bd5ee1f6ebe18c36a0168c43f459f54fd133d35244b269e4ecef5bd2a484c72b

Resubmissions

02/06/2025, 23:08

250602-24hx3aek6z

02/06/2025, 22:44

250602-2pacdabk2110

Analysis

max time kernel
145s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20250502-en
resource tags

arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2025, 22:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
uploaded/0f0d2abea57c5403fb538eef2e42d5003.exe
Size 409KB
Sample250602-2pacdabk21
SHA256 f7f8ca0ae4af42baa3586561ce73cea45445e439eec867091704a696de334e96
MD5 3d6531f8f4eb1b41f62e8a55f033735f
SHA1 aa250187efbbb4254d14949d862b41c6125b452c
SHA512 505bb32692f7e65106dc55eb8fdb9eb0b4b095d1fbc6b3c33d496fbd9f540e7c05c0f42df3401c7d1933f0f48fb51844e61c5b6bdbf29a2d2ff273366076a121
SSDEEP 12288:P//ZbUXN0kCD9pZ4QQxCQDrX2t9xqkHE7J:P3Zbm0BZvQxCgrXS9f6
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery persistence upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-186956858-2143653872-2609589082-1000\Control Panel\International\Geo\Nation	0f0d2abea57c5403fb538eef2e42d5003.exe

