16483d2e4c4bf47d77b0a3ed38b2f6246ec01bc66fb8832aa860716a1a3be8cb

Resubmissions

07/09/2026, 20:22

260907-y5tt6sfr713

07/09/2026, 20:21

260907-y471eavfre3

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 20:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
prada.exe
Size 90KB
Sample260907-y471eavfre
SHA256 16483d2e4c4bf47d77b0a3ed38b2f6246ec01bc66fb8832aa860716a1a3be8cb
MD5 9a338b8b286be3993a9f0aa76d27d5f8
SHA1 4b84d35e9d377d99ebb23901c08475c4d3e30075
SHA512 bb1e8a8b1c42613e403be25d5f852cee55957641e11509dd55ac45476bb40a3c6b1fa85044faa9d27a20935fd0a288c53502804bc58ecb7ead772578df0fa4d8
SSDEEP 1536:z7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfxwqvjOj:v7DhdC6kzWypvaQ0FxyNTBfx3vo
TLSH
T1B9936C41F3E242F7EAF2053100A6722F973663389764E8DBC74C2D529913AD5A63D3E9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3344	cmd.exe
4448	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	prada.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 4448	2760	prada.exe	90
PID 4448 wrote to memory of 3344	4448	cmd.exe	91
PID 3344 wrote to memory of 4156	3344	cmd.exe	92
PID 3344 wrote to memory of 3924	3344	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\prada.exe
"C:\Users\Admin\AppData\Local\Temp\prada.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\536.tmp\537.tmp\538.bat C:\Users\Admin\AppData\Local\Temp\prada.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c echo prompt $E | cmd
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3344
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo prompt $E "
      4⤵
      PID:4156
  - - C:\Windows\system32\cmd.exe
      cmd
      4⤵
      PID:3924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

538.bat

Path C:\Users\Admin\AppData\Local\Temp\536.tmp\537.tmp\538.bat
Size 1KB
SHA256 70bc786da897e24338976cc3a6e450c73062442665f7a847b40a3349c1d31a18
MD5 bbc4459ba940d1f3ae668b87c97c8bfc
SHA1 e9b943f0f75de5b289f918ea3cf15f0f02d8511d
SHA512 300ee2dae397e2ce0113dcb74fb5703851040c37eba0ee574a3b3f87652950f6040be4488bffff5634e5c07641f11f238c8edee58c80e6e9ed75c2dd2f4af5a7
TLSH
T1E321C1A63132D089445A7FF25EB3F1FF7A0962CB47055F80368F297A832B4C5B446189
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2760-0-0x0000000000417000-0x0000000000418000-memory.dmp

Download