cd34953eda1cdc7e2a07ed9880485d18ea02ee652f5cf40487eca15ecbda756b

Analysis

max time kernel
149s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
prosvet-1.1.0-windows-amd64/zapret.bat
Size 617B
Sample261027-vbzlsaea86
SHA256 cd34953eda1cdc7e2a07ed9880485d18ea02ee652f5cf40487eca15ecbda756b
MD5 b79bb1960a771513b28b174bb3024030
SHA1 02dbc53c62f1d751a834d0f4195956df18877846
SHA512 018d7f1a7c5c38ba46fbc61cac54d26aaa5484440f3af30ae8cca19b50a6a073a836f44adf58a5d58de450a6bf8ae732e7aba1f3144b0b318e36a9e837daaa92
TLSH
T10BF0A24ED749D6F835224580154F6991528EC975425749C8337F81CB330EE5E9ABE0F3
MD5 SHA1 SHA512 TLSH

Score

7^/10

execution

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
4128	prosvet.exe
5072	winws.exe
4212	prosvet.exe
1252	WinDivert64.sys

Loads dropped DLL 2 IoCs

pid	Process
5072	winws.exe
5072	winws.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Prosvet\prosvet.exe.new	prosvet.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1264	sc.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5108	cmd.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3324	prosvet.exe
3324	prosvet.exe
4128	prosvet.exe
4128	prosvet.exe
4128	prosvet.exe
4128	prosvet.exe
4128	prosvet.exe
4212	prosvet.exe
4212	prosvet.exe
4212	prosvet.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
640	Process not Found

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	5072	winws.exe
Token: SeBackupPrivilege	5072	winws.exe
Token: SeDebugPrivilege	5072	winws.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 4320	5108	cmd.exe	85
PID 5108 wrote to memory of 1316	5108	cmd.exe	86
PID 5108 wrote to memory of 1264	5108	cmd.exe	87
PID 5108 wrote to memory of 3324	5108	cmd.exe	88
PID 4128 wrote to memory of 5072	4128	prosvet.exe	90
PID 5108 wrote to memory of 4212	5108	cmd.exe	92

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\prosvet-1.1.0-windows-amd64\zapret.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:4320
- C:\Windows\system32\mode.com
  mode con: cols=132 lines=42
  2⤵
  PID:1316
- C:\Windows\system32\sc.exe
  sc query prosvet
  2⤵
  - Launches sc.exe
  PID:1264
- C:\Users\Admin\AppData\Local\Temp\prosvet-1.1.0-windows-amd64\prosvet.exe
  "C:\Users\Admin\AppData\Local\Temp\prosvet-1.1.0-windows-amd64\prosvet.exe" install
  2⤵
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  PID:3324
- C:\Program Files\Prosvet\prosvet.exe
  "C:\Program Files\Prosvet\prosvet.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4212

C:\Program Files\Prosvet\prosvet.exe
"C:\Program Files\Prosvet\prosvet.exe" daemon
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4128
- C:\ProgramData\Prosvet\engine\winws.exe
  C:\ProgramData\Prosvet\engine\winws.exe --wf-udp=443,19294-19344,50000-50100 --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-discord=C:\ProgramData\Prosvet\fakes\gen_quic_steamcommunity.com.bin --dpi-desync-fake-stun=C:\ProgramData\Prosvet\fakes\gen_quic_steamcommunity.com.bin --new --filter-udp=443 --hostlist=C:\ProgramData\Prosvet\lists\custom.txt --hostlist=C:\ProgramData\Prosvet\lists\general.txt --hostlist-exclude=C:\ProgramData\Prosvet\lists\exclude.txt --hostlist-exclude=C:\ProgramData\Prosvet\lists\exclude-user.txt --ipset-exclude=C:\ProgramData\Prosvet\lists\ipset-ipset-exclude.txt --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic=C:\ProgramData\Prosvet\fakes\gen_quic_www.google.com.bin
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:5072

C:\ProgramData\Prosvet\engine\WinDivert64.sys
C:\ProgramData\Prosvet\engine\WinDivert64.sys
1⤵
- Executes dropped EXE
PID:1252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

prosvet.exe

Path C:\Program Files\Prosvet\prosvet.exe
Size 13.4MB
SHA256 d2d9af1a4e1fa3d8655c3d75e7f8f89994cee010ea61a25fb820fee64af67250
MD5 2ddc118ac7220df793e836aeb58ac89f
SHA1 a1c02cbfe9999f47635d27e42e83a6233dbb2d9b
SHA512 c11c1a72f93c24633fbed6576d8865ef80d48ba98dee5f59044cc1c64b670f8a0eee9d90c0442ae2740bffd3090aec0403e3da1b34a6e6b22a2ed00f758bd461
SSDEEP 98304:vZRQ8wiK1hLa/JkcbkwUXPHSIofniGRcsVJqCmB5RMiCwDIS4TBrppUy1u7MHr4E:7yzhIIyNR3JqlMiCwMOD
TLSH
T121E64A17E9A614E8C0AEC134866792227B717C494B3127DB2B50F6383F77BD0AEB9714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinDivert.dll

