ca839c79741fbab7bcf73a6fd80e78062e174da098a30ecb2607653b6aaa098b

Analysis

max time kernel
150s
max time network
158s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 18:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Xpand!2_2.2.7_Setup.exe
Size 135.6MB
Sample260807-w8yleshe99
SHA256 ca839c79741fbab7bcf73a6fd80e78062e174da098a30ecb2607653b6aaa098b
MD5 3ca5a287dd41592a631a3a3564e2950c
SHA1 c7ac1bdceac77ea4ed5b77a5e6455e46129d80df
SHA512 0e199cdcf70a522b6db0223f5fcf1cc7beabd421bfdfd9b8e69d7c555bf58e5a027e2cf2a568706485bda7add72f2599a0f81bc93473a0089b20b55087e49c61
SSDEEP 3145728:qLlsNiU1pD/WvtyKeau/Y/kn2FFsvC/9selMF:qLlsNJ1pD/4deDY/EUe+9semF
TLSH
T1D26833325199BB29E79000BEE9B8742C3C74BDD9541481D6E4CDDEAE1F9F10322B6BC9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2516	Xpand!2_2.2.7_Setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Xpand!2_2.2.7_Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Xpand!2_2.2.7_Setup.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 2516	4968	Xpand!2_2.2.7_Setup.exe	89

C:\Users\Admin\AppData\Local\Temp\Xpand!2_2.2.7_Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Xpand!2_2.2.7_Setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Users\Admin\AppData\Local\Temp\Xpand!2_2.2.7_Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Xpand!2_2.2.7_Setup.exe" -burn.unelevated BurnPipe.{8ED9D2EC-ED01-478A-9201-AF9B0BFB24F2} {66194426-12B9-4AFC-A1E9-C005DA3019D4} 4968
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Logo.png

Path C:\Users\Admin\AppData\Local\Temp\{dadbcc76-2a7e-4f53-a77a-3868c51bdd80}\.ba1\Logo.png
Size 8KB
SHA256 4fbe5b49f79b07c0c7be42c8b0d4cdb546f41e6534982d5aae318323446e02e4
MD5 ef64063135e8571eefedf020dedba5a7
SHA1 6c4a784027bee37d7f69330b1225060a88b19be5
SHA512 a37faf3eb2ee7808708717685a9063b0a17a0e17564df7d24e7a90caf1b0b565ad6dc61b2551fa96321cb43da63fd7651fd9cc540e7c196391f59d40d223c65e
SSDEEP 192:FuDK9zzFmZd3Eo0lmjxNKcGIw987MHpU1rUt:FuDiwZxIYnwO7Mmmt
TLSH
T16502AE713A6FCD4FEE097FD480B6062B4B4EAC8501292447F5EE6A2E60AE820F795490
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LogoSide.png

Path C:\Users\Admin\AppData\Local\Temp\{dadbcc76-2a7e-4f53-a77a-3868c51bdd80}\.ba1\LogoSide.png
Size 86KB
SHA256 fd905d17ebf98939093fb911038896f03dc9878841244dd50b42ac0c955ce5e7
MD5 2aebb11196543062fa5f97c130afc389
SHA1 eee76e368b53a31da51962f78cce53ba4e903295
SHA512 f36a59bf29c89cb7521643e2518d959f35ba175f5ac884c6dcf2a66e50b52c2ec4eaf1bc1d8c6e91b837587f4cc66cb845bb832d6ac1008c608383832730d1c2
SSDEEP 1536:NofiJAAnkZfSp/Hn5f7fJtAah/0KvmDNty2pcLvegCdxIwTBZU:vJAjSpv5f7fpFeDny0gCdxVTTU
TLSH
T197830274ADB4CA11A0658EEBE8591CCEF1AF44465CF800EC0C770FD443FE6D9899A1E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixextba.dll

Path C:\Users\Admin\AppData\Local\Temp\{dadbcc76-2a7e-4f53-a77a-3868c51bdd80}\.ba1\wixextba.dll
Size 156KB
SHA256 0e3c3e71e19952e366c450b3c895340564007bb7c56900b31d0262ebe24e21fa
MD5 8ea0df94b525101b06c1418692a38b7d
SHA1 60be0e93f314cdb0bf2c74a9e9a8c50d19522f8f
SHA512 93753ebca0b851f76d1e163a57d35dfa1e4830108c7c04ef7bf2159eea495a7124776933dea081dd063d46d67d9f512cdff35fb8b2add913b9630b58a531507e
SSDEEP 3072:EGYUK9rWf42CdaaGnLCv2yaQum4rZZBDGt96dwk2i+lmEni5CXU6nDLCFex2:EGqVWAvdtvvOQj4tGt9DlPDLL
TLSH
T1C4F36B2025D08036E6F706B85DB992A06F7B7A314B60D4CF2BD55E7E1F722D29A35323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads