bd5ee1f6ebe18c36a0168c43f459f54fd133d35244b269e4ecef5bd2a484c72b

Resubmissions

02/06/2025, 23:08

250602-24hx3aek6z

02/06/2025, 22:44

250602-2pacdabk2110

Analysis

max time kernel
148s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20250502-en
resource tags

arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2025, 22:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
uploaded/70e835f3140dc2fbc211273727a8a8b4d.exe
Size 489KB
Sample250602-2pacdabk21
SHA256 aae4696fa35c74a7aa3e9b75ae37d4ffa9a81f64bf647c801252f3abb29c21d8
MD5 68975d70f5c844bc1fd923813d42b31b
SHA1 3d07569e46b8e026b608fa5c5e4186abf58bf02e
SHA512 4d475614543df97037f327a3ca5faa10396eff193729ecd1da87dc66f0d2386e720d55095c9df92116d9206832db424680e95d9fad02bcdca0cd31aa91ea422c
SSDEEP 12288:wrxZ//3SfgfZCgOAZw+i+vwnPWybFxJ8fk0:wtZ/VCgOAnAb+F
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2820	zango.exe

Loads dropped DLL 2 IoCs

pid	Process
2576	70e835f3140dc2fbc211273727a8a8b4d.exe
2576	70e835f3140dc2fbc211273727a8a8b4d.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\zango = "c:\\program files (x86)\\zango\\zango.exe"	zango.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\n:	zango.exe
File opened (read-only)	\??\o:	zango.exe
File opened (read-only)	\??\r:	zango.exe
File opened (read-only)	\??\s:	zango.exe
File opened (read-only)	\??\t:	zango.exe
File opened (read-only)	\??\u:	zango.exe
File opened (read-only)	\??\w:	zango.exe
File opened (read-only)	\??\g:	zango.exe
File opened (read-only)	\??\i:	zango.exe
File opened (read-only)	\??\m:	zango.exe
File opened (read-only)	\??\v:	zango.exe
File opened (read-only)	\??\y:	zango.exe
File opened (read-only)	\??\z:	zango.exe
File opened (read-only)	\??\h:	zango.exe
File opened (read-only)	\??\j:	zango.exe
File opened (read-only)	\??\l:	zango.exe
File opened (read-only)	\??\p:	zango.exe
File opened (read-only)	\??\q:	zango.exe
File opened (read-only)	\??\x:	zango.exe
File opened (read-only)	\??\e:	zango.exe
File opened (read-only)	\??\k:	zango.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral24/memory/2820-39-0x0000000000400000-0x0000000000545000-memory.dmp	upx
behavioral24/files/0x000700000002426c-38.dat	upx
behavioral24/memory/2820-61-0x0000000000400000-0x0000000000545000-memory.dmp	upx
behavioral24/memory/2820-62-0x0000000000400000-0x0000000000545000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Zango\zango.exe	70e835f3140dc2fbc211273727a8a8b4d.exe
File created	C:\Program Files (x86)\Zango\zango.exe	70e835f3140dc2fbc211273727a8a8b4d.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Downloaded Program Files\clientax.inf	70e835f3140dc2fbc211273727a8a8b4d.exe
File created	C:\Windows\Downloaded Program Files\clientax.dll	70e835f3140dc2fbc211273727a8a8b4d.exe
File opened for modification	C:\Windows\Downloaded Program Files\RCXD3AD.tmp	70e835f3140dc2fbc211273727a8a8b4d.exe
File created	C:\Windows\Downloaded Program Files\clientax.inf	70e835f3140dc2fbc211273727a8a8b4d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	70e835f3140dc2fbc211273727a8a8b4d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zango.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AC49246-419B-4EE0-8917-8818DAAD6A4E}\Control	70e835f3140dc2fbc211273727a8a8b4d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AC49246-419B-4EE0-8917-8818DAAD6A4E}\MiscStatus\1\ = "132497"	70e835f3140dc2fbc211273727a8a8b4d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}	70e835f3140dc2fbc211273727a8a8b4d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\Control	70e835f3140dc2fbc211273727a8a8b4d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}\TypeLib\Version = "1.0"	70e835f3140dc2fbc211273727a8a8b4d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ClientAX.ClientInstaller.1\CLSID	70e835f3140dc2fbc211273727a8a8b4d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ClientAX.RequiredComponent\CurVer\ = "ClientAX.RequiredComponent.1"	70e835f3140dc2fbc211273727a8a8b4d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	70e835f3140dc2fbc211273727a8a8b4d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1F1E775-1B21-454D-8D38-7C16519969E5}\TypeLib\ = "{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}"	70e835f3140dc2fbc211273727a8a8b4d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ClientAX.ClientInstaller\CLSID\ = "{99410CDE-6F16-42ce-9D49-3807F78F0287}"	70e835f3140dc2fbc211273727a8a8b4d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ClientAX.ClientInstaller\CurVer\ = "ClientAX.ClientInstaller.1"	70e835f3140dc2fbc211273727a8a8b4d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ClientAX.RequiredComponent\CurVer	70e835f3140dc2fbc211273727a8a8b4d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AC49246-419B-4EE0-8917-8818DAAD6A4E}\ProgID	70e835f3140dc2fbc211273727a8a8b4d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}	70e835f3140dc2fbc211273727a8a8b4d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}	70e835f3140dc2fbc211273727a8a8b4d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	70e835f3140dc2fbc211273727a8a8b4d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}\TypeLib	70e835f3140dc2fbc211273727a8a8b4d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\InprocServer32	70e835f3140dc2fbc211273727a8a8b4d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ClientAX.RequiredComponent\CLSID\ = "{0AC49246-419B-4EE0-8917-8818DAAD6A4E}"	70e835f3140dc2fbc211273727a8a8b4d.