4638ba8a30ec18b7491c9fae445694f5ce1c314372a8d7fcd90f0aada78edc40

Analysis

user interaction
yes
max time kernel
149s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
N3D HAHA.exe
Size 24KB
Sample260925-vbmbfsfg86
SHA256 4638ba8a30ec18b7491c9fae445694f5ce1c314372a8d7fcd90f0aada78edc40
MD5 43ae831cbe9bc63549875675ce1cfcea
SHA1 8290998ff6b1587f38eb7a973aabb4c48351abf5
SHA512 81d7842638dbb42b814ee9117531024a2f2712da246c6e72d3b5ab0f27570b875bedf70a5bc1e41c7e78729fb95e8c1af4fa3f44719d91ec6b7d388d140eb753
SSDEEP 384:jLiknGU6rLAwMdaLiqSXhPLTufHm1sICJbt5j8KoQrJK/zy:niO6LHFeIfGR/2
TLSH
T100B2AA2EE7EC0556E27E9F31CEE853438936F752942EFD4E0C6ACF8D2B15A508465322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4984	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 4984	4964	N3D HAHA.exe	89
PID 4984 wrote to memory of 5480	4984	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\N3D HAHA.exe
"C:\Users\Admin\AppData\Local\Temp\N3D HAHA.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cmd.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4984
- - C:\Windows\system32\rundll32.exe
    RUNDLL32 USER32.DLL,SwapMouseButton
    3⤵
    PID:5480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cmd.bat

Path C:\Users\Admin\AppData\Local\Temp\cmd.bat
Size 5KB
SHA256 932f065927365836cdd8ac757846cda18a2fd4044615a864504ca6f56b8aa4d2
MD5 5f06994a1c6e18f7a56b6ce611e0680a
SHA1 acf2fd047d9786c88dd8568c2b243ed704ae6dd3
SHA512 a586d4da9f2fdc178462e5cf0d63f340c0e7cda8e67de20bde5d8b39b4b9d33acf70fea5d67f9968c3f846326db3eca18e0e1aac55d5bf38a0bd1e6dbd143c18
SSDEEP 96:6/F/Is23YEQpLuLpDqUmDsYW0LGMJi7sJEJxaJeJdHLgLxkLM4019AU4c8cppdDy:c23YEQpLuLpDq7QYfLGMV+jasHHLgLxq
TLSH
T1CCC167263B1DD674C4D04580D72EB90B379AE0536DF8E98C92F3A096906ACC7716E7CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4964-0-0x00007FFB2F65F000-0x00007FFB2F660000-memory.dmp

Download

memory/4964-1-0x0000000000800000-0x000000000080C000-memory.dmp

Download

memory/4964-3-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp

Download

memory/4964-4-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp

Download

memory/4964-10-0x00007FFB2F4D0000-0x00007FFB2FE74000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads