bbc8c2cb9e49d785e6f0731b3e9d1b91942dd8a2c7910dd1b52ea36f22ae13cf

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/11/2026, 22:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LDManager.core.ps1
Size 168KB
Sample261104-2rfl6sdz21
SHA256 bbc8c2cb9e49d785e6f0731b3e9d1b91942dd8a2c7910dd1b52ea36f22ae13cf
MD5 bfe3ea5235063feab346d954d8b2acc2
SHA1 0a91e3dee7e3bf0432b4d9c160ad921fef040fe7
SHA512 cf8e766de3fdd299ec922ed605c1dab76460c6aff14a8d2fba4858aceb818017835b5f5b673a165bbe4d8576743ca63164af17eaa7f8558c4391612d4f7d6b3a
SSDEEP 3072:nMrnwY4hEUZd2a59CbjVTX8Dly2NLbQ9PnEdioM3HP+BhkrjX6RDeKZy3:MrnwcqoSwMDbbU9HPkkrjKcKE
TLSH
T1A2F364206D4654AE06B1E73BDD55A809FCE6007FA71D1204B5AC58A93FF632CC33DE6A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3424	powershell.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3424	powershell.exe
3424	powershell.exe
3424	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3424	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3424 wrote to memory of 2980	3424	powershell.exe	86
PID 2980 wrote to memory of 4544	2980	csc.exe	87

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\LDManager.core.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bugbru3m\bugbru3m.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5908.tmp" "c:\Users\Admin\AppData\Local\Temp\bugbru3m\CSCD0E0785B829643D29C7EE6EC4D9A24F.TMP"
    3⤵
    PID:4544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES5908.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5908.tmp
Size 1KB
SHA256 1262fc19f5032f0eedff32ff752465ebcfefdbaaa33ac7b4ea03a5c717c50d05
MD5 0c9a4edc15f292255b0a67eef33d99ad
SHA1 b65602fc3dffa5d831aab3b41547c9d9d7a5fba4
SHA512 c31a311204077082c2947b93fec1057b67dfd5a8d3ade713951acfc853366d85e654c1de79d4a6d3c24eb6d6d9fab69896d5d1e56470bb203a7b8dd6f0e75967
TLSH
T1E621C90583ED4B0EF17717316EF6532F9238FD6AEF61935B854081282C91204EEA0E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_wyxykslw.1tk.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wyxykslw.1tk.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

bugbru3m.dll

Path C:\Users\Admin\AppData\Local\Temp\bugbru3m\bugbru3m.dll
Size 3KB
SHA256 4f9696319256f0dc50e9e63420e39fd3f426db18844a379524093cf562b72acc
MD5 7835ddc399521f07396d3e62bbc289b1
SHA1 379fe0aea12e44ec9d92c6e3e3704b334ee32c20
SHA512 fa1e5d7014295767cb534f313d037beccf87565b03a9f8bb31e8953c1378c141575511b45f5fbf2d794fedf2604d0027346f345ac0504b8e3ad389b7d790a93f
TLSH
T18A51CC26A3E8066BF4770B306EF3476637A4F8109B72972E59D04269BC613A44D72FB4
MD5 SHA1 SHA512 TLSH

Submit Download

CSCD0E0785B829643D29C7EE6EC4D9A24F.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\bugbru3m\CSCD0E0785B829643D29C7EE6EC4D9A24F.TMP
Size 652B
SHA256 1d03b48b8c3fdaa02e71a63555f29abf99c5b333ad992aa2a05f87b3bc726b24
MD5 72c63b228d34e3f3bc8b0eb0df5c3e04
SHA1 f15eb07c1dc465319c46bbd66b8e8b7514dc1263
SHA512 1c01e006f4a3f642657ed6f07f166c2d7144e20e8a373bef43de972fc2f3056ea74d6ab58e9e253b44a490c8ddabc63955d39b00d11043fcdf6fe8bfa411d1e6
TLSH
T1E6F05E1963F8020EF1F34B30BEF693A791A9FC66EE3293ED145043592C646108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

bugbru3m.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\bugbru3m\bugbru3m.0.cs
Size 289B
SHA256 1822f786a9782953233825b2cda3e0954d383f61d9260f940078ea9f13e39360
MD5 84a4d284c78980971b21685d31b7e13b
SHA1 4f780f3b0ab02a09eb76668cbf8ba2cc5ae67a19
SHA512 9d960f72495774ccbd7edd1cb3252b973a15d593b4b349eac119ca7571913ce240ba133f7c3d2221654ffe49494233826efcc3b62d74fa9773ed859151d97101
TLSH
T111D0C21869B3BEA000624C270C8EA5FDB717112636AB1A15A6FA0721DF5B00A0271E5A
MD5 SHA1 SHA512 TLSH

Submit Download

bugbru3m.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\bugbru3m\bugbru3m.cmdline
Size 369B
SHA256 90a5ac88eb576a231d25e15f89ccc1645fbcbbe1d6df75c47f48d4899959085b
MD5 265c63365ea310061d495e6cf797f26a
SHA1 d7d1d068bfe074fffa89018bf4e3ef2e155bfd7b
SHA512 d64a13b7c3e0319c8f880f1721fccc4ad0ff3a47433a5e251e5a97b5a9b5348508a501cc156126d495d6016524b994f52647854cbdef305aa967c8881459dad7
TLSH
T129E06F2A834AC6BD31ED100B277AC4AC93720B8339A1BF84E850840DF02B0082BD2B81
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3424-0-0x000001A45AC60000-0x000001A45AC70000-memory.dmp

Download

memory/3424-2-0x000001A442610000-0x000001A442632000-memory.dmp

Download

memory/3424-1-0x000001A45AC60000-0x000001A45AC70000-memory.dmp

Download

memory/3424-22-0x000001A4425F0000-0x000001A4425F8000-memory.dmp

Download

memory/3424-23-0x000001A45AC60000-0x000001A45AC70000-memory.dmp

Download

memory/3424-24-0x000001A45AC60000-0x000001A45AC70000-memory.dmp

Download

memory/3424-25-0x000001A45AC60000-0x000001A45AC70000-memory.dmp

Download

memory/3424-26-0x000001A45AC60000-0x000001A45AC70000-memory.dmp

Download