrivilege 1660 WMIC.exe Token: SeProfSingleProcessPrivilege 1660 WMIC.exe Token: SeIncBasePriorityPrivilege 1660 WMIC.exe Token: SeCreatePagefilePrivilege 1660 WMIC.exe Token: SeBackupPrivilege 1660 WMIC.exe Token: SeRestorePrivilege 1660 WMIC.exe Token: SeShutdownPrivilege 1660 WMIC.exe Token: SeDebugPrivilege 1660 WMIC.exe Token: SeSystemEnvironmentPrivilege 1660 WMIC.exe Token: SeRemoteShutdownPrivilege 1660 WMIC.exe Token: SeUndockPrivilege 1660 WMIC.exe Token: SeManageVolumePrivilege 1660 WMIC.exe Token: 33 1660 WMIC.exe Token: 34 1660 WMIC.exe Token: 35 1660 WMIC.exe Token: 36 1660 WMIC.exe Token: SeIncreaseQuotaPrivilege 1660 WMIC.exe Token: SeSecurityPrivilege 1660 WMIC.exe Token: SeTakeOwnershipPrivilege 1660 WMIC.exe Token: SeLoadDriverPrivilege 1660 WMIC.exe Token: SeSystemProfilePrivilege 1660 WMIC.exe Token: SeSystemtimePrivilege 1660 WMIC.exe Token: SeProfSingleProcessPrivilege 1660 WMIC.exe Token: SeIncBasePriorityPrivilege 1660 WMIC.exe Token: SeCreatePagefilePrivilege 1660 WMIC.exe Token: SeBackupPrivilege 1660 WMIC.exe Token: SeRestorePrivilege 1660 WMIC.exe Token: SeShutdownPrivilege 1660 WMIC.exe Token: SeDebugPrivilege 1660 WMIC.exe Token: SeSystemEnvironmentPrivilege 1660 WMIC.exe Token: SeRemoteShutdownPrivilege 1660 WMIC.exe Token: SeUndockPrivilege 1660 WMIC.exe Token: SeManageVolumePrivilege 1660 WMIC.exe Token: 33 1660 WMIC.exe Token: 34 1660 WMIC.exe Token: 35 1660 WMIC.exe Token: 36 1660 WMIC.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4808 wrote to memory of 2652 4808 cmd.exe 87 PID 4808 wrote to memory of 2940 4808 cmd.exe 88 PID 4808 wrote to memory of 1896 4808 cmd.exe 90 PID 1896 wrote to memory of 2680 1896 net.exe 91 PID 4808 wrote to memory of 1660 4808 cmd.exe 92 PID 4808 wrote to memory of 1556 4808 cmd.exe 93
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20261002_53e2b1.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Windows\system32\chcp.comchcp 650012⤵PID:2652
-
-
C:\Windows\system32\mode.commode con: cols=85 lines=422⤵PID:2940
-
-
C:\Windows\system32\net.exenet session2⤵
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session3⤵PID:2680
-
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name2⤵
- Reads the TCP/IP host and domain name from the registry
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
PID:1660
-
-
C:\Windows\system32\findstr.exefindstr /i "NVIDIA"2⤵PID:1556
-