458d50f7f2b86f54b3fd19752db7426eb818a927013dba8629b5bc72f9d46665

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/11/2026, 22:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LDManager.core.ps1
Size 157KB
Sample261104-2rh3asvyev
SHA256 458d50f7f2b86f54b3fd19752db7426eb818a927013dba8629b5bc72f9d46665
MD5 4e99c46e376f878669c755675b889bd0
SHA1 7fd2179ad4d84c959c000fbfa3b1c705259a42af
SHA512 ef27f9e1b8b5d2290acd0343e92c76440ea5141af25b56be8ee02b6f5ffc84d6b5335427a3fa490269d8ef98c90c7b87c6d58739dbf7cdfe7480a6cedb712d76
SSDEEP 3072:UMrnwY4hEUZd0TX8Dly2NLbQ9PnEdioM35+3hkrjX6RDeKq3:TrnwcqYMDbbU95CkrjKcKS
TLSH
T164F374206D4654AE02B1E73BDD55A809FCD6047FAB1D1204B5AC58A93FF632CC33DE6A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
536	powershell.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
536	powershell.exe
536	powershell.exe
536	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	536	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 3708	536	powershell.exe	87
PID 3708 wrote to memory of 3916	3708	csc.exe	88

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\LDManager.core.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:536
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4hlegotp\4hlegotp.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3708
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6FBC.tmp" "c:\Users\Admin\AppData\Local\Temp\4hlegotp\CSC7CBF52FE23FA46AA858DD83265B96EDF.TMP"
    3⤵
    PID:3916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4hlegotp.dll

Path C:\Users\Admin\AppData\Local\Temp\4hlegotp\4hlegotp.dll
Size 3KB
SHA256 c9132b90756b8de647238c371081a8acd18840d36d8e659a7a03671a634ea93d
MD5 9ca417aebf19bf1f736b0c2e777228b2
SHA1 45155a4a178165327200b45e92cdd97a6eb3af37
SHA512 0091a1ac7b23500bf8e133d4382e1458b3d24f7148c58d73d681316fe440dbe75163b111f3818317f024345109f428a187e29c2898449ca37cf7a3f528ed9358
TLSH
T14551CC5AA3F8467BF4770B306EF3476627F4F8109B72975E49D00239AC513644A32BB1
MD5 SHA1 SHA512 TLSH

Submit Download

RES6FBC.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES6FBC.tmp
Size 1KB
SHA256 68d8519e73fe024e163403d40cd4c1a7623bffb3eae75052b342d5e570923984
MD5 27a437b7d9b14823ad61c76c24396e60
SHA1 351c9887a02f3e21c3ba13ad53b843aa911754dd
SHA512 635a6bead564a601f546ca522fa6210b066fb8e364db3c94d294cb8fe16ab3e3b3e03f748c0726c58c48afa0fa707c002c833752a09cc3738efef62c9827a967
TLSH
T1AF21890553E84B1EF0B74731BDF6132F9238FD98AFA2935B854042282C50504EEE1F72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_yi3yqgkz.11o.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yi3yqgkz.11o.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

4hlegotp.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\4hlegotp\4hlegotp.0.cs
Size 289B
SHA256 1822f786a9782953233825b2cda3e0954d383f61d9260f940078ea9f13e39360
MD5 84a4d284c78980971b21685d31b7e13b
SHA1 4f780f3b0ab02a09eb76668cbf8ba2cc5ae67a19
SHA512 9d960f72495774ccbd7edd1cb3252b973a15d593b4b349eac119ca7571913ce240ba133f7c3d2221654ffe49494233826efcc3b62d74fa9773ed859151d97101
TLSH
T111D0C21869B3BEA000624C270C8EA5FDB717112636AB1A15A6FA0721DF5B00A0271E5A
MD5 SHA1 SHA512 TLSH

Submit Download

4hlegotp.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\4hlegotp\4hlegotp.cmdline
Size 369B
SHA256 ac50ff692b62f14813e0b5c6d814545950945886f25f09364a1e3db36e4cf8f2
MD5 96c346bdcba1acea83ecfdfd147e2a68
SHA1 0ddc25619bad5ee8a00028c8d45674b56a477690
SHA512 0060e5f441cbe4d5fb05199d1a7d0d9923c5937dd6b6905a0c050cad1b5cfd94475f74ba1d8acc85fcac85c87c892de63f145e36e6a10a43d252e339849dc713
TLSH
T10DE0C0FA6296CBBD81DD500725F9C5ADCA72074339707F845061880ED61740427D1B83
MD5 SHA1 SHA512 TLSH

Submit Download

CSC7CBF52FE23FA46AA858DD83265B96EDF.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\4hlegotp\CSC7CBF52FE23FA46AA858DD83265B96EDF.TMP
Size 652B
SHA256 a3c5a4ecb07b8ae8787c3953c75b0411f66a4ac4d39a700216a94e8f63db7186
MD5 8c8f74e16865e5b59695f800aa53b023
SHA1 d80014315bcab20d0a1d04bd05195a74ef4ed50c
SHA512 111573a8de76380ff91873ae78ff8696674bc06ba556865bc953a2fdd475e9acd9d450fa5899580c243a19dfb4119d33dce8b3e06ba2937f82d19ff2f5d5d509
TLSH
T130F03A4963F8030EF0F74B70BDF6436391A8FC64DE3293ED1840031D28646208962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/536-9-0x0000022D62970000-0x0000022D62992000-memory.dmp

Download

memory/536-1-0x0000022D468E0000-0x0000022D468F0000-memory.dmp

Download

memory/536-0-0x0000022D468E0000-0x0000022D468F0000-memory.dmp

Download

memory/536-22-0x0000022D48370000-0x0000022D48378000-memory.dmp

Download

memory/536-23-0x0000022D468E0000-0x0000022D468F0000-memory.dmp

Download

memory/536-24-0x0000022D468E0000-0x0000022D468F0000-memory.dmp

Download

memory/536-25-0x0000022D468E0000-0x0000022D468F0000-memory.dmp

Download

memory/536-26-0x0000022D468E0000-0x0000022D468F0000-memory.dmp

Download