Executes dropped EXE 1 IoCs

pid	Process
3996	zango.exe

Loads dropped DLL 2 IoCs

pid	Process
760	0f0d2abea57c5403fb538eef2e42d5003.exe
760	0f0d2abea57c5403fb538eef2e42d5003.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\zango = "c:\\program files\\zango\\zango.exe"	zango.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	zango.exe
File opened (read-only)	\??\j:	zango.exe
File opened (read-only)	\??\n:	zango.exe
File opened (read-only)	\??\t:	zango.exe
File opened (read-only)	\??\u:	zango.exe
File opened (read-only)	\??\g:	zango.exe
File opened (read-only)	\??\i:	zango.exe
File opened (read-only)	\??\k:	zango.exe
File opened (read-only)	\??\o:	zango.exe
File opened (read-only)	\??\v:	zango.exe
File opened (read-only)	\??\h:	zango.exe
File opened (read-only)	\??\l:	zango.exe
File opened (read-only)	\??\p:	zango.exe
File opened (read-only)	\??\q:	zango.exe
File opened (read-only)	\??\y:	zango.exe
File opened (read-only)	\??\z:	zango.exe
File opened (read-only)	\??\m:	zango.exe
File opened (read-only)	\??\r:	zango.exe
File opened (read-only)	\??\s:	zango.exe
File opened (read-only)	\??\w:	zango.exe
File opened (read-only)	\??\x:	zango.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000700000002429f-38.dat	upx
behavioral2/memory/3996-49-0x0000000000400000-0x0000000000495000-memory.dmp	upx
behavioral2/memory/3996-51-0x0000000000400000-0x0000000000495000-memory.dmp	upx
behavioral2/memory/3996-52-0x0000000000400000-0x0000000000495000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\zango\zango.exe	0f0d2abea57c5403fb538eef2e42d5003.exe
File created	C:\Program Files\zango\zango.exe	0f0d2abea57c5403fb538eef2e42d5003.exe
File opened for modification	\??\c:\program files\zango\zango.log	zango.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Downloaded Program Files\ClientAX.dll	0f0d2abea57c5403fb538eef2e42d5003.exe
File opened for modification	C:\Windows\Downloaded Program Files\RCXE7A2.tmp	0f0d2abea57c5403fb538eef2e42d5003.exe
File opened for modification	C:\Windows\Downloaded Program Files\ZangoAX.cab	0f0d2abea57c5403fb538eef2e42d5003.exe
File created	C:\Windows\Downloaded Program Files\ZangoAX.cab	0f0d2abea57c5403fb538eef2e42d5003.exe
File created	C:\Windows\Downloaded Program Files\ClientAX.inf	0f0d2abea57c5403fb538eef2e42d5003.exe
File opened for modification	C:\Windows\Downloaded Program Files\ClientAX.inf	0f0d2abea57c5403fb538eef2e42d5003.exe
File created	C:\Windows\Downloaded Program Files\ClientAX.dll	0f0d2abea57c5403fb538eef2e42d5003.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0f0d2abea57c5403fb538eef2e42d5003.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zango.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}\1.0\HELPDIR	0f0d2abea57c5403fb538eef2e42d5003.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}\1.0\HELPDIR\ = "C:\\Windows\\Downloaded Program Files\\"	0f0d2abea57c5403fb538eef2e42d5003.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}\TypeLib\ = "{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}"	0f0d2abea57c5403fb538eef2e42d5003.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}\ = "IClientInstaller"	0f0d2abea57c5403fb538eef2e42d5003.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ClientAX.ClientInstaller	0f0d2abea57c5403fb538eef2e42d5003.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\InprocServer32	0f0d2abea57c5403fb538eef2e42d5003.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}\ProxyStubClsid32	0f0d2abea57c5403fb538eef2e42d5003.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}\ProxyStubClsid32	0f0d2abea57c5403fb538eef2e42d5003.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ClientAX.ClientInstaller\CLSID\ = "{99410CDE-6F16-42ce-9D49-3807F78F0287}"	0f0d2abea57c5403fb538eef2e42d5003.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\ToolboxBitmap32\ = "C:\\Windows\\Downloaded Program Files\\ClientAX.dll, 101"	0f0d2abea57c5403fb538eef2e42d5003.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\TypeLib\ = "{5B6689B5-C2D4-4dc7-BFD1-24AC17E5FCDA}"	0f0d2abea57c5403fb538eef2e42d5003.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\MiscStatus\1	0f0d2abea57c5403fb538eef2e42d5003.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\MiscStatus	0f0d2abea57c5403fb538eef2e42d5003.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}\1.0	0f0d2abea57c5403fb538eef2e42d5003.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}\ = "IClientInstaller"	0f0d2abea57c5403fb538eef2e42d5003.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}\TypeLib	0f0d2abea57c5403fb538eef2e42d5003.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ClientAX.ClientInstaller.1	0f0d2abea57c5403fb538eef2e42d5003.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ClientAX.ClientInstaller.1\CLSID	0f0d2abea57c5403fb538eef2e42d5003.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\MiscStatus	0f0d2abea57c5403fb538eef2e42d5003.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}\1.0\0\win32	0f0d2abea57c5403fb538eef2e42d5003.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ClientAX.ClientInstaller\ = "ClientInstaller Class"	0f0d2abea57c5403fb538eef2e42d5003.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ClientAX.ClientInstaller\CurVer\ = "ClientAX.ClientInstaller.1"	0f0d2abea57c5403fb538eef2e42d5003.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\ProgID	0f0d2abea57c5403fb538eef2e42d5003.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\VersionIndependentProgID	0f0d2abea57c5403fb538eef2e42d5003.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\ProgID	0f0d2abea57c5403fb538eef2e42d5003.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\Control	0f0d2abea57c5403fb538eef2e42d5003.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\Programmable	0f0d2abea57c5403fb538eef2e42d5003.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}\1.0\0	0f0d2abea57c5403fb538eef2e42d5003.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}	0f0d2abea57c5403fb538eef2e42d5003.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}\TypeLib\ = "{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}"	0f0d2abea57c5403fb538eef2e42d5003.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	0f0d2abea57c5403fb538eef2e42d5003.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ClientAX.ClientInstaller.1\CLSID\ = "{99410CDE-6F16-42ce-9D49-3807F78F0287}"	0f0d2abea57c5403fb538eef2e42d5003.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ClientAX.ClientInstaller\CurVer	0f0d2abea57c5403fb538eef2e42d5003.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}\TypeLib\ = "{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}"	0f0d2abea57c5403fb538eef2e42d5003.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ClientAX.ClientInstaller.1\ = "ClientInstaller Class"	0f0d2abea57c5403fb538eef2e42d5003.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}	0f0d2abea57c5403fb538eef2e42d5003.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}\1.0\FLAGS	0f0d2abea57c5403fb538eef2e42d5003.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}	0f0d2abea57c5403fb538eef2e42d5003.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}\ = "IClientInstaller2"	0f0d2abea57c5403fb538eef2e42d5003.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\ProgID\ = "ClientAX.ClientInstaller.1"	0f0d2abea57c5403fb538eef2e42d5003.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}	0f0d2abea57c5403fb538eef2e42d5003.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}\1.0\ = "ClientAX 1.0 Type Library"	0f0d2abea57c5403fb538eef2e42d5003.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	0f0d2abea57c5403fb538eef2e42d5003.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}\TypeLib\Version = "1.0"	0f0d2abea57c5403fb538eef2e42d5003.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}\TypeLib\Version = "1.0"	0f0d2abea57c5403fb538eef2e42d5003.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\Version	0f0d2abea57c5403fb538eef2e42d5003.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\TypeLib	0f0d2abea57c5403fb538eef2e42d5003.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\Version	0f0d2abea57c5403fb538eef2e42d5003.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\VersionIndependentProgID	0f0d2abea57c5403fb538eef2e42d5003.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}	0f0d2abea57c5403fb538eef2e42d5003.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}\ProxyStubClsid32	0f0d2abea57c5403fb538eef2e42d5003.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\VersionIndependentProgID\ = "ClientAX.ClientInstaller"	0f0d2abea57c5403fb538eef2e42d5003.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}\1.0\FLAGS\ = "0"	0f0d2abea57c5403fb538eef2e42d5003.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}\TypeLib\ = "{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}"	0f0d2abea57c5403fb538eef2e42d5003.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	0f0d2abea57c5403fb538eef2e42d5003.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\MiscStatus\1\ = "132497"	0f0d2abea57c5403fb538eef2e42d5003.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\Control	0f0d2abea57c5403fb538eef2e42d5003.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\ToolboxBitmap32	0f0d2abea57c5403fb538eef2e42d5003.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}\TypeLib\Version = "1.0"	0f0d2abea57c5403fb538eef2e42d5003.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}\ProxyStubClsid32	0f0d2abea57c5403fb538eef2e42d5003.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	0f0d2abea57c5403fb538eef2e42d5003.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}\TypeLib	0f0d2abea57c5403fb538eef2e42d5003.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\Programmable	0f0d2abea57c5403fb538eef2e42d5003.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\InprocServer32\ = "C:\\Windows\\Downloaded Program Files\\ClientAX.dll"	0f0d2abea57c5403fb538eef2e42d5003.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3996	zango.exe
3996	zango.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3996	zango.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
3996	zango.exe
3996	zango.exe
3996	zango.exe
3996	zango.exe
3996	zango.exe
3996	zango.exe
3996	zango.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3996	zango.exe
3996	zango.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 760 wrote to memory of 3996	760	0f0d2abea57c5403fb538eef2e42d5003.exe	89
PID 760 wrote to memory of 3996	760	0f0d2abea57c5403fb538eef2e42d5003.exe	89
PID 760 wrote to memory of 3996	760	0f0d2abea57c5403fb538eef2e42d5003.exe	89

