bd5ee1f6ebe18c36a0168c43f459f54fd133d35244b269e4ecef5bd2a484c72b

Resubmissions

02/06/2025, 23:08

250602-24hx3aek6z

02/06/2025, 22:44

250602-2pacdabk2110

Analysis

max time kernel
144s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20250502-en
resource tags

arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2025, 22:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
uploaded/4c6265723661653d2fdab12a0d5d7e841.exe
Size 409KB
Sample250602-2pacdabk21
SHA256 8e0bf3262f19da58a5e045c85d918e4a35b873dc1ac3a8c26dc7aa2fa07b59de
MD5 916707fcffcec2b8ae25dd706486f469
SHA1 6905656c07c1185b943520ea07980f422096f0a2
SHA512 5c8e1fe8b4b2d8a3b75e0b5bc462a2c55ab9fad090b40dbf227195be0d1de7d025a4dac3bcffe611e076a96d905ad2c02e06b64218dc906cf2684332ea7cdab6
SSDEEP 12288:V//ZbUXN0kCD9pZ4QQxCQDrX2t9xqkHE7o:V3Zbm0BZvQxCgrXS9fb
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery persistence upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3951986358-4006919840-1009690842-1000\Control Panel\International\Geo\Nation	4c6265723661653d2fdab12a0d5d7e841.exe

