d4da18bf1cf7e12f804bcaed4ae6718f556e2c2bd001fc8bfc1421bc9b1f1d99

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/11/2026, 22:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LDManager.core.ps1
Size 157KB
Sample261104-2rjc3a1t2n
SHA256 d4da18bf1cf7e12f804bcaed4ae6718f556e2c2bd001fc8bfc1421bc9b1f1d99
MD5 de2a471a986cf4543c43878cff1fc4ff
SHA1 6e02997b84e88e7981d3fb5bfabf92c7de1a3f7e
SHA512 f17bcbb89478f0ce9baaf9e17febadbf61bb488248de3282be36279e1774f3a25ee0b30db417cd1b9a6ce6781da874852aee4e13255bc23a6067540465a79eae
SSDEEP 3072:bM/nwY4hEUZd0TX8Dly2NLbQ9PnxdioM3l+3hkrjX6RDeKK3:I/nwcqYMDbbUMlCkrjKcKy
TLSH
T1C5F374206D4654AE02B1E73BDD55A809FCE6047FA71D1204B5AC58A93FF632CC33DE6A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2428	powershell.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2428	powershell.exe
2428	powershell.exe
2428	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2428	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 5104	2428	powershell.exe	86
PID 5104 wrote to memory of 1816	5104	csc.exe	87

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\LDManager.core.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qegzzoj0\qegzzoj0.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5104
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD1.tmp" "c:\Users\Admin\AppData\Local\Temp\qegzzoj0\CSC1A5C4AAF7AB64FA686AAEF9D844CAF96.TMP"
    3⤵
    PID:1816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESD1.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESD1.tmp
Size 1KB
SHA256 a2780bf90bed1ebd3cfae7e7f725caba5d9c63d8c347fcf0636879079c762cb6
MD5 bfe8154fb2dcd5ec164b1ffdd9ef4382
SHA1 6d95235b7435ca091aba43731a11fa26db9e9b8b
SHA512 58a09b4077495809f94c4c4ee3458f58be974512b706fb9cf489e0e9200dabb2ca48f04e0180abdd350d7ace1d0743c37269084d49a0a1231827e8865a59adb9
TLSH
T1D5218C0583F8471EF0B747316AF6636B9278FD549F62A35B8540522C1C40604EEA0E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_iluwk2cf.hsu.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iluwk2cf.hsu.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

qegzzoj0.dll

Path C:\Users\Admin\AppData\Local\Temp\qegzzoj0\qegzzoj0.dll
Size 3KB
SHA256 df3c6c56445a6f7e78f6b413351d2289e31330ea1e030c3eabfe293bdafe77d7
MD5 622834bd54700d04e08171fc61f4c7e3
SHA1 a4d42aa1af13a95b4f516d1d72b8847421e2a490
SHA512 7eed477a81d8cfe9b6cda46a55451c242f21dcdece9066f6696e145865443ba3f2477ec648ca66c998bfc908a2bdee1bf08115118bb30ffd55a7610eadfedfab
TLSH
T12A51C91AA3F8466BE4B70B306EF3475727B4F9209B72976E59D00329AC603644932FB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC1A5C4AAF7AB64FA686AAEF9D844CAF96.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\qegzzoj0\CSC1A5C4AAF7AB64FA686AAEF9D844CAF96.TMP
Size 652B
SHA256 bf8d60dd7c313c292fc573709b3a24e83e760acc8e9f79547361e1fd23c27f04
MD5 88df85207b6510d18742fb2368fdabf9
SHA1 37f77cb6b35a81bc47ca03494b12609ff2506ccf
SHA512 73400b201d78d419accdb9a0c98fe3a40a17c730cdf3b556619338f2d65ffea7d18be11533b6084a8fc21827c3b74290c5325081c64a49b2acf34a8d4a640936
TLSH
T128F0890963F8420EF0F74B30BDF543639168FC64DE3253ED1884031D1C646108961F72
MD5 SHA1 SHA512 TLSH

Submit Download

qegzzoj0.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\qegzzoj0\qegzzoj0.0.cs
Size 289B
SHA256 1822f786a9782953233825b2cda3e0954d383f61d9260f940078ea9f13e39360
MD5 84a4d284c78980971b21685d31b7e13b
SHA1 4f780f3b0ab02a09eb76668cbf8ba2cc5ae67a19
SHA512 9d960f72495774ccbd7edd1cb3252b973a15d593b4b349eac119ca7571913ce240ba133f7c3d2221654ffe49494233826efcc3b62d74fa9773ed859151d97101
TLSH
T111D0C21869B3BEA000624C270C8EA5FDB717112636AB1A15A6FA0721DF5B00A0271E5A
MD5 SHA1 SHA512 TLSH

Submit Download

qegzzoj0.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\qegzzoj0\qegzzoj0.cmdline
Size 369B
SHA256 acaebbff5106ea62b893cd7af897d6761683c6fcd1c8cecc38131485934e672f
MD5 9d8718659bed29b2e83eb8786bce8be8
SHA1 8cc0b78744f31243fa205e73e51ee73ab73b65f3
SHA512 2c3358eeac1abb8aa7a60eb52e3d010fa96a03006b0e0a37d529fec79357e0396a3c9dbb5dc2da51d9e9c3c8c5d00ef4ded2780b4f706b49c796ab404b67ebdd
TLSH
T184E0C03A52AEC2FD05DD1807236FC7ACE27217432D417F845050444DD21740077D2B43
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2428-0-0x0000020A4F860000-0x0000020A4F870000-memory.dmp

Download

memory/2428-2-0x0000020A687E0000-0x0000020A68802000-memory.dmp

Download

memory/2428-1-0x0000020A4F860000-0x0000020A4F870000-memory.dmp

Download

memory/2428-22-0x0000020A4F9C0000-0x0000020A4F9C8000-memory.dmp

Download

memory/2428-23-0x0000020A4F860000-0x0000020A4F870000-memory.dmp

Download

memory/2428-24-0x0000020A4F860000-0x0000020A4F870000-memory.dmp

Download

memory/2428-25-0x0000020A4F860000-0x0000020A4F870000-memory.dmp

Download

memory/2428-26-0x0000020A4F860000-0x0000020A4F870000-memory.dmp

Download