Path C:\ProgramData\Prosvet\engine\WinDivert.dll
Size 46KB
SHA256 c1e060ee19444a259b2162f8af0f3fe8c4428a1c6f694dce20de194ac8d7d9a2
MD5 b2014d33ee645112d5dc16fe9d9fcbff
SHA1 aa69498562d350f2de06954b133e59fac1e57002
SHA512 37014a018b9cd91b2eaeeccc7c5af3838fcae4d4fe6bb50c7ae32cd5c99423965a3e3efb29499324f6885b8f0c2ee2952cb75ab73db4e8960811abcb46801f15
SSDEEP 768:Qjf2rf/kxpxI+JEw2VWHDDjQSQX4zTtllgwBqWocwTicI:YuT/CXHDvVQatonTic
TLSH
T17423D803F74151B7C429C27083AED352AE22FCC56354F9EF82DEB7952D85E42DB1A606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinDivert64.sys

Path C:\ProgramData\Prosvet\engine\WinDivert64.sys
Size 91KB
SHA256 8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2
MD5 89ed5be7ea83c01d0de33d3519944aa5
SHA1 4c9b9c74529399abacc2284de1dead5f2332ee9b
SHA512 be6530fa0e26441441028b530cd6fc4f900448916e137f92613a1f886c16399d415ddd17f7f8847258cc19c63b1510f2f3068942203c50486e48eed838f9f138
SSDEEP 1536:AsmCCzg4Klt7jh//NiRMwoGK0tmdsAXixJz48dJ/zuXR:Atzilt/iR5ojGmdsAXoz4k/8R
TLSH
T12E935B46B2E240C5F9F6C97895F59253EE31FA90A721C7DF11E0981E4F21BE1AD78322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cygwin1.dll

Path C:\ProgramData\Prosvet\engine\cygwin1.dll
Size 2.8MB
SHA256 103104a52e5293ce418944725df19e2bf81ad9269b9a120d71d39028e821499b
MD5 a1c82ed072dc079dd7851f82d9aa7678
SHA1 52f26fa1aee39476f1c13438aec8bf969c78da45
SHA512 22993e7cee1e7aa69ffe45adf3a329abced7e53d54ffea96dab42fe273c81522252c7b7e98e5af36d2fdec0346c51540e977c6e56b8c08835bac86fa6d04ca59
SSDEEP 49152:hGniafRcs02/oSqCmB5RMiCwDjUZQjuhKv+TLRlURxKc+tKaZrpu8dhcy1u7MHz:YniGRcsVJqCmB5RMiCwDIS4TBrppUy1J
TLSH
T165D55C1BF3A350ECC967C138466BA372BA32B82441347F6E2958CB701F72F51666DB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winws.exe

Path C:\ProgramData\Prosvet\engine\winws.exe
Size 218KB
SHA256 a14bff1df6234ea555d2e0c61b589f0707c0b12d6c9b7eeccda76012154996e8
MD5 37bf60e34672966a19a6dd346b779382
SHA1 2f4f3b064c88053e0649c7bec019cd6ba51ee11e
SHA512 f3b7c8f40ecd33bdf2edc48b62789105dbda4f71a11acd089d22e411510b5bbe51113ea7001cd956a99dd5bf576427f46fa6d3ecdaf615b947e23908698160e9
SSDEEP 3072:Sd0M+XQsvL6HZSi44zstHi0OLD1/OwMbNF6rAhpQ2rrR3IctDiFh2FUJ:SGMYn4V0oZRe6CIctuFLJ
TLSH
T1B2245B57F3D688F9C562C178D6AB6333A931FC452124EA4B9FD4CB142F62F10A12E798
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gen_quic_steamcommunity.com.bin