C:\Users\Admin\AppData\Local\Temp\uploaded\0f0d2abea57c5403fb538eef2e42d5003.exe
"C:\Users\Admin\AppData\Local\Temp\uploaded\0f0d2abea57c5403fb538eef2e42d5003.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:760
- C:\Program Files\zango\zango.exe
  "C:\Program Files\zango\zango.exe" /did=004210
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3996

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c c:\program files\zango\zango.exe
1⤵
PID:1324

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

zango.exe

Path C:\Program Files\zango\zango.exe
Size 290KB
SHA256 b81b066c4f790d039c10d843a4c1b84326af6c75e12cef0b6acedf425458b690
MD5 97e0b4549717055cda481f31577c6aad
SHA1 f6fa15cecb70383c221f14bc7243c3de38a38609
SHA512 18ff5f6ca76c8e20ff202a2df6daf78a896494ae0cfd1c8543d1329387e65094cc23bd28b66ec04b064a2d83edcb8b308d87a8766eba0c23216b2cac544df1af
SSDEEP 6144:BvVKFzTtXMiL3tSBQgh21F0jNJcZ6J8mn99jK:BvYFxMiL3MqggiHcYJ8Gje
MD5 SHA1 SHA512 SSDEEP

Submit Download

ClientAX.dll

Path C:\Users\Admin\AppData\Local\Temp\ClientAX.dll
Size 408KB
SHA256 86eae33ca5d35efbf403f028da60f426a2ce651ebcbea9bf7c76e1eb61bf8388
MD5 a1c77aaa60ea5acf080f90f4c89aa8a1
SHA1 d96931b0a7a8e1a798c6e099ee6b5bb00ec558ea
SHA512 e78096d4fe24541c922fb2f44577ff3175a804760b6f661adf54628a9d3eda4440eac42008fdd35c7bae6f8277f2bf71df50764e9398464ad42978757db28175
SSDEEP 6144:SCJaKQ/qgCUvVKFzTtXMiL3tSBQgh21F0jNJcZ6J8mn99jio/r:SCJ7QyivYFxMiL3MqggiHcYJ8Gjeo/r
MD5 SHA1 SHA512 SSDEEP

Submit Download

ClientAX.dll

Path C:\Windows\Downloaded Program Files\ClientAX.dll
Size 408KB
SHA256 b1499b6fa4bf9e1a202b0d56e32b266b35cefdc9df7e1fee37bb646afdd131f9
MD5 c39b024066f2fefc18eb08dbc5001f84
SHA1 df4c02af3077810b4d1107d0df61f5e5414fd559
SHA512 bb0ff02531e4077cd7e98f7c1636fbbab62ff9b1152ebeaf923c1afd1d2605e3d45a4a6a89ac9e1001db83335d0340da104fe73927dca7e573f11e3318c1578c
SSDEEP 6144:SCJaKQ/qgCUvVKFzTtXMiL3tSBQgh21F0jNJcZ6J8mn99jio/r:SCJ7QyivYFxMiL3MqggiHcYJ8Gjeo/r
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZangoAX.cab

Path C:\Windows\Downloaded Program Files\ZangoAX.cab
Size 335KB
SHA256 2d89c6d2b05cd1264f377163d9f1ca88c273e738c23fbadcc22a8f11781f0476
MD5 c8453e07793a1e7a1180300d039cc878
SHA1 f5726e4ca1e6964443104cd13c47b0c660fbeb85
SHA512 f711fb2ca0c46553f06e088627e98f941967439ef5c6c3f139b1207b95f874fb04b4a75f6ffb62728dd1f52bf41a604e681d4fa1c6f9904d97e2a699f26c927c
SSDEEP 6144:DUp1/beiZbUXN0kCLbW4hQ1MpjIS4ixeI0xCQDsKX2t9sErOrLkH98NScBg:gZbUXN0kCD9pZ4QQxCQDrX2t9xqkHE7m
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3996-49-0x0000000000400000-0x0000000000495000-memory.dmp

Download

memory/3996-51-0x0000000000400000-0x0000000000495000-memory.dmp

Download

memory/3996-52-0x0000000000400000-0x0000000000495000-memory.dmp

Download