bd5ee1f6ebe18c36a0168c43f459f54fd133d35244b269e4ecef5bd2a484c72b

Resubmissions

02/06/2025, 23:08

250602-24hx3aek6z

02/06/2025, 22:44

250602-2pacdabk2110

Analysis

max time kernel
145s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20250502-en
resource tags

arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2025, 22:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
uploaded/882f4c1313d37351d72004caa3ef1aee0.exe
Size 409KB
Sample250602-2pacdabk21
SHA256 c164cd72d5927e12bbfa5946b3f9526e27bfe37b1d57fc595c3eb3e94c40b395
MD5 1b83a6f8956ec912d04e30591e6c0026
SHA1 6e56d558efb40697afb669fd40100cd007deeeec
SHA512 35e70cdadf7d80072b8092c6ea4e66d73e6f4b0d78f9a3079d3efdb40f305c58aa8865d8664698249d3ab1d0be4f3afabf02c9ac84398fa50d4e3aba350de8be
SSDEEP 12288:2//ZbUXN0kCD9pZ4QQxCQDrX2t9xqkHE7/:23Zbm0BZvQxCgrXS9fo
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery persistence upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-343936533-1262634978-1863872812-1000\Control Panel\International\Geo\Nation	882f4c1313d37351d72004caa3ef1aee0.exe

