Analysis
- user interaction
yes - max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 12:36
Static task
static1
Behavioral task
behavioral1
Sample
deepseek_batch_20261002_53e2b1.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target deepseek_batch_20261002_53e2b1.bat
- Size 26KB
- Sample261002-ps5apsvt4n
- SHA256 22245aecf52f615b6405b69eb6fe9c9e46ab89049e5db0b847f498189f21a89a
- MD5 0043fd830de0793f39d8e412ff77d630
- SHA1 9c7d9f669c3fd200676e2898c2c2b0c13f49fe3f
- SHA512 82b204f5cfcb86f1520acb02d40366186acc2933e4e64ec62b9d0fb68af0fc1c367d5e473beeb9d7db028906ac60cbc98174127658670f41c334ab9c4552ca06
- SSDEEP 384:5jZjB69QNxgKsNQegxMRuVgZhvWQfmZsRsaATXbS9R+iuqWfriEI1MINzl3qGjlF:9X6BTi6RdCcTsoQm
- TLSH T193C2521378151C2B9816E221DAF74853B7A5C08300163EE4B5EB71A8276BB8593FDFED
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 480 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe - Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 4544 WMIC.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4544 WMIC.exe 4544 WMIC.exe 4544 WMIC.exe 4544 WMIC.exe - Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4544 WMIC.exe Token: SeSecurityPrivilege 4544 WMIC.exe Token: SeTakeOwnershipPrivilege 4544 WMIC.exe Token: SeLoadDriverPrivilege 4544 WMIC.exe Token: SeSystemProfilePrivilege 4544 WMIC.exe Token: SeSystemtimePrivilege 4544 WMIC.exe Token: SeProfSingleProcessPrivilege 4544 WMIC.exe Token: SeIncBasePriorityPrivilege 4544 WMIC.exe Token: SeCreatePagefilePrivilege 4544 WMIC.exe Token: SeBackupPrivilege 4544 WMIC.exe Token: SeRestorePrivilege 4544 WMIC.exe Token: SeShutdownPrivilege 4544 WMIC.exe Token: SeDebugPrivilege 4544 WMIC.exe Token: SeSystemEnvironmentPrivilege 4544 WMIC.exe Token: SeRemoteShutdownPrivilege 4544 WMIC.exe Token: SeUndockPrivilege 4544 WMIC.exe Token: SeManageVolumePrivilege 4544 WMIC.exe Token: 33 4544 WMIC.exe Token: 34 4544 WMIC.exe Token: 35 4544 WMIC.exe Token: 36 4544 WMIC.exe Token: SeIncreaseQuotaPrivilege 4544 WMIC.exe Token: SeSecurityPrivilege 4544 WMIC.exe Token: SeTakeOwnershipPrivilege 4544 WMIC.exe Token: SeLoadDriverPrivilege 4544 WMIC.exe Token: SeSystemProfilePrivilege 4544 WMIC.exe Token: SeSystemtimePrivilege 4544 WMIC.exe Token: SeProfSingleProcessPrivilege 4544 WMIC.exe Token: SeIncBasePriorityPrivilege 4544 WMIC.exe Token: SeCreatePagefilePrivilege 4544 WMIC.exe Token: SeBackupPrivilege 4544 WMIC.exe Token: SeRestorePrivilege 4544 WMIC.exe Token: SeShutdownPrivilege 4544 WMIC.exe Token: SeDebugPrivilege 4544 WMIC.exe Token: SeSystemEnvironmentPrivilege 4544 WMIC.exe Token: SeRemoteShutdownPrivilege 4544 WMIC.exe Token: SeUndockPrivilege 4544 WMIC.exe Token: SeManageVolumePrivilege 4544 WMIC.exe Token: 33 4544 WMIC.exe Token: 34 4544 WMIC.exe Token: 35 4544 WMIC.exe Token: 36 4544 WMIC.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 480 wrote to memory of 5284 480 cmd.exe 90 PID 480 wrote to memory of 4668 480 cmd.exe 91 PID 480 wrote to memory of 1352 480 cmd.exe 92 PID 1352 wrote to memory of 4892 1352 net.exe 93 PID 480 wrote to memory of 4544 480 cmd.exe 94 PID 480 wrote to memory of 4244 480 cmd.exe 95
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20261002_53e2b1.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:480 -
C:\Windows\system32\chcp.comchcp 650012⤵PID:5284
-
-
C:\Windows\system32\mode.commode con: cols=85 lines=422⤵PID:4668
-
-
C:\Windows\system32\net.exenet session2⤵
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session3⤵PID:4892
-
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name2⤵
- Reads the TCP/IP host and domain name from the registry
- Detects videocard installed
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4544
-
-
C:\Windows\system32\findstr.exefindstr /i "NVIDIA"2⤵PID:4244
-