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\ToolboxBitmap32	70e835f3140dc2fbc211273727a8a8b4d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}\ = "IClientInstaller2"	70e835f3140dc2fbc211273727a8a8b4d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1F1E775-1B21-454D-8D38-7C16519969E5}	70e835f3140dc2fbc211273727a8a8b4d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1F1E775-1B21-454D-8D38-7C16519969E5}\TypeLib	70e835f3140dc2fbc211273727a8a8b4d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1F1E775-1B21-454D-8D38-7C16519969E5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	70e835f3140dc2fbc211273727a8a8b4d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ClientAX.ClientInstaller.1\ = "ClientInstaller Class"	70e835f3140dc2fbc211273727a8a8b4d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ClientAX.RequiredComponent.1\CLSID\ = "{0AC49246-419B-4EE0-8917-8818DAAD6A4E}"	70e835f3140dc2fbc211273727a8a8b4d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}\ = "IClientInstaller"	70e835f3140dc2fbc211273727a8a8b4d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}\TypeLib\ = "{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}"	70e835f3140dc2fbc211273727a8a8b4d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1F1E775-1B21-454D-8D38-7C16519969E5}\ = "IRequiredComponent"	70e835f3140dc2fbc211273727a8a8b4d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1F1E775-1B21-454D-8D38-7C16519969E5}\TypeLib	70e835f3140dc2fbc211273727a8a8b4d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1F1E775-1B21-454D-8D38-7C16519969E5}\TypeLib\ = "{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}"	70e835f3140dc2fbc211273727a8a8b4d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ClientAX.RequiredComponent	70e835f3140dc2fbc211273727a8a8b4d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AC49246-419B-4EE0-8917-8818DAAD6A4E}\TypeLib	70e835f3140dc2fbc211273727a8a8b4d.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\Control	70e835f3140dc2fbc211273727a8a8b4d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}\TypeLib	70e835f3140dc2fbc211273727a8a8b4d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}\TypeLib\ = "{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}"	70e835f3140dc2fbc211273727a8a8b4d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\ToolboxBitmap32\ = "C:\\Windows\\Downloaded Program Files\\ClientAX.dll, 101"	70e835f3140dc2fbc211273727a8a8b4d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AC49246-419B-4EE0-8917-8818DAAD6A4E}\Programmable	70e835f3140dc2fbc211273727a8a8b4d.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\ProgID	70e835f3140dc2fbc211273727a8a8b4d.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}	70e835f3140dc2fbc211273727a8a8b4d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1F1E775-1B21-454D-8D38-7C16519969E5}\TypeLib\Version = "1.0"	70e835f3140dc2fbc211273727a8a8b4d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\MiscStatus	70e835f3140dc2fbc211273727a8a8b4d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\MiscStatus\1	70e835f3140dc2fbc211273727a8a8b4d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ClientAX.RequiredComponent.1\ = "RequiredComponent Class"	70e835f3140dc2fbc211273727a8a8b4d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AC49246-419B-4EE0-8917-8818DAAD6A4E}\VersionIndependentProgID	70e835f3140dc2fbc211273727a8a8b4d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AC49246-419B-4EE0-8917-8818DAAD6A4E}\Version	70e835f3140dc2fbc211273727a8a8b4d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}\1.0\0\win32\ = "C:\\Windows\\Downloaded Program Files\\ClientAX.dll"	70e835f3140dc2fbc211273727a8a8b4d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\Programmable	70e835f3140dc2fbc211273727a8a8b4d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ClientAX.RequiredComponent.1	70e835f3140dc2fbc211273727a8a8b4d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}\1.0\FLAGS	70e835f3140dc2fbc211273727a8a8b4d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	70e835f3140dc2fbc211273727a8a8b4d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\MiscStatus\1\ = "132497"	70e835f3140dc2fbc211273727a8a8b4d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}\ProxyStubClsid32	70e835f3140dc2fbc211273727a8a8b4d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\ProgID\ = "ClientAX.ClientInstaller.1"	70e835f3140dc2fbc211273727a8a8b4d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\InprocServer32\ = "C:\\Windows\\Downloaded Program Files\\ClientAX.dll"	70e835f3140dc2fbc211273727a8a8b4d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\ToolboxBitmap32	70e835f3140dc2fbc211273727a8a8b4d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}\ = "IClientInstaller"	70e835f3140dc2fbc211273727a8a8b4d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1F1E775-1B21-454D-8D38-7C16519969E5}\TypeLib\Version = "1.0"	70e835f3140dc2fbc211273727a8a8b4d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\Version	70e835f3140dc2fbc211273727a8a8b4d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ClientAX.RequiredComponent\CLSID	70e835f3140dc2fbc211273727a8a8b4d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AC49246-419B-4EE0-8917-8818DAAD6A4E}\ToolboxBitmap32\ = "C:\\Windows\\Downloaded Program Files\\ClientAX.dll, 101"	70e835f3140dc2fbc211273727a8a8b4d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}\TypeLib\Version = "1.0"	70e835f3140dc2fbc211273727a8a8b4d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}\TypeLib\Version = "1.0"	70e835f3140dc2fbc211273727a8a8b4d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AC49246-419B-4EE0-8917-8818DAAD6A4E}\MiscStatus\1	70e835f3140dc2fbc211273727a8a8b4d.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2576	70e835f3140dc2fbc211273727a8a8b4d.exe
2576	70e835f3140dc2fbc211273727a8a8b4d.exe
2576	70e835f3140dc2fbc211273727a8a8b4d.exe
2576	70e835f3140dc2fbc211273727a8a8b4d.exe
2576	70e835f3140dc2fbc211273727a8a8b4d.exe
2576	70e835f3140dc2fbc211273727a8a8b4d.exe
2576	70e835f3140dc2fbc211273727a8a8b4d.exe
2576	70e835f3140dc2fbc211273727a8a8b4d.exe
2576	70e835f3140dc2fbc211273727a8a8b4d.exe
2576	70e835f3140dc2fbc211273727a8a8b4d.exe
2576	70e835f3140dc2fbc211273727a8a8b4d.exe
2576	70e835f3140dc2fbc211273727a8a8b4d.exe
2820	zango.exe
2820	zango.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2820	zango.exe
2820	zango.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 2820	2576	70e835f3140dc2fbc211273727a8a8b4d.exe	91
PID 2576 wrote to memory of 2820	2576	70e835f3140dc2fbc211273727a8a8b4d.exe	91
PID 2576 wrote to memory of 2820	2576	70e835f3140dc2fbc211273727a8a8b4d.exe	91

