18d9711d59f71f37ee0335bba29545f5d3e11dd0b8fb318af76e9486da179089

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/11/2026, 22:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LDManager.core.ps1
Size 158KB
Sample261104-2rg51avyet
SHA256 18d9711d59f71f37ee0335bba29545f5d3e11dd0b8fb318af76e9486da179089
MD5 89f83b9e0efb6b9669957224e986addd
SHA1 4d81bf57b5a802efde69186bf37e5eda9f54e2f8
SHA512 dfc9b182e767d544ce075685b148891627158bb7440863040c530aec0aad331a67f2e28038d6b6016c0605923e37d240983cf06c1691b4945c46d5aad83f0041
SSDEEP 3072:SMrnwY4hEUZd0TX8Dly2NLbQ9PnEdioM3HP+BhkrjX6RDeKq3:prnwcqYMDbbU9HPkkrjKcKS
TLSH
T1D2F364206D4654AE02B1E73BDD55A809FCD6047FAB1D1204B5AC58A93FF632CC33DE6A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2872	powershell.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2872	powershell.exe
2872	powershell.exe
2872	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2872	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 5016	2872	powershell.exe	85
PID 5016 wrote to memory of 3168	5016	csc.exe	86

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\LDManager.core.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\a32mr0r3\a32mr0r3.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5016
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEA3C.tmp" "c:\Users\Admin\AppData\Local\Temp\a32mr0r3\CSC951C1C5F6AF040F7BF7D56E44143F261.TMP"
    3⤵
    PID:3168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESEA3C.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESEA3C.tmp
Size 1KB
SHA256 e5f8b1c2c40bb967cda9562314f3dd1cb66e63deb19b17d43453ce0e1b0ae9ef
MD5 9cbd5b3ae9473dde53859eb51a4bbbcc
SHA1 cbbc93b5cec5ce72992b125cb795c61e54ef6def
SHA512 69e1d6241ce9f33096356cd2e601597fcf908def9933a477cd385545b97d49e92034dccdcaf571ea47f3887a383fc69dcf304c3fe710370ba41de27fdc86e62d
TLSH
T1DD21AF0553E84B1BF077473169F6072F9678FD96EFA2575B8540422C1C61114EEE1E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_jqfwzuxz.wht.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jqfwzuxz.wht.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

a32mr0r3.dll

Path C:\Users\Admin\AppData\Local\Temp\a32mr0r3\a32mr0r3.dll
Size 3KB
SHA256 a8bbb6e3473831384aa9ce44d20a0b78a7a0e4bc38d5376b37fd2520846f7a9c
MD5 d72724ab8a45cf5445f56ea6073d44d9
SHA1 5e24746db23ca05fadf8ca5c5bb63110c95ac66b
SHA512 e94f54ee34c4bda35f710cfdcf098c1f189e73caedeefe43befced502bd57a1a2ed85f5689e747d26091a929fa727a331cba356fdf1336177ee10c7c41bb08a6
TLSH
T1B751BB1AA3F8066BF4774B306EF3476627F4F8109B72575E59D00368AC613A88932BB0
MD5 SHA1 SHA512 TLSH

Submit Download

CSC951C1C5F6AF040F7BF7D56E44143F261.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\a32mr0r3\CSC951C1C5F6AF040F7BF7D56E44143F261.TMP
Size 652B
SHA256 3c1beff6166f11a3fa1ad60bf83d03e40f736a336154461b9e4edd24284c250b
MD5 2aaced95c346386b7f84a84c99dccf54
SHA1 8e9ce2fb5b937a804973c7267a1096e0240befb1
SHA512 6cf8c955d64f07ac468c795a818f415db02786128079b707876b35fecd4a472437b0770494a35b5ab3d94f1a243f827ad20e52e7836ca2d7021981eb03bdc17e
TLSH
T1B1F05E4A63F8120EF0F74B30BDF6836395B8BC65DE3297ED1890135928746209972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

a32mr0r3.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\a32mr0r3\a32mr0r3.0.cs
Size 289B
SHA256 1822f786a9782953233825b2cda3e0954d383f61d9260f940078ea9f13e39360
MD5 84a4d284c78980971b21685d31b7e13b
SHA1 4f780f3b0ab02a09eb76668cbf8ba2cc5ae67a19
SHA512 9d960f72495774ccbd7edd1cb3252b973a15d593b4b349eac119ca7571913ce240ba133f7c3d2221654ffe49494233826efcc3b62d74fa9773ed859151d97101
TLSH
T111D0C21869B3BEA000624C270C8EA5FDB717112636AB1A15A6FA0721DF5B00A0271E5A
MD5 SHA1 SHA512 TLSH

Submit Download

a32mr0r3.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\a32mr0r3\a32mr0r3.cmdline
Size 369B
SHA256 a07909b90b2d3e335495fbe12ec764f1e6d1523a3a25e3618719b1a73d153862
MD5 cef792f3fe68e0c09c2bcdc2b46e2e21
SHA1 ff7f0c64b90bc5705c57d18b2b2dffb0037431fa
SHA512 c3187c117e7baf0efeee189ef8503fa105c27df1da104f5bc4634540daf1bcb19cd65be74bd9a390570c35e863d69c8e6bad917d6c58bce6447beac25b3d7f87
TLSH
T1ECE0202AD256C67D27EF201721A9C5EDC372078729C17F885150446FD027005ABE2F55
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2872-9-0x00000206A3440000-0x00000206A3462000-memory.dmp

Download

memory/2872-0-0x00000206A3480000-0x00000206A3490000-memory.dmp

Download

memory/2872-1-0x00000206A3480000-0x00000206A3490000-memory.dmp

Download

memory/2872-22-0x00000206A3410000-0x00000206A3418000-memory.dmp

Download

memory/2872-23-0x00000206A3480000-0x00000206A3490000-memory.dmp

Download

memory/2872-24-0x00000206A3480000-0x00000206A3490000-memory.dmp

Download

memory/2872-25-0x00000206A3480000-0x00000206A3490000-memory.dmp

Download

memory/2872-26-0x00000206A3480000-0x00000206A3490000-memory.dmp

Download