cd34953eda1cdc7e2a07ed9880485d18ea02ee652f5cf40487eca15ecbda756b

Analysis

max time kernel
149s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
prosvet-1.1.0-windows-amd64/zapret.bat
Size 617B
Sample261027-vbzlsaea86
SHA256 cd34953eda1cdc7e2a07ed9880485d18ea02ee652f5cf40487eca15ecbda756b
MD5 b79bb1960a771513b28b174bb3024030
SHA1 02dbc53c62f1d751a834d0f4195956df18877846
SHA512 018d7f1a7c5c38ba46fbc61cac54d26aaa5484440f3af30ae8cca19b50a6a073a836f44adf58a5d58de450a6bf8ae732e7aba1f3144b0b318e36a9e837daaa92
TLSH
T10BF0A24ED749D6F835224580154F6991528EC975425749C8337F81CB330EE5E9ABE0F3
MD5 SHA1 SHA512 TLSH

Score

7^/10

execution

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
6048	prosvet.exe
4864	winws.exe
4808	prosvet.exe
5748	WinDivert64.sys

Loads dropped DLL 2 IoCs

pid	Process
4864	winws.exe
4864	winws.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Prosvet\prosvet.exe.new	prosvet.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3712	sc.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5652	cmd.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4648	prosvet.exe
4648	prosvet.exe
6048	prosvet.exe
6048	prosvet.exe
6048	prosvet.exe
6048	prosvet.exe
6048	prosvet.exe
4808	prosvet.exe
4808	prosvet.exe
4808	prosvet.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
832	Process not Found

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	4864	winws.exe
Token: SeBackupPrivilege	4864	winws.exe
Token: SeDebugPrivilege	4864	winws.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5652 wrote to memory of 5004	5652	cmd.exe	89
PID 5652 wrote to memory of 3944	5652	cmd.exe	90
PID 5652 wrote to memory of 3712	5652	cmd.exe	91
PID 5652 wrote to memory of 4648	5652	cmd.exe	92
PID 6048 wrote to memory of 4864	6048	prosvet.exe	94
PID 5652 wrote to memory of 4808	5652	cmd.exe	96

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\prosvet-1.1.0-windows-amd64\zapret.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5652
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:5004
- C:\Windows\system32\mode.com
  mode con: cols=132 lines=42
  2⤵
  PID:3944
- C:\Windows\system32\sc.exe
  sc query prosvet
  2⤵
  - Launches sc.exe
  PID:3712
- C:\Users\Admin\AppData\Local\Temp\prosvet-1.1.0-windows-amd64\prosvet.exe
  "C:\Users\Admin\AppData\Local\Temp\prosvet-1.1.0-windows-amd64\prosvet.exe" install
  2⤵
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  PID:4648
- C:\Program Files\Prosvet\prosvet.exe
  "C:\Program Files\Prosvet\prosvet.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4808

C:\Program Files\Prosvet\prosvet.exe
"C:\Program Files\Prosvet\prosvet.exe" daemon
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6048
- C:\ProgramData\Prosvet\engine\winws.exe
  C:\ProgramData\Prosvet\engine\winws.exe --wf-udp=443,19294-19344,50000-50100 --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-discord=C:\ProgramData\Prosvet\fakes\gen_quic_steamcommunity.com.bin --dpi-desync-fake-stun=C:\ProgramData\Prosvet\fakes\gen_quic_steamcommunity.com.bin --new --filter-udp=443 --hostlist=C:\ProgramData\Prosvet\lists\custom.txt --hostlist=C:\ProgramData\Prosvet\lists\general.txt --hostlist-exclude=C:\ProgramData\Prosvet\lists\exclude.txt --hostlist-exclude=C:\ProgramData\Prosvet\lists\exclude-user.txt --ipset-exclude=C:\ProgramData\Prosvet\lists\ipset-ipset-exclude.txt --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic=C:\ProgramData\Prosvet\fakes\gen_quic_www.google.com.bin
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:4864

C:\ProgramData\Prosvet\engine\WinDivert64.sys
C:\ProgramData\Prosvet\engine\WinDivert64.sys
1⤵
- Executes dropped EXE
PID:5748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

prosvet.exe

Path C:\Program Files\Prosvet\prosvet.exe
Size 13.4MB
SHA256 d2d9af1a4e1fa3d8655c3d75e7f8f89994cee010ea61a25fb820fee64af67250
MD5 2ddc118ac7220df793e836aeb58ac89f
SHA1 a1c02cbfe9999f47635d27e42e83a6233dbb2d9b
SHA512 c11c1a72f93c24633fbed6576d8865ef80d48ba98dee5f59044cc1c64b670f8a0eee9d90c0442ae2740bffd3090aec0403e3da1b34a6e6b22a2ed00f758bd461
SSDEEP 98304:vZRQ8wiK1hLa/JkcbkwUXPHSIofniGRcsVJqCmB5RMiCwDIS4TBrppUy1u7MHr4E:7yzhIIyNR3JqlMiCwMOD
TLSH
T121E64A17E9A614E8C0AEC134866792227B717C494B3127DB2B50F6383F77BD0AEB9714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinDivert.dll