Path C:\ProgramData\Prosvet\fakes\gen_quic_steamcommunity.com.bin
Size 1KB
SHA256 90ef133fe0a09c3bc18b3860b58acd6e01d13e56cac65f8c3e319538bd5dabda
MD5 0ed2b50df2bacc2272ae2470c1c21ba1
SHA1 784202f6e278639470bb64d80f64160b04462cd8
SHA512 c1ab859a34181523de10fafe065ed89eac507f1aee88a9525606a60d65b04949dc9b37f9a41e8f042b67be2896ea68384717a759806806bcf7fda3f466aa665c
TLSH
T1F621B712168AF3C0F5EA84261A3ED38419F6812B500D42B06437784009E71ED88CE83A
MD5 SHA1 SHA512 TLSH

Submit Download

gen_quic_www.google.com.bin

Path C:\ProgramData\Prosvet\fakes\gen_quic_www.google.com.bin
Size 1KB
SHA256 31d6fd3f421d8bf6971bfd8dfdf1e706f1217cd55e86234e19d909524a6ef2ad
MD5 81d3b3b1918c452a23165e6f3039cb62
SHA1 80916e0a2c73fa68228806f3c82b1931275feb5f
SHA512 6a90a83f42761cf23e55055278933a2998827f55f1d4a68c9b94061280c03cfba7917bdf1dd652e1266dd5b13f9df041ac75fb4b1ae5821766fa22ffd80436a4
TLSH
T1B3211AF8030CE56F64ABC833D038A2BA3854789803A644FF5F7A2440586ED744A23707
MD5 SHA1 SHA512 TLSH

Submit Download

custom.txt

Path C:\ProgramData\Prosvet\lists\custom.txt
Size 17B
SHA256 d3f5554128c8fd26a633dfe487cd7ac0e2e910eadb788f1ca4460d00cf44c6e5
MD5 11ab302310d9466e067d97e287d97edd
SHA1 3ed45085f70f06327861323942ad978a1d5244d8
SHA512 8976971609f3b42e999331942d041caff8141f9b3c35cde0aa340aa0fbf82c4cce4be5bc6b67cb4dd8d7c6d5f5af9662ff7eb432ac273175ccebdbb4a7deb059
MD5 SHA1 SHA512

Submit Download

exclude.txt

Path C:\ProgramData\Prosvet\lists\exclude.txt
Size 748B
SHA256 11a9051ba62bd76b83c09ca26c0aaa428c0f57f85647f3bbb3cddc16d1965e39
MD5 dbb0a5019a8d3ce631465ced3a8865dd
SHA1 8725a5728bcef0049d6568d65b453ed1540ba6bd
SHA512 c714f128c6048788da683f9795351f7810413ead2ffc2816bf76b53f69e8f8aecdf51533d2fcb8f12a28c44f81ad1b761725d0b70f167eab25efcf9cbf689185
TLSH
T15501C0708C147B2037A9A471F045BEAAB935461B88C0F8C9AAF5B9041BD33C67D56E36
MD5 SHA1 SHA512 TLSH

Submit Download

general.txt

Path C:\ProgramData\Prosvet\lists\general.txt
Size 194B
SHA256 8512156371fc41354537597ddd4fce253a617ab4ada74760e113a84e006b2ed4
MD5 1657ce5004515d2d3ca12803ac601838
SHA1 aa220db7bedd20f121b711afb931742525a45c24
SHA512 ffb067b7e15543e5ce56e7c62525d76f6390e8de8439cc07935133e70290b8b49a0444adfae8e843285c225dc9af455e88faa17b3268edcf49bab4ec67cc7176
TLSH
T17FC0128A697C6F31750644397991753072C4C6BC8055FDEB6E72782A03CD2FDB3202B5
MD5 SHA1 SHA512 TLSH

Submit Download

ipset-ipset-exclude.txt

Path C:\ProgramData\Prosvet\lists\ipset-ipset-exclude.txt
Size 270B
SHA256 bffe1d110e2b3cac715f1f4dbcb9ed9bacc415c2138d6c267d7f55b9cdfb7278
MD5 616be8f89a715133810845dad340b216
SHA1 57e51a5016394c1dbdfd15810a2ece0b844bea15
SHA512 c3b8d3ee66af59a3eeadc085e40239520601968be1fe68313411c050b8ad5280420314c7a44af12c603a108b34e5f39f69cec6d6718aacd77465ef7e1b311010
TLSH
T1ACD05E7081ED20FA5E8BA614A02D973DFD2B11EF24C72915536C542E7E1282D6815720
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5072-64-0x0000000100400000-0x000000010043D000-memory.dmp

Download

memory/5072-73-0x0000000100400000-0x000000010043D000-memory.dmp

Download

memory/5072-74-0x0000000062800000-0x0000000062813000-memory.dmp

Download

memory/5072-72-0x00007FFAD5530000-0x00007FFAD5832000-memory.dmp

Download