Executes dropped EXE 1 IoCs

pid	Process
3884	zango.exe

Loads dropped DLL 2 IoCs

pid	Process
3244	882f4c1313d37351d72004caa3ef1aee0.exe
3244	882f4c1313d37351d72004caa3ef1aee0.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\zango = "c:\\program files\\zango\\zango.exe"	zango.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\q:	zango.exe
File opened (read-only)	\??\e:	zango.exe
File opened (read-only)	\??\j:	zango.exe
File opened (read-only)	\??\l:	zango.exe
File opened (read-only)	\??\p:	zango.exe
File opened (read-only)	\??\t:	zango.exe
File opened (read-only)	\??\z:	zango.exe
File opened (read-only)	\??\h:	zango.exe
File opened (read-only)	\??\m:	zango.exe
File opened (read-only)	\??\u:	zango.exe
File opened (read-only)	\??\v:	zango.exe
File opened (read-only)	\??\x:	zango.exe
File opened (read-only)	\??\s:	zango.exe
File opened (read-only)	\??\i:	zango.exe
File opened (read-only)	\??\n:	zango.exe
File opened (read-only)	\??\o:	zango.exe
File opened (read-only)	\??\r:	zango.exe
File opened (read-only)	\??\w:	zango.exe
File opened (read-only)	\??\y:	zango.exe
File opened (read-only)	\??\g:	zango.exe
File opened (read-only)	\??\k:	zango.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral26/files/0x0008000000024216-39.dat	upx
behavioral26/memory/3884-50-0x0000000000400000-0x0000000000495000-memory.dmp	upx
behavioral26/memory/3884-51-0x0000000000400000-0x0000000000495000-memory.dmp	upx
behavioral26/memory/3884-52-0x0000000000400000-0x0000000000495000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\zango\zango.exe	882f4c1313d37351d72004caa3ef1aee0.exe
File created	C:\Program Files\zango\zango.exe	882f4c1313d37351d72004caa3ef1aee0.exe
File opened for modification	\??\c:\program files\zango\zango.log	zango.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\Downloaded Program Files\ZangoAX.cab	882f4c1313d37351d72004caa3ef1aee0.exe
File created	C:\Windows\Downloaded Program Files\ClientAX.inf	882f4c1313d37351d72004caa3ef1aee0.exe
File opened for modification	C:\Windows\Downloaded Program Files\ClientAX.inf	882f4c1313d37351d72004caa3ef1aee0.exe
File created	C:\Windows\Downloaded Program Files\ClientAX.dll	882f4c1313d37351d72004caa3ef1aee0.exe
File opened for modification	C:\Windows\Downloaded Program Files\ClientAX.dll	882f4c1313d37351d72004caa3ef1aee0.exe
File opened for modification	C:\Windows\Downloaded Program Files\RCXF32B.tmp	882f4c1313d37351d72004caa3ef1aee0.exe
File opened for modification	C:\Windows\Downloaded Program Files\ZangoAX.cab	882f4c1313d37351d72004caa3ef1aee0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	882f4c1313d37351d72004caa3ef1aee0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zango.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ClientAX.ClientInstaller\CurVer\ = "ClientAX.ClientInstaller.1"	882f4c1313d37351d72004caa3ef1aee0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\ = "ClientInstaller Class"	882f4c1313d37351d72004caa3ef1aee0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\ProgID\ = "ClientAX.ClientInstaller.1"	882f4c1313d37351d72004caa3ef1aee0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\TypeLib\ = "{5B6689B5-C2D4-4dc7-BFD1-24AC17E5FCDA}"	882f4c1313d37351d72004caa3ef1aee0.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\VersionIndependentProgID	882f4c1313d37351d72004caa3ef1aee0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}\1.0\0\win32	882f4c1313d37351d72004caa3ef1aee0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}\TypeLib\Version = "1.0"	882f4c1313d37351d72004caa3ef1aee0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\TypeLib	882f4c1313d37351d72004caa3ef1aee0.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\Version	882f4c1313d37351d72004caa3ef1aee0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}\1.0\HELPDIR	882f4c1313d37351d72004caa3ef1aee0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	882f4c1313d37351d72004caa3ef1aee0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	882f4c1313d37351d72004caa3ef1aee0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}\TypeLib	882f4c1313d37351d72004caa3ef1aee0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ClientAX.ClientInstaller\CurVer	882f4c1313d37351d72004caa3ef1aee0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}\TypeLib\Version = "1.0"	882f4c1313d37351d72004caa3ef1aee0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}	882f4c1313d37351d72004caa3ef1aee0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}\TypeLib\Version = "1.0"	882f4c1313d37351d72004caa3ef1aee0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\Control	882f4c1313d37351d72004caa3ef1aee0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\Programmable	882f4c1313d37351d72004caa3ef1aee0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\InprocServer32	882f4c1313d37351d72004caa3ef1aee0.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\Programmable	882f4c1313d37351d72004caa3ef1aee0.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\ToolboxBitmap32	882f4c1313d37351d72004caa3ef1aee0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}	882f4c1313d37351d72004caa3ef1aee0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ClientAX.ClientInstaller\CLSID	882f4c1313d37351d72004caa3ef1aee0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\MiscStatus\1	882f4c1313d37351d72004caa3ef1aee0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\Version	882f4c1313d37351d72004caa3ef1aee0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}\1.0	882f4c1313d37351d72004caa3ef1aee0.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\InprocServer32	882f4c1313d37351d72004caa3ef1aee0.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\TypeLib	882f4c1313d37351d72004caa3ef1aee0.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}	882f4c1313d37351d72004caa3ef1aee0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}	882f4c1313d37351d72004caa3ef1aee0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}\ProxyStubClsid32	882f4c1313d37351d72004caa3ef1aee0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	882f4c1313d37351d72004caa3ef1aee0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\ProgID	882f4c1313d37351d72004caa3ef1aee0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\InprocServer32\ThreadingModel = "Apartment"	882f4c1313d37351d72004caa3ef1aee0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\Version\ = "1.0"	882f4c1313d37351d72004caa3ef1aee0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}\TypeLib\ = "{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}"	882f4c1313d37351d72004caa3ef1aee0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}\TypeLib\ = "{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}"	882f4c1313d37351d72004caa3ef1aee0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\MiscStatus\ = "0"	882f4c1313d37351d72004caa3ef1aee0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}	882f4c1313d37351d72004caa3ef1aee0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}\ = "IClientInstaller2"	882f4c1313d37351d72004caa3ef1aee0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ClientAX.ClientInstaller.1	882f4c1313d37351d72004caa3ef1aee0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\InprocServer32\ = "C:\\Windows\\Downloaded Program Files\\ClientAX.dll"	882f4c1313d37351d72004caa3ef1aee0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\ToolboxBitmap32	882f4c1313d37351d72004caa3ef1aee0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\MiscStatus\1\ = "132497"	882f4c1313d37351d72004caa3ef1aee0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}\1.0\0\win32\ = "C:\\Windows\\Downloaded Program Files\\ClientAX.dll"	882f4c1313d37351d72004caa3ef1aee0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	882f4c1313d37351d72004caa3ef1aee0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\MiscStatus	882f4c1313d37351d72004caa3ef1aee0.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\MiscStatus\1	882f4c1313d37351d72004caa3ef1aee0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ClientAX.ClientInstaller\CLSID\ = "{99410CDE-6F16-42ce-9D49-3807F78F0287}"	882f4c1313d37351d72004caa3ef1aee0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\VersionIndependentProgID\ = "ClientAX.ClientInstaller"	882f4c1313d37351d72004caa3ef1aee0.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\MiscStatus	882f4c1313d37351d72004caa3ef1aee0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}\1.0\HELPDIR\ = "C:\\Windows\\Downloaded Program Files\\"	882f4c1313d37351d72004caa3ef1aee0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}\TypeLib	882f4c1313d37351d72004caa3ef1aee0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}\TypeLib\ = "{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}"	882f4c1313d37351d72004caa3ef1aee0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}\TypeLib\ = "{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}"	882f4c1313d37351d72004caa3ef1aee0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}\ = "IClientInstaller2"	882f4c1313d37351d72004caa3ef1aee0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}\1.0\ = "ClientAX 1.0 Type Library"	882f4c1313d37351d72004caa3ef1aee0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}\1.0\FLAGS\ = "0"	882f4c1313d37351d72004caa3ef1aee0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}\1.0\0	882f4c1313d37351d72004caa3ef1aee0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}\TypeLib	882f4c1313d37351d72004caa3ef1aee0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\ToolboxBitmap32\ = "C:\\Windows\\Downloaded Program Files\\ClientAX.dll, 101"	882f4c1313d37351d72004caa3ef1aee0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}\ = "IClientInstaller"	882f4c1313d37351d72004caa3ef1aee0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}	882f4c1313d37351d72004caa3ef1aee0.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3884	zango.exe
3884	zango.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3884	zango.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
3884	zango.exe
3884	zango.exe
3884	zango.exe
3884	zango.exe
3884	zango.exe
3884	zango.exe
3884	zango.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3884	zango.exe
3884	zango.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3244 wrote to memory of 3884	3244	882f4c1313d37351d72004caa3ef1aee0.exe	89
PID 3244 wrote to memory of 3884	3244	882f4c1313d37351d72004caa3ef1aee0.exe	89
PID 3244 wrote to memory of 3884	3244	882f4c1313d37351d72004caa3ef1aee0.exe	89

