6b47a4f75275ac9b03d6e6b206db54fd6c9e87eebc930504baaea3e08b36a4ed

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/11/2026, 22:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LDManager.ps1
Size 14KB
Sample261104-2rjc3a1t2n
SHA256 6b47a4f75275ac9b03d6e6b206db54fd6c9e87eebc930504baaea3e08b36a4ed
MD5 2cd4bf48318f41cb39becb4aeb70e625
SHA1 5aef88081d1fda3066cc7cfa5d8790f6c92c4801
SHA512 6c735b2402b7170ef4e9c7d334ae79071d075807d63bcc2fa54195aa4009d1b2378f67b9d9a52ffb383dab344de4e190dd30f9042d68a3102a01214cfdb5d47d
SSDEEP 384:5N9Jv3+uRT3o0lpTADTgm5Thtm5QFxPQZ0Ig:nTjqYToTgmwKPNIg
TLSH
T1BD526B594D43686E05B2E243C9417C1EF8E607BFAFE952A4389C28391FE16285B3E991
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5080	powershell.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
5080	powershell.exe
5080	powershell.exe
5080	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5080	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 3452	5080	powershell.exe	87
PID 3452 wrote to memory of 2064	3452	csc.exe	88

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\LDManager.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0oumttfv\0oumttfv.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3452
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAD14.tmp" "c:\Users\Admin\AppData\Local\Temp\0oumttfv\CSCE8B2391A8F354EE3823F192817FE745.TMP"
    3⤵
    PID:2064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0oumttfv.dll

Path C:\Users\Admin\AppData\Local\Temp\0oumttfv\0oumttfv.dll
Size 3KB
SHA256 8704e7a13ac4f0a2152b82320d8fa8952a740046d489b8f15ec7872250d1fade
MD5 5a748194f422e0761443db9caff183dc
SHA1 58a5336073c4c9669455ce6af12a58e82970272c
SHA512 f6f7532cc15356da433bde07b07ed8132ce845d6b8d3bce84e891182ebca206dc10c2191e8dff9ad2d19edba95625eddb9e080c3fb8fc1fa3808ce1b16541dda
TLSH
T13751BB16A3F8066BF4B347306EF3472627B4F9109B72975E49904369AC513A48E72BB1
MD5 SHA1 SHA512 TLSH

Submit Download

RESAD14.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESAD14.tmp
Size 1KB
SHA256 f14e453b3b3b8bb6c924ab7c9d110837d45d78b1af93640abfc7ed4a871a2c7f
MD5 163149b5e436303922b149787986d053
SHA1 55cfb0f81fb1af823b1cdb4b34ab07b11aad46d6
SHA512 10f0086bb9e3b4367e8dd02b9f72b560ad73fa0f246cd4e7671ec9bbef44603bbb364e80a300df2eefacdf5f8faecbfdd5de5da35ab32aa296bad5316839f25f
TLSH
T17B21894583E84B1AF077473279FA072B9279FD95EFA2A35B8540422D2851504EEA0F72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_zvp5331s.4rc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zvp5331s.4rc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

0oumttfv.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\0oumttfv\0oumttfv.0.cs
Size 289B
SHA256 1822f786a9782953233825b2cda3e0954d383f61d9260f940078ea9f13e39360
MD5 84a4d284c78980971b21685d31b7e13b
SHA1 4f780f3b0ab02a09eb76668cbf8ba2cc5ae67a19
SHA512 9d960f72495774ccbd7edd1cb3252b973a15d593b4b349eac119ca7571913ce240ba133f7c3d2221654ffe49494233826efcc3b62d74fa9773ed859151d97101
TLSH
T111D0C21869B3BEA000624C270C8EA5FDB717112636AB1A15A6FA0721DF5B00A0271E5A
MD5 SHA1 SHA512 TLSH

Submit Download

0oumttfv.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\0oumttfv\0oumttfv.cmdline
Size 369B
SHA256 ac8164ee74749f3603bde1ee59a5a2f3ce1b8402ff25cd2d0d92722ff36823dc
MD5 72c5dabeb374ad946b3901318dfa4971
SHA1 fe5b7f061565036f55f022cd2041f9838737d0d0
SHA512 4262aaf65a500ca5ab68d69681854056dba11df08165a9e0c8d96e8a410e30c528d66bb5a6d30e7b572a18660ca81cb533e367ffcd779343d989e108f61a9454
TLSH
T186E0C62E4256C27E22ED700B327AE4ACC372078329903F88D35C880EE067000FBD3B81
MD5 SHA1 SHA512 TLSH

Submit Download

CSCE8B2391A8F354EE3823F192817FE745.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\0oumttfv\CSCE8B2391A8F354EE3823F192817FE745.TMP
Size 652B
SHA256 65961f0ecb42ae4b0fbc57d870f0b3db0744e1c62751bfabae6f4380e07c173c
MD5 8add34217cce98ef969b99cf845e0a90
SHA1 5428b027b6c82d26e744d307e41c09368545a5bc
SHA512 5e1ddd7f306f5b1845e4ecf5684111b9a343952f8fe447512e03e8a15a39b330aa4774c81c931c772ec1f86071bb8329cd56fccf464624dcda87dafd6ba78305
TLSH
T12EF05E4AA3F8020EF0F34B30BDF6436391B9BC65DE32A3ED1440031D28645108AA2FB2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5080-10-0x00000135F9470000-0x00000135F9480000-memory.dmp

Download

memory/5080-1-0x00000135F9470000-0x00000135F9480000-memory.dmp

Download

memory/5080-9-0x00000135FB760000-0x00000135FB782000-memory.dmp

Download

memory/5080-0-0x00000135F9470000-0x00000135F9480000-memory.dmp

Download

memory/5080-23-0x00000135F9460000-0x00000135F9468000-memory.dmp

Download

memory/5080-24-0x00000135F9470000-0x00000135F9480000-memory.dmp

Download

memory/5080-26-0x00000135F9470000-0x00000135F9480000-memory.dmp

Download

memory/5080-25-0x00000135F9470000-0x00000135F9480000-memory.dmp

Download

memory/5080-27-0x00000135F9470000-0x00000135F9480000-memory.dmp

Download

memory/5080-28-0x00000135F9470000-0x00000135F9480000-memory.dmp

Download