5b820b5fe9a318d8714b697acbf309a96aa68946a7af75752eb3038833a98340

Analysis

max time kernel
149s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/11/2026, 22:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LDManager.ps1
Size 14KB
Sample261104-2rg51avyet
SHA256 5b820b5fe9a318d8714b697acbf309a96aa68946a7af75752eb3038833a98340
MD5 23fd40568f6245b0a6d3d8e0c454cdfb
SHA1 d1d00c60581035e3b0a39cab15f7479998597f4b
SHA512 a2b3e59b782b51ab9953000b6739de38804ec2b6158b4f0d6d0016159b171f43049de310d427e86dee617669ce393252cde9ec537f114ef02cd63d2350f7ee00
SSDEEP 384:5N9JC3+uRT3o0lpTADTgm5Thtm5QFxPQZ0Ig:nujqYToTgmwKPNIg
TLSH
T1D7526C594D43686E05B2E243C9017C1EF8E607BFAFF952A4389C28391FE13285F3E991
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
448	powershell.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
448	powershell.exe
448	powershell.exe
448	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	448	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 448 wrote to memory of 2140	448	powershell.exe	86
PID 2140 wrote to memory of 2996	2140	csc.exe	87

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\LDManager.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:448
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\20ymqj52\20ymqj52.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2140
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES712F.tmp" "c:\Users\Admin\AppData\Local\Temp\20ymqj52\CSC73339E5E39A43CF871EC12EEC61BCD7.TMP"
    3⤵
    PID:2996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

20ymqj52.dll

Path C:\Users\Admin\AppData\Local\Temp\20ymqj52\20ymqj52.dll
Size 3KB
SHA256 cc70690f26b89c84c667175de2b3e7de3982805f17169b12648818049b4a06b3
MD5 9919ff783676ab07a8226d9af51785c4
SHA1 197e76c6548f4b9781b24fb3b8bdd43d22f61b76
SHA512 50cb63be4e6d6aecad791a4cd1f58d7387517076773f0c8da699d9d6a58689d51e66b4208c4099824f2ad239d8699ca46902b324284528c6770e80c6e6acb588
TLSH
T1A251EF1AA3E8462BE0734B306EF3072737F8F8109B72575D49C04329AC513A49D32BB1
MD5 SHA1 SHA512 TLSH

Submit Download

RES712F.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES712F.tmp
Size 1KB
SHA256 d28815f35a056b04f8036a500ca31443e0d2cfbc71bdcab5b0ee8ec285e3a265
MD5 f27d382fe1433a37e5791daa6d419987
SHA1 3018ddda699a7f7d2bb06447e0764c1e3621fd1f
SHA512 65b47122cd4d53f8116579c08026c240e6457e85de28d52ffebbcb553c5402f7a75a524a056cf1986afb53470ee39dcb5ec2fccb796109f11ceded1b507e89b1
TLSH
T10521AF0957EC4B1EF0778B3269F5172B9175FD54DFB1575E854082281C41504EEE0F72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_cihkjrpf.3kl.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cihkjrpf.3kl.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

20ymqj52.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\20ymqj52\20ymqj52.0.cs
Size 289B
SHA256 1822f786a9782953233825b2cda3e0954d383f61d9260f940078ea9f13e39360
MD5 84a4d284c78980971b21685d31b7e13b
SHA1 4f780f3b0ab02a09eb76668cbf8ba2cc5ae67a19
SHA512 9d960f72495774ccbd7edd1cb3252b973a15d593b4b349eac119ca7571913ce240ba133f7c3d2221654ffe49494233826efcc3b62d74fa9773ed859151d97101
TLSH
T111D0C21869B3BEA000624C270C8EA5FDB717112636AB1A15A6FA0721DF5B00A0271E5A
MD5 SHA1 SHA512 TLSH

Submit Download

20ymqj52.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\20ymqj52\20ymqj52.cmdline
Size 369B
SHA256 f8a646dc193896f0281854651ebf6d4ce2a215c844d5520700680c141a8c6448
MD5 085937c23d428ada0631b9369a737119
SHA1 a66b08b265d02e62be256ebc8922128656c4e318
SHA512 19c3220fb888b6e5e4eedcf1fa36997f886bb3a4c7182fb467f74cf132d9e6c3d41683b7b60a5ae8fd7a9d1d3f1f22fee88a98c5c9bc2d5d060c5143c1103586
TLSH
T1DBE0C62E624EC37D01ED100B32EEC4ACCEFA07832AC63F84E040848FE067080ABD2781
MD5 SHA1 SHA512 TLSH

Submit Download

CSC73339E5E39A43CF871EC12EEC61BCD7.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\20ymqj52\CSC73339E5E39A43CF871EC12EEC61BCD7.TMP
Size 652B
SHA256 8592357e502401311260e96794cf3c5834d2ca84b4da71d80fae58c7dbf5e6ec
MD5 c0487c2850b6830a6ed85c38c1279b81
SHA1 bf0cf26600af2a1dba3ddba66b3b2ad8c60d4217
SHA512 859e5b0d482eaa3ba902d0fc1a61828cd4a6dd4a6f08bd2a52c7d8bb32eb14d8b03760806bcee015e6e37efe4f0235b598d06468e0e41dca5836afeea9a51caf
TLSH
T19DF05E0963F8520EF0F38F71BDF6436391A8FC64DE3293ED548043196C64A109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/448-10-0x000001C0A9C80000-0x000001C0A9C90000-memory.dmp

Download

memory/448-1-0x000001C0A9C80000-0x000001C0A9C90000-memory.dmp

Download

memory/448-9-0x000001C0C4470000-0x000001C0C4492000-memory.dmp

Download

memory/448-0-0x000001C0A9C80000-0x000001C0A9C90000-memory.dmp

Download

memory/448-23-0x000001C0C44E0000-0x000001C0C44E8000-memory.dmp

Download

memory/448-24-0x000001C0A9C80000-0x000001C0A9C90000-memory.dmp

Download

memory/448-26-0x000001C0A9C80000-0x000001C0A9C90000-memory.dmp

Download

memory/448-25-0x000001C0A9C80000-0x000001C0A9C90000-memory.dmp

Download

memory/448-27-0x000001C0A9C80000-0x000001C0A9C90000-memory.dmp

Download

memory/448-28-0x000001C0A9C80000-0x000001C0A9C90000-memory.dmp

Download