5b820b5fe9a318d8714b697acbf309a96aa68946a7af75752eb3038833a98340

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/11/2026, 22:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LDManager.ps1
Size 14KB
Sample261104-2rh3asvyev
SHA256 5b820b5fe9a318d8714b697acbf309a96aa68946a7af75752eb3038833a98340
MD5 23fd40568f6245b0a6d3d8e0c454cdfb
SHA1 d1d00c60581035e3b0a39cab15f7479998597f4b
SHA512 a2b3e59b782b51ab9953000b6739de38804ec2b6158b4f0d6d0016159b171f43049de310d427e86dee617669ce393252cde9ec537f114ef02cd63d2350f7ee00
SSDEEP 384:5N9JC3+uRT3o0lpTADTgm5Thtm5QFxPQZ0Ig:nujqYToTgmwKPNIg
TLSH
T1D7526C594D43686E05B2E243C9017C1EF8E607BFAFF952A4389C28391FE13285F3E991
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1332	powershell.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1332	powershell.exe
1332	powershell.exe
1332	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1332	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1332 wrote to memory of 4328	1332	powershell.exe	86
PID 4328 wrote to memory of 60	4328	csc.exe	87

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\LDManager.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1332
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fe434igr\fe434igr.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4328
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6EF1.tmp" "c:\Users\Admin\AppData\Local\Temp\fe434igr\CSC92085A889DB5494F854E80C372A9F5C2.TMP"
    3⤵
    PID:60

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES6EF1.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES6EF1.tmp
Size 1KB
SHA256 79963a85cb7c838de2d0d40cf8a8dfb3d9501d8ff6070c300359c64dece15e6e
MD5 a31339b7bc2841e9e4e994c10314cb4b
SHA1 440b847ffbeb6a26baac6c70e2e1e31169ef24df
SHA512 f793ced2cc6cce759de326f23b66f7d7d355f0639cebfcd2c7bfe457d56bdd46a2ecef260e811becd6ed4aa7e3f9aa61d016d6e6a039b150e05afef059a57be3
TLSH
T19F21AB0583E84B1FF4B7573269F60B2FA238FD65EF62679F854042282C91104EEA1E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ht13dngt.a1g.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ht13dngt.a1g.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

fe434igr.dll

Path C:\Users\Admin\AppData\Local\Temp\fe434igr\fe434igr.dll
Size 3KB
SHA256 32a5fcebf8cdc5e32267b7c4dd809868c3671f4896d07fcab10ed6c68f7f4450
MD5 c191a2c2a81078c2a95f5bb5b8de4cfe
SHA1 f10df6f8929dacbc5288192e83b1aa1a51c02a1d
SHA512 978e2ca21838dc8a77fc4e885660804928d3203e840fc7931348f821f9d0a458a52f4b3d43ca8c1c0c81a7d682774d5688bbd264fe6860fc971fa2c51ac87388
TLSH
T1EA51CC16A3E8467BF4730B306EF34B5637E4F8109B73975E49D00229BC613A48932BB0
MD5 SHA1 SHA512 TLSH

Submit Download

CSC92085A889DB5494F854E80C372A9F5C2.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\fe434igr\CSC92085A889DB5494F854E80C372A9F5C2.TMP
Size 652B
SHA256 e70c47ff9bbfe62de2cb144c06abdbf04c62579646c1e82728139d2f7b273fa1
MD5 10b9289b16ef5df2ccae2db1956f1737
SHA1 4ce8c99cc1b2f9dba46636f343f2ebf7e80ba709
SHA512 fe204b1a016146e4648ed56012629dd5aeaca7fb9213317e6489aa6f15b856e2d484d65b00c9ca4cb35383070c773db4957ef8da8fa4767ece871ef021b86875
TLSH
T1B0F05E09A3F8020EF4F34B30BDF64367A1A8FC65DE3393ED5540031928A45108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

fe434igr.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\fe434igr\fe434igr.0.cs
Size 289B
SHA256 1822f786a9782953233825b2cda3e0954d383f61d9260f940078ea9f13e39360
MD5 84a4d284c78980971b21685d31b7e13b
SHA1 4f780f3b0ab02a09eb76668cbf8ba2cc5ae67a19
SHA512 9d960f72495774ccbd7edd1cb3252b973a15d593b4b349eac119ca7571913ce240ba133f7c3d2221654ffe49494233826efcc3b62d74fa9773ed859151d97101
TLSH
T111D0C21869B3BEA000624C270C8EA5FDB717112636AB1A15A6FA0721DF5B00A0271E5A
MD5 SHA1 SHA512 TLSH

Submit Download

fe434igr.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\fe434igr\fe434igr.cmdline
Size 369B
SHA256 9c115f361091621ff52f08091883b65e0d928a5a97e16d9dadf7e7b2f57d8220
MD5 15c543df3bdd3f8ab35a54ef3fea2209
SHA1 c68f9c2125464de515881bfd6ccc017fd7e0ae6e
SHA512 5ceefd088c1337bcdd307e381a8c4f5eaef6128344e3fec89728f8dd44e40cf1d6f90daf5b257122def2b77fd9e9b2f0bb4c0ea91ac6955c597287b015b251eb
TLSH
T183E0683A4346CA7F15DA12172169EDEC83722A4329503F849240485EE0174102BE1B55
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1332-10-0x000001062F970000-0x000001062F980000-memory.dmp

Download

memory/1332-0-0x000001062F970000-0x000001062F980000-memory.dmp

Download

memory/1332-9-0x00000106172B0000-0x00000106172D2000-memory.dmp

Download

memory/1332-1-0x000001062F970000-0x000001062F980000-memory.dmp

Download

memory/1332-23-0x0000010617360000-0x0000010617368000-memory.dmp

Download

memory/1332-24-0x000001062F970000-0x000001062F980000-memory.dmp

Download

memory/1332-25-0x000001062F970000-0x000001062F980000-memory.dmp

Download

memory/1332-26-0x000001062F970000-0x000001062F980000-memory.dmp

Download

memory/1332-27-0x000001062F970000-0x000001062F980000-memory.dmp

Download

memory/1332-28-0x000001062F970000-0x000001062F980000-memory.dmp

Download