C:\Users\Admin\AppData\Local\Temp\uploaded\882f4c1313d37351d72004caa3ef1aee0.exe
"C:\Users\Admin\AppData\Local\Temp\uploaded\882f4c1313d37351d72004caa3ef1aee0.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3244
- C:\Program Files\zango\zango.exe
  "C:\Program Files\zango\zango.exe" /did=004825
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3884

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c c:\program files\zango\zango.exe
1⤵
PID:4612

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

zango.exe

Path C:\Program Files\zango\zango.exe
Size 290KB
SHA256 b81b066c4f790d039c10d843a4c1b84326af6c75e12cef0b6acedf425458b690
MD5 97e0b4549717055cda481f31577c6aad
SHA1 f6fa15cecb70383c221f14bc7243c3de38a38609
SHA512 18ff5f6ca76c8e20ff202a2df6daf78a896494ae0cfd1c8543d1329387e65094cc23bd28b66ec04b064a2d83edcb8b308d87a8766eba0c23216b2cac544df1af
SSDEEP 6144:BvVKFzTtXMiL3tSBQgh21F0jNJcZ6J8mn99jK:BvYFxMiL3MqggiHcYJ8Gje
MD5 SHA1 SHA512 SSDEEP

Submit Download

ClientAX.dll

Path C:\Users\Admin\AppData\Local\Temp\ClientAX.dll
Size 408KB
SHA256 86eae33ca5d35efbf403f028da60f426a2ce651ebcbea9bf7c76e1eb61bf8388
MD5 a1c77aaa60ea5acf080f90f4c89aa8a1
SHA1 d96931b0a7a8e1a798c6e099ee6b5bb00ec558ea
SHA512 e78096d4fe24541c922fb2f44577ff3175a804760b6f661adf54628a9d3eda4440eac42008fdd35c7bae6f8277f2bf71df50764e9398464ad42978757db28175
SSDEEP 6144:SCJaKQ/qgCUvVKFzTtXMiL3tSBQgh21F0jNJcZ6J8mn99jio/r:SCJ7QyivYFxMiL3MqggiHcYJ8Gjeo/r
MD5 SHA1 SHA512 SSDEEP

Submit Download

ClientAX.dll

Path C:\Windows\Downloaded Program Files\ClientAX.dll
Size 408KB
SHA256 399836f02ec12bdbd53ab1c5a8891726d00776739943becb138c6ce3698a5932
MD5 fab5473a48caa9d44dc898c938872a24
SHA1 baf86b71106b96a869ab19c322d3aaccf873de4f
SHA512 7a2ce7b1c6c11ebe1d9a9f001c0b4cf029b71dcc6d4b2c1e6a8fe77df3c22ce802de6febe7f4b763e7922b5d8746bc1c68844fe1afb022ef801fcb656c7a2edb
SSDEEP 6144:SCJaKQ/qgCovVKFzTtXMiL3tSBQgh21F0jNJcZ6J8mn99jio/r:SCJ7QyevYFxMiL3MqggiHcYJ8Gjeo/r
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZangoAX.cab

Path C:\Windows\Downloaded Program Files\ZangoAX.cab
Size 335KB
SHA256 2d89c6d2b05cd1264f377163d9f1ca88c273e738c23fbadcc22a8f11781f0476
MD5 c8453e07793a1e7a1180300d039cc878
SHA1 f5726e4ca1e6964443104cd13c47b0c660fbeb85
SHA512 f711fb2ca0c46553f06e088627e98f941967439ef5c6c3f139b1207b95f874fb04b4a75f6ffb62728dd1f52bf41a604e681d4fa1c6f9904d97e2a699f26c927c
SSDEEP 6144:DUp1/beiZbUXN0kCLbW4hQ1MpjIS4ixeI0xCQDsKX2t9sErOrLkH98NScBg:gZbUXN0kCD9pZ4QQxCQDrX2t9xqkHE7m
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3884-50-0x0000000000400000-0x0000000000495000-memory.dmp

Download

memory/3884-51-0x0000000000400000-0x0000000000495000-memory.dmp

Download

memory/3884-52-0x0000000000400000-0x0000000000495000-memory.dmp

Download