C:\Users\Admin\AppData\Local\Temp\uploaded\70e835f3140dc2fbc211273727a8a8b4d.exe
"C:\Users\Admin\AppData\Local\Temp\uploaded\70e835f3140dc2fbc211273727a8a8b4d.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Program Files (x86)\Zango\zango.exe
  C:\Program Files (x86)\Zango\zango.exe /did=004144 /DID=004144 /bpu=y
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2820

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c c:\program files (x86)\zango\zango.exe
1⤵
PID:1600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

zango.exe

Path C:\Program Files (x86)\Zango\zango.exe
Size 606KB
SHA256 fc5699ac65bd88ec11eb5fc79890fbcd7d952e93f38ef94f1848ba38dd8b216f
MD5 3fc783e8c587891e6977f4e36a1f511a
SHA1 23e85d4dd1d087cfb7bc8ad82a4042f2744b8b62
SHA512 940801e6f6720cd131cf74bfaec9510b3b2304718250ebe685fc280f9490fba65f42c1a7c4545e0b7d1b01d9bed0c76d689137fa77083bf97eeb56915b20f1ae
SSDEEP 6144:NOBxG2oS4CYFSUF5k1fB8dX+/3zZB4R82E0HV6JLJ6PgG9EF06LCR3B9kPmgV6J7:2GrM1L/3zQOP6JeeRr6m
MD5 SHA1 SHA512 SSDEEP

