5b820b5fe9a318d8714b697acbf309a96aa68946a7af75752eb3038833a98340

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/11/2026, 22:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LDManager.ps1
Size 14KB
Sample261104-2rfl6sdz21
SHA256 5b820b5fe9a318d8714b697acbf309a96aa68946a7af75752eb3038833a98340
MD5 23fd40568f6245b0a6d3d8e0c454cdfb
SHA1 d1d00c60581035e3b0a39cab15f7479998597f4b
SHA512 a2b3e59b782b51ab9953000b6739de38804ec2b6158b4f0d6d0016159b171f43049de310d427e86dee617669ce393252cde9ec537f114ef02cd63d2350f7ee00
SSDEEP 384:5N9JC3+uRT3o0lpTADTgm5Thtm5QFxPQZ0Ig:nujqYToTgmwKPNIg
TLSH
T1D7526C594D43686E05B2E243C9017C1EF8E607BFAFF952A4389C28391FE13285F3E991
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2144	powershell.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2144	powershell.exe
2144	powershell.exe
2144	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2144	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 1584	2144	powershell.exe	85
PID 1584 wrote to memory of 1836	1584	csc.exe	86

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\LDManager.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bdks0i5p\bdks0i5p.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1584
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9798.tmp" "c:\Users\Admin\AppData\Local\Temp\bdks0i5p\CSC5AA5FBA9AAB24EDA8AFFC9DE14FD23B4.TMP"
    3⤵
    PID:1836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES9798.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9798.tmp
Size 1KB
SHA256 44533824cf1836d5d92c3306d59384d06f4b49071fa1002accd1a0d8426a6b0f
MD5 6c8e14803efc38b44361b418eca36912
SHA1 813d59a4eb114d81fc9644253ae8db1b343421bf
SHA512 1808b8ae65d19b1bd70a460113b21199384d680ce7a4dcf3ffa556a00faffbfae69e37d2668a9cb4a33cf55e4fdfb26f5024a16aafe1be6caf976c902e1c9286
TLSH
T1AB21CC0593F8071FF0B71732A9F6076F9178FD95EF62535B8440422C1C50104EEB1A72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_sfxcrdug.0el.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sfxcrdug.0el.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

bdks0i5p.dll

Path C:\Users\Admin\AppData\Local\Temp\bdks0i5p\bdks0i5p.dll
Size 3KB
SHA256 84a3db313754c1091073c4851e0e1adfd7ead0cf5a98fc6a131011eb2d79de87
MD5 a094cc47c8158983ee3ef7e2a42aef60
SHA1 0f82e245979aed26cfeb2a49d8a8f842a08683ce
SHA512 b5fea478424385a3ddb8597f1bd79d0834d15de4c2be9f5d12e4582b9339b2fec59c60c689614620bb50394388552e80cceca008955aabdbf5045470d5b7856d
TLSH
T14C51BD16A3F8056BE4770B305EF3475727A4F8109B72576D59900329AC617A48931BB0
MD5 SHA1 SHA512 TLSH

Submit Download

CSC5AA5FBA9AAB24EDA8AFFC9DE14FD23B4.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\bdks0i5p\CSC5AA5FBA9AAB24EDA8AFFC9DE14FD23B4.TMP
Size 652B
SHA256 75e3f4992c65faf328f487086f7a3b1c8871fa068a48e1690f6dc8074d1d8838
MD5 0730c5f1437fcef0cb0da72155def2c5
SHA1 629aa640a4f9213509c0f11cb1935e7a1eb4988a
SHA512 4b7dda8d7e407d029d4a08b7a3a979237ec15d7b1315468ca22e7f09f1dc05aca3a901bee8e5c130203f6eaf52e00a36ac213771934209d2298e1a789565e4d0
TLSH
T1D1F05E0973F8020EF0F35B31BDF643A395A8BC65DE3293ED184103192C64A108A72FB2
MD5 SHA1 SHA512 TLSH

Submit Download

bdks0i5p.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\bdks0i5p\bdks0i5p.0.cs
Size 289B
SHA256 1822f786a9782953233825b2cda3e0954d383f61d9260f940078ea9f13e39360
MD5 84a4d284c78980971b21685d31b7e13b
SHA1 4f780f3b0ab02a09eb76668cbf8ba2cc5ae67a19
SHA512 9d960f72495774ccbd7edd1cb3252b973a15d593b4b349eac119ca7571913ce240ba133f7c3d2221654ffe49494233826efcc3b62d74fa9773ed859151d97101
TLSH
T111D0C21869B3BEA000624C270C8EA5FDB717112636AB1A15A6FA0721DF5B00A0271E5A
MD5 SHA1 SHA512 TLSH

Submit Download

bdks0i5p.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\bdks0i5p\bdks0i5p.cmdline
Size 369B
SHA256 b450a5d3a7042e980566ccffd595cc57c25a8bb6a13a7f7eab592654e886e784
MD5 86c6698fa12761c47bf48a6d79237785
SHA1 7fb69aa0276dbc5b1eb61c96944cf67d1acf2529
SHA512 b98aea06341000c05ff63fb3287aee489f8f6e777c635548e6e52135348327671be5865667523676a33bb8659b3b215b469f8ef74a871ee292821a0c2aeeca7a
TLSH
T1E2E0D83A9266C6BD16DD1007216BC5ADD2F25FC72A827F846150C45ED09B0446BF1795
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2144-10-0x0000023E51240000-0x0000023E51250000-memory.dmp

Download

memory/2144-1-0x0000023E51240000-0x0000023E51250000-memory.dmp

Download

memory/2144-9-0x0000023E532C0000-0x0000023E532E2000-memory.dmp

Download

memory/2144-0-0x0000023E51240000-0x0000023E51250000-memory.dmp

Download

memory/2144-23-0x0000023E53650000-0x0000023E53658000-memory.dmp

Download

memory/2144-24-0x0000023E51240000-0x0000023E51250000-memory.dmp

Download

memory/2144-25-0x0000023E51240000-0x0000023E51250000-memory.dmp

Download

memory/2144-26-0x0000023E51240000-0x0000023E51250000-memory.dmp

Download

memory/2144-27-0x0000023E51240000-0x0000023E51250000-memory.dmp

Download

memory/2144-28-0x0000023E51240000-0x0000023E51250000-memory.dmp

Download