0b2d36533342d396e7efa5a53642ce90f76b9c5e09ee6a8dfaa1b372f6afc477

Resubmissions

03/05/2026, 00:14

260503-ajbvgahx3x

03/05/2026, 00:10

260503-af5y5sds9k7

03/05/2026, 00:08

260503-ae2v4ads8m7

Analysis

user interaction
yes
max time kernel
14s
max time network
8s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/05/2026, 00:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Bennett.exe
Size 2.0MB
Sample260503-ae2v4ads8m
SHA256 0b2d36533342d396e7efa5a53642ce90f76b9c5e09ee6a8dfaa1b372f6afc477
MD5 28f64d97f38bc053bab7f4119c387ef2
SHA1 8efce4939b55c84eaf65dc36a0f0d810f38edbf7
SHA512 56149353937fea34bb251845c0cf6454ee5a40f397d56d96fad58b18101a7bc52ea65c08336192321e141afe5e847cffd36559f316e89d56817aac19069774d6
SSDEEP 24576:L18h65lOjHLLcQ3akim/aCUs3+5xWH31nZxVdjQy7NGegz2:GE7urekim9+5x2nDLQeNMz2
TLSH
T169A56C00EEA28C35ED9250B5B5F6027AAA34BE60473156F713C0FE59FA315DCA93E316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4200	Bennett.exe

Maps connected drives based on registry 3 TTPs 3 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	Bennett.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count	Bennett.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	Bennett.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bennett.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4200	Bennett.exe

C:\Users\Admin\AppData\Local\Temp\Bennett.exe
"C:\Users\Admin\AppData\Local\Temp\Bennett.exe"
1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:4200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BroadcomBT.dll

Path C:\Users\Admin\AppData\Local\Temp\BroadcomBT.dll
Size 180KB
SHA256 a5727542e5a37957e648cd209b411757159fb4172d1bad34fa36b431ddf94361
MD5 0f40fe1b46f1669c26f35f3280a96fc8
SHA1 50e651f8bd0b2513bab0a021563440e3316ac59e
SHA512 257dd934662de576e4a4ccc6e10a7ff390ce3e96c4b4471fc554b829ea620f7dccf653b40c39175ef2b42eef8dced10c476d1f144fea2647b926f42d66517d39
SSDEEP 3072:GexEBkIsnGgo/HjeuHy+BWkSzH7y/Py7NIeJVr05em9fQL/ockmvHQl:3mO1nGgoPqP+WzH+Py7b0Im9fISf
TLSH
T1F4046C01B5A644FDE66E263C18BE3B3A967B6ED88B314BC71360DD656837181EC36307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4200-28-0x0000000002550000-0x000000000298B000-memory.dmp

Download