Executes dropped EXE 1 IoCs

pid	Process
4876	zango.exe

Loads dropped DLL 2 IoCs

pid	Process
3412	4c6265723661653d2fdab12a0d5d7e841.exe
3412	4c6265723661653d2fdab12a0d5d7e841.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\zango = "c:\\program files\\zango\\zango.exe"	zango.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\j:	zango.exe
File opened (read-only)	\??\k:	zango.exe
File opened (read-only)	\??\m:	zango.exe
File opened (read-only)	\??\p:	zango.exe
File opened (read-only)	\??\s:	zango.exe
File opened (read-only)	\??\v:	zango.exe
File opened (read-only)	\??\z:	zango.exe
File opened (read-only)	\??\g:	zango.exe
File opened (read-only)	\??\h:	zango.exe
File opened (read-only)	\??\q:	zango.exe
File opened (read-only)	\??\t:	zango.exe
File opened (read-only)	\??\x:	zango.exe
File opened (read-only)	\??\e:	zango.exe
File opened (read-only)	\??\l:	zango.exe
File opened (read-only)	\??\n:	zango.exe
File opened (read-only)	\??\r:	zango.exe
File opened (read-only)	\??\u:	zango.exe
File opened (read-only)	\??\y:	zango.exe
File opened (read-only)	\??\i:	zango.exe
File opened (read-only)	\??\o:	zango.exe
File opened (read-only)	\??\w:	zango.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral19/files/0x00080000000243a7-38.dat	upx
behavioral19/memory/4876-50-0x0000000000400000-0x0000000000495000-memory.dmp	upx
behavioral19/memory/4876-52-0x0000000000400000-0x0000000000495000-memory.dmp	upx
behavioral19/memory/4876-53-0x0000000000400000-0x0000000000495000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\zango\zango.exe	4c6265723661653d2fdab12a0d5d7e841.exe
File created	C:\Program Files\zango\zango.exe	4c6265723661653d2fdab12a0d5d7e841.exe
File opened for modification	\??\c:\program files\zango\zango.log	zango.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\Downloaded Program Files\ClientAX.dll	4c6265723661653d2fdab12a0d5d7e841.exe
File opened for modification	C:\Windows\Downloaded Program Files\ClientAX.dll	4c6265723661653d2fdab12a0d5d7e841.exe
File opened for modification	C:\Windows\Downloaded Program Files\RCXCFB5.tmp	4c6265723661653d2fdab12a0d5d7e841.exe
File opened for modification	C:\Windows\Downloaded Program Files\ZangoAX.cab	4c6265723661653d2fdab12a0d5d7e841.exe
File created	C:\Windows\Downloaded Program Files\ZangoAX.cab	4c6265723661653d2fdab12a0d5d7e841.exe
File created	C:\Windows\Downloaded Program Files\ClientAX.inf	4c6265723661653d2fdab12a0d5d7e841.exe
File opened for modification	C:\Windows\Downloaded Program Files\ClientAX.inf	4c6265723661653d2fdab12a0d5d7e841.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4c6265723661653d2fdab12a0d5d7e841.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zango.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\Programmable	4c6265723661653d2fdab12a0d5d7e841.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\ToolboxBitmap32	4c6265723661653d2fdab12a0d5d7e841.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\TypeLib	4c6265723661653d2fdab12a0d5d7e841.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}	4c6265723661653d2fdab12a0d5d7e841.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}\ = "IClientInstaller"	4c6265723661653d2fdab12a0d5d7e841.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}\TypeLib	4c6265723661653d2fdab12a0d5d7e841.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ClientAX.ClientInstaller\CLSID	4c6265723661653d2fdab12a0d5d7e841.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\Programmable	4c6265723661653d2fdab12a0d5d7e841.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\MiscStatus	4c6265723661653d2fdab12a0d5d7e841.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\InprocServer32	4c6265723661653d2fdab12a0d5d7e841.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}\1.0\FLAGS	4c6265723661653d2fdab12a0d5d7e841.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}\1.0\0\win32	4c6265723661653d2fdab12a0d5d7e841.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	4c6265723661653d2fdab12a0d5d7e841.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}\TypeLib\Version = "1.0"	4c6265723661653d2fdab12a0d5d7e841.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\ = "ClientInstaller Class"	4c6265723661653d2fdab12a0d5d7e841.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\ToolboxBitmap32\ = "C:\\Windows\\Downloaded Program Files\\ClientAX.dll, 101"	4c6265723661653d2fdab12a0d5d7e841.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\MiscStatus\ = "0"	4c6265723661653d2fdab12a0d5d7e841.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}	4c6265723661653d2fdab12a0d5d7e841.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}\ProxyStubClsid32	4c6265723661653d2fdab12a0d5d7e841.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}\TypeLib\ = "{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}"	4c6265723661653d2fdab12a0d5d7e841.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}\TypeLib\Version = "1.0"	4c6265723661653d2fdab12a0d5d7e841.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ClientAX.ClientInstaller.1\ = "ClientInstaller Class"	4c6265723661653d2fdab12a0d5d7e841.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ClientAX.ClientInstaller\CurVer	4c6265723661653d2fdab12a0d5d7e841.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\VersionIndependentProgID	4c6265723661653d2fdab12a0d5d7e841.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}\TypeLib	4c6265723661653d2fdab12a0d5d7e841.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	4c6265723661653d2fdab12a0d5d7e841.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}\TypeLib	4c6265723661653d2fdab12a0d5d7e841.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\MiscStatus\1	4c6265723661653d2fdab12a0d5d7e841.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\MiscStatus	4c6265723661653d2fdab12a0d5d7e841.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}\1.0\ = "ClientAX 1.0 Type Library"	4c6265723661653d2fdab12a0d5d7e841.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}\TypeLib\ = "{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}"	4c6265723661653d2fdab12a0d5d7e841.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}\ = "IClientInstaller2"	4c6265723661653d2fdab12a0d5d7e841.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ClientAX.ClientInstaller.1\CLSID	4c6265723661653d2fdab12a0d5d7e841.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ClientAX.ClientInstaller.1\CLSID\ = "{99410CDE-6F16-42ce-9D49-3807F78F0287}"	4c6265723661653d2fdab12a0d5d7e841.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\VersionIndependentProgID	4c6265723661653d2fdab12a0d5d7e841.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}\ = "IClientInstaller"	4c6265723661653d2fdab12a0d5d7e841.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}\ProxyStubClsid32	4c6265723661653d2fdab12a0d5d7e841.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}\TypeLib\Version = "1.0"	4c6265723661653d2fdab12a0d5d7e841.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}	4c6265723661653d2fdab12a0d5d7e841.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\Control	4c6265723661653d2fdab12a0d5d7e841.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\Version	4c6265723661653d2fdab12a0d5d7e841.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}\1.0	4c6265723661653d2fdab12a0d5d7e841.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\TypeLib	4c6265723661653d2fdab12a0d5d7e841.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\Control	4c6265723661653d2fdab12a0d5d7e841.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}	4c6265723661653d2fdab12a0d5d7e841.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}\ProxyStubClsid32	4c6265723661653d2fdab12a0d5d7e841.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ClientAX.ClientInstaller\CLSID\ = "{99410CDE-6F16-42ce-9D49-3807F78F0287}"	4c6265723661653d2fdab12a0d5d7e841.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ClientAX.ClientInstaller\CurVer\ = "ClientAX.ClientInstaller.1"	4c6265723661653d2fdab12a0d5d7e841.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\MiscStatus\1\ = "132497"	4c6265723661653d2fdab12a0d5d7e841.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}\1.0\FLAGS\ = "0"	4c6265723661653d2fdab12a0d5d7e841.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}\TypeLib	4c6265723661653d2fdab12a0d5d7e841.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ClientAX.ClientInstaller\ = "ClientInstaller Class"	4c6265723661653d2fdab12a0d5d7e841.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}	4c6265723661653d2fdab12a0d5d7e841.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\ProgID\ = "ClientAX.ClientInstaller.1"	4c6265723661653d2fdab12a0d5d7e841.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\ToolboxBitmap32	4c6265723661653d2fdab12a0d5d7e841.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\MiscStatus\1	4c6265723661653d2fdab12a0d5d7e841.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}\1.0\0\win32\ = "C:\\Windows\\Downloaded Program Files\\ClientAX.dll"	4c6265723661653d2fdab12a0d5d7e841.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}	4c6265723661653d2fdab12a0d5d7e841.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	4c6265723661653d2fdab12a0d5d7e841.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\InprocServer32\ThreadingModel = "Apartment"	4c6265723661653d2fdab12a0d5d7e841.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\Version	4c6265723661653d2fdab12a0d5d7e841.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}\ = "IClientInstaller2"	4c6265723661653d2fdab12a0d5d7e841.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\InprocServer32	4c6265723661653d2fdab12a0d5d7e841.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}\1.0\0	4c6265723661653d2fdab12a0d5d7e841.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4876	zango.exe
4876	zango.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4876	zango.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
4876	zango.exe
4876	zango.exe
4876	zango.exe
4876	zango.exe
4876	zango.exe
4876	zango.exe
4876	zango.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4876	zango.exe
4876	zango.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 4876	3412	4c6265723661653d2fdab12a0d5d7e841.exe	88
PID 3412 wrote to memory of 4876	3412	4c6265723661653d2fdab12a0d5d7e841.exe	88
PID 3412 wrote to memory of 4876	3412	4c6265723661653d2fdab12a0d5d7e841.exe	88