Submit Download

180E8CA.mht

Path C:\Users\Admin\AppData\Local\Temp\180E8CA.mht
Size 7KB
SHA256 e0357ae70c1f8b6365bbaa20adfeabd63fa5cd0673e4c9ec71e26e03e00381e7
MD5 511ba54f162172b179c994d638ba4257
SHA1 078a6cb57ed6a0a93b86a2fe6a073ac57c9e5291
SHA512 8cbc5bfda0179b0c47a18bdad136d28da801e6671506120c35a487708293780a00f924e154eeaf45cc444b3c5d3a8391c506da8897ad741003a9a5df7df099f5
SSDEEP 192:nY+wYXj+b1ozIzqSkYxt1eSTkBl99Vv846:nY+w2ju1fzqSkuISTq9/v846
MD5 SHA1 SHA512 SSDEEP

Submit Download

clientax.dll

Path C:\Users\Admin\AppData\Local\Temp\clientax.dll
Size 796KB
SHA256 bbd4ac5549635ec0870f0d068d865e4dab893bbf4cc57301403d0c24966f9c1b
MD5 e96ca570a4b896f1ff3772f44b23a496
SHA1 79632754cd75f0bc7e988c3a3dcd41581067dbb5
SHA512 3269addf73197235d2984179e1ae934a5fffc63272bdee6a3f357074ec9596d679cbf6f096bc996a79210538bd1a8aefe438d389353975d32be0ca8a2104adb0
SSDEEP 6144:+gQGiG3fE86wppcRYaZqBP/HOBxG2oS4CYFSUF5k1fB8dX+/3zZB4R82E0HV6JLf:SGicfPpGZqmGrM1L/3zQOP6JeeRr6m
MD5 SHA1 SHA512 SSDEEP

Submit Download

360e9316558dc5fc61c74119e7e1abb7_19c0db82-0fb5-4d49-b9d4-7acccba1985f

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3623617754-4043701611-775564599-1000\360e9316558dc5fc61c74119e7e1abb7_19c0db82-0fb5-4d49-b9d4-7acccba1985f
Size 68B
SHA256 0324e28fabee037dd3a0b41147a30242b7c8c06d6c39e7d6fc20e342c93c4a5e
MD5 4766fe2c5783d803c530c88f176ebf97
SHA1 3bde73ea83344c3a3db336fb2f274e429c76acac
SHA512 880484e131d5cc669b4469a2df9737bbec9746b6862122b66cf71a4e4d9281fbe105fa73b085980fa52f2819cd10ef65cb8a03f980d2e9ec0e5dafd63c595400
MD5 SHA1 SHA512

Submit Download

ClientAX.dll

Path C:\Windows\Downloaded Program Files\ClientAX.dll
Size 796KB
SHA256 b5feb6da59e6b56e666d6bbd591078f19e3391bc3311687bb8a0415d017fa263
MD5 93e6553c879e0495809bc878145c493c
SHA1 9e5d01b52cf2f345a2dd3912855d561be378a5a8
SHA512 2abce7289b728182604772f5bb2cd4e47a15d9160c7ded9b4d6a6be251992b2b1cf2175d56707751275c3cc0c4018e5e66107c6bfd7edc67adc6a5c4ea4a301d
SSDEEP 6144:+gQGiG3fE86wppcRYaZqBP/VOBxG2oS4CYFSUF5k1fB8dX+/3zZB4R82E0HV6JLf:SGicfPpGZqkGrM1L/3zQOP6JeeRr6m
MD5 SHA1 SHA512 SSDEEP

Submit Download

clientax.inf

Path C:\Windows\Downloaded Program Files\clientax.inf
Size 229B
SHA256 b8b93f706f83f93fcda3a8c24a8092f733128b3a5d3d08d4689e53590f3b485b
MD5 cee09b7981687b1afc51cca79b2ed811
SHA1 6432d2314f25c8ff12105b6fec94d1351fd233b9
SHA512 2dd403c90fad4c83240ccbe33e067c1ad9b3efc533a22d060f548aa124885a21144cd3b2f3752a0c915c27e1a0c0f5d8bcea3ed862d244dcce64d50ba993b84e
MD5 SHA1 SHA512

Submit Download

memory/2820-39-0x0000000000400000-0x0000000000545000-memory.dmp

Download

memory/2820-61-0x0000000000400000-0x0000000000545000-memory.dmp

Download

memory/2820-62-0x0000000000400000-0x0000000000545000-memory.dmp

Download