Path C:\ProgramData\Prosvet\engine\WinDivert.dll
Size 46KB
SHA256 c1e060ee19444a259b2162f8af0f3fe8c4428a1c6f694dce20de194ac8d7d9a2
MD5 b2014d33ee645112d5dc16fe9d9fcbff
SHA1 aa69498562d350f2de06954b133e59fac1e57002
SHA512 37014a018b9cd91b2eaeeccc7c5af3838fcae4d4fe6bb50c7ae32cd5c99423965a3e3efb29499324f6885b8f0c2ee2952cb75ab73db4e8960811abcb46801f15
SSDEEP 768:Qjf2rf/kxpxI+JEw2VWHDDjQSQX4zTtllgwBqWocwTicI:YuT/CXHDvVQatonTic
TLSH
T17423D803F74151B7C429C27083AED352AE22FCC56354F9EF82DEB7952D85E42DB1A606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinDivert64.sys

Path C:\ProgramData\Prosvet\engine\WinDivert64.sys
Size 91KB
SHA256 8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2
MD5 89ed5be7ea83c01d0de33d3519944aa5
SHA1 4c9b9c74529399abacc2284de1dead5f2332ee9b
SHA512 be6530fa0e26441441028b530cd6fc4f900448916e137f92613a1f886c16399d415ddd17f7f8847258cc19c63b1510f2f3068942203c50486e48eed838f9f138
SSDEEP 1536:AsmCCzg4Klt7jh//NiRMwoGK0tmdsAXixJz48dJ/zuXR:Atzilt/iR5ojGmdsAXoz4k/8R
TLSH
T12E935B46B2E240C5F9F6C97895F59253EE31FA90A721C7DF11E0981E4F21BE1AD78322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cygwin1.dll

Path C:\ProgramData\Prosvet\engine\cygwin1.dll
Size 2.8MB
SHA256 103104a52e5293ce418944725df19e2bf81ad9269b9a120d71d39028e821499b
MD5 a1c82ed072dc079dd7851f82d9aa7678
SHA1 52f26fa1aee39476f1c13438aec8bf969c78da45
SHA512 22993e7cee1e7aa69ffe45adf3a329abced7e53d54ffea96dab42fe273c81522252c7b7e98e5af36d2fdec0346c51540e977c6e56b8c08835bac86fa6d04ca59
SSDEEP 49152:hGniafRcs02/oSqCmB5RMiCwDjUZQjuhKv+TLRlURxKc+tKaZrpu8dhcy1u7MHz:YniGRcsVJqCmB5RMiCwDIS4TBrppUy1J
TLSH
T165D55C1BF3A350ECC967C138466BA372BA32B82441347F6E2958CB701F72F51666DB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winws.exe

Path C:\ProgramData\Prosvet\engine\winws.exe
Size 218KB
SHA256 a14bff1df6234ea555d2e0c61b589f0707c0b12d6c9b7eeccda76012154996e8
MD5 37bf60e34672966a19a6dd346b779382
SHA1 2f4f3b064c88053e0649c7bec019cd6ba51ee11e
SHA512 f3b7c8f40ecd33bdf2edc48b62789105dbda4f71a11acd089d22e411510b5bbe51113ea7001cd956a99dd5bf576427f46fa6d3ecdaf615b947e23908698160e9
SSDEEP 3072:Sd0M+XQsvL6HZSi44zstHi0OLD1/OwMbNF6rAhpQ2rrR3IctDiFh2FUJ:SGMYn4V0oZRe6CIctuFLJ
TLSH
T1B2245B57F3D688F9C562C178D6AB6333A931FC452124EA4B9FD4CB142F62F10A12E798
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gen_quic_steamcommunity.com.bin

Path C:\ProgramData\Prosvet\fakes\gen_quic_steamcommunity.com.bin
Size 1KB
SHA256 cf327daa17dfc2a25f63f048dd4df6d32e9d6772a1c07494ea13ed087e1212b6
MD5 3a9da0c6c099b1dd2db403168a4408e8
SHA1 97a974975fe56a7aa7248016fc4951682d93d321
SHA512 428c67544416bcc8b34d3a87c80ad5ad52bc2da6024e3dd20b5bd6d1f7bb9352c090f1d716bc487f0f5c92637b47afd93a3c9a575becf941aebcbf9eb628982c
TLSH
T195213A3C9272A742278E0005B3304E967824FF9E7FCD60078D4ABC923C6A39B97E1304
MD5 SHA1 SHA512 TLSH