C:\Users\Admin\AppData\Local\Temp\uploaded\4c6265723661653d2fdab12a0d5d7e841.exe
"C:\Users\Admin\AppData\Local\Temp\uploaded\4c6265723661653d2fdab12a0d5d7e841.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Program Files\zango\zango.exe
  "C:\Program Files\zango\zango.exe" /did=001758
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4876

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c c:\program files\zango\zango.exe
1⤵
PID:4928

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

zango.exe

Path C:\Program Files\zango\zango.exe
Size 290KB
SHA256 b81b066c4f790d039c10d843a4c1b84326af6c75e12cef0b6acedf425458b690
MD5 97e0b4549717055cda481f31577c6aad
SHA1 f6fa15cecb70383c221f14bc7243c3de38a38609
SHA512 18ff5f6ca76c8e20ff202a2df6daf78a896494ae0cfd1c8543d1329387e65094cc23bd28b66ec04b064a2d83edcb8b308d87a8766eba0c23216b2cac544df1af
SSDEEP 6144:BvVKFzTtXMiL3tSBQgh21F0jNJcZ6J8mn99jK:BvYFxMiL3MqggiHcYJ8Gje
MD5 SHA1 SHA512 SSDEEP

Submit Download

ClientAX.dll

Path C:\Users\Admin\AppData\Local\Temp\ClientAX.dll
Size 408KB
SHA256 86eae33ca5d35efbf403f028da60f426a2ce651ebcbea9bf7c76e1eb61bf8388
MD5 a1c77aaa60ea5acf080f90f4c89aa8a1
SHA1 d96931b0a7a8e1a798c6e099ee6b5bb00ec558ea
SHA512 e78096d4fe24541c922fb2f44577ff3175a804760b6f661adf54628a9d3eda4440eac42008fdd35c7bae6f8277f2bf71df50764e9398464ad42978757db28175
SSDEEP 6144:SCJaKQ/qgCUvVKFzTtXMiL3tSBQgh21F0jNJcZ6J8mn99jio/r:SCJ7QyivYFxMiL3MqggiHcYJ8Gjeo/r
MD5 SHA1 SHA512 SSDEEP

Submit Download

ClientAX.dll

Path C:\Windows\Downloaded Program Files\ClientAX.dll
Size 408KB
SHA256 7b67eeb5492fff1f8a15eb184df899d8022aaef0e1c201622e9ec710608c38fc
MD5 917d27f02f6bfd32cd28f2654a0eecd7
SHA1 83a8bfeefeb669c253b5ab8db02e89ee825bbc8a
SHA512 b3c0ea7164bfa8d592bf3bb026b4a5df12d6484528d282a719cf18c71f8af7d89c95abec0cacb160f7f7043f8b19709f974b0334e066d70a734ac4cc08bab389
SSDEEP 6144:SCJaKQ/qgCIvVKFzTtXMiL3tSBQgh21F0jNJcZ6J8mn99jio/r:SCJ7QyevYFxMiL3MqggiHcYJ8Gjeo/r
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZangoAX.cab

Path C:\Windows\Downloaded Program Files\ZangoAX.cab
Size 335KB
SHA256 2d89c6d2b05cd1264f377163d9f1ca88c273e738c23fbadcc22a8f11781f0476
MD5 c8453e07793a1e7a1180300d039cc878
SHA1 f5726e4ca1e6964443104cd13c47b0c660fbeb85
SHA512 f711fb2ca0c46553f06e088627e98f941967439ef5c6c3f139b1207b95f874fb04b4a75f6ffb62728dd1f52bf41a604e681d4fa1c6f9904d97e2a699f26c927c
SSDEEP 6144:DUp1/beiZbUXN0kCLbW4hQ1MpjIS4ixeI0xCQDsKX2t9sErOrLkH98NScBg:gZbUXN0kCD9pZ4QQxCQDrX2t9xqkHE7m
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4876-50-0x0000000000400000-0x0000000000495000-memory.dmp

Download

memory/4876-52-0x0000000000400000-0x0000000000495000-memory.dmp

Download

memory/4876-53-0x0000000000400000-0x0000000000495000-memory.dmp

Download