Submit Download

gen_quic_www.google.com.bin

Path C:\ProgramData\Prosvet\fakes\gen_quic_www.google.com.bin
Size 1KB
SHA256 fad0def85af3b5908a6511ef653e2c67d5669cf8f9f13562b9bfcf9556542e9e
MD5 e76b5492f5c7dc01efb8f8a516f9f9ce
SHA1 437a66a2af1341610e88336cd1bda75b6bd91f04
SHA512 679f38ac1f466bf6204025b76778ce81831518bac745bad949e03a1da04c70f89c9493062be4cd6f013ee313a13908d3ff23bb93a6dda9f9ef551362202dfa93
TLSH
T1C1211AC095E712B1AE4C68BA1B4CB4FCB32447981D544002F751B7E33374832A8F80AE
MD5 SHA1 SHA512 TLSH

Submit Download

custom.txt

Path C:\ProgramData\Prosvet\lists\custom.txt
Size 17B
SHA256 d3f5554128c8fd26a633dfe487cd7ac0e2e910eadb788f1ca4460d00cf44c6e5
MD5 11ab302310d9466e067d97e287d97edd
SHA1 3ed45085f70f06327861323942ad978a1d5244d8
SHA512 8976971609f3b42e999331942d041caff8141f9b3c35cde0aa340aa0fbf82c4cce4be5bc6b67cb4dd8d7c6d5f5af9662ff7eb432ac273175ccebdbb4a7deb059
MD5 SHA1 SHA512

Submit Download

exclude.txt

Path C:\ProgramData\Prosvet\lists\exclude.txt
Size 748B
SHA256 11a9051ba62bd76b83c09ca26c0aaa428c0f57f85647f3bbb3cddc16d1965e39
MD5 dbb0a5019a8d3ce631465ced3a8865dd
SHA1 8725a5728bcef0049d6568d65b453ed1540ba6bd
SHA512 c714f128c6048788da683f9795351f7810413ead2ffc2816bf76b53f69e8f8aecdf51533d2fcb8f12a28c44f81ad1b761725d0b70f167eab25efcf9cbf689185
TLSH
T15501C0708C147B2037A9A471F045BEAAB935461B88C0F8C9AAF5B9041BD33C67D56E36
MD5 SHA1 SHA512 TLSH

Submit Download

general.txt

Path C:\ProgramData\Prosvet\lists\general.txt
Size 194B
SHA256 8512156371fc41354537597ddd4fce253a617ab4ada74760e113a84e006b2ed4
MD5 1657ce5004515d2d3ca12803ac601838
SHA1 aa220db7bedd20f121b711afb931742525a45c24
SHA512 ffb067b7e15543e5ce56e7c62525d76f6390e8de8439cc07935133e70290b8b49a0444adfae8e843285c225dc9af455e88faa17b3268edcf49bab4ec67cc7176
TLSH
T17FC0128A697C6F31750644397991753072C4C6BC8055FDEB6E72782A03CD2FDB3202B5
MD5 SHA1 SHA512 TLSH

Submit Download

ipset-ipset-exclude.txt

Path C:\ProgramData\Prosvet\lists\ipset-ipset-exclude.txt
Size 270B
SHA256 bffe1d110e2b3cac715f1f4dbcb9ed9bacc415c2138d6c267d7f55b9cdfb7278
MD5 616be8f89a715133810845dad340b216
SHA1 57e51a5016394c1dbdfd15810a2ece0b844bea15
SHA512 c3b8d3ee66af59a3eeadc085e40239520601968be1fe68313411c050b8ad5280420314c7a44af12c603a108b34e5f39f69cec6d6718aacd77465ef7e1b311010
TLSH
T1ACD05E7081ED20FA5E8BA614A02D973DFD2B11EF24C72915536C542E7E1282D6815720
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4864-66-0x0000000100400000-0x000000010043D000-memory.dmp

Download

memory/4864-74-0x0000000100400000-0x000000010043D000-memory.dmp

Download

memory/4864-75-0x0000000062800000-0x0000000062813000-memory.dmp

Download

memory/4864-77-0x00007FFBEBBE0000-0x00007FFBEBEE2000-memory.dmp

Download

memory/4864-65-0x00007FFBEBBE0000-0x00007FFBEBEE2000-memory.dmp

Download