bd5ee1f6ebe18c36a0168c43f459f54fd133d35244b269e4ecef5bd2a484c72b

Resubmissions

02/06/2025, 23:08

250602-24hx3aek6z

02/06/2025, 22:44

250602-2pacdabk2110

Analysis

max time kernel
149s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20250502-en
resource tags

arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2025, 22:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
uploaded/8e751b8765f733f3f7682fd1247a27a70.exe
Size 489KB
Sample250602-2pacdabk21
SHA256 aa169fb465a49976694ffa3d8795d73dab23bc3e11209ddc70aa07577e675d4b
MD5 2a4b8fa83e620ebb4fc21488efc16bbe
SHA1 cfc0f3c3a5b015ac235d98245c9d5633749cce38
SHA512 647b8ee84ea10262e29307a9ba7b3a055bab4211ce801cf22baf264cd8507533d7370ef1ec12e5576c129b20ee3d547fa06c005722a181e8f226855d5a3560ba
SSDEEP 12288:grxZ//3SfgfZCgOAZw+i+vwnPWybFxJ8fkw:gtZ/VCgOAnAb+l
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1556	zango.exe

Loads dropped DLL 2 IoCs

pid	Process
3720	8e751b8765f733f3f7682fd1247a27a70.exe
3720	8e751b8765f733f3f7682fd1247a27a70.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\zango = "c:\\program files (x86)\\zango\\zango.exe"	zango.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\x:	zango.exe
File opened (read-only)	\??\z:	zango.exe
File opened (read-only)	\??\l:	zango.exe
File opened (read-only)	\??\p:	zango.exe
File opened (read-only)	\??\u:	zango.exe
File opened (read-only)	\??\y:	zango.exe
File opened (read-only)	\??\e:	zango.exe
File opened (read-only)	\??\k:	zango.exe
File opened (read-only)	\??\m:	zango.exe
File opened (read-only)	\??\q:	zango.exe
File opened (read-only)	\??\t:	zango.exe
File opened (read-only)	\??\w:	zango.exe
File opened (read-only)	\??\g:	zango.exe
File opened (read-only)	\??\h:	zango.exe
File opened (read-only)	\??\j:	zango.exe
File opened (read-only)	\??\o:	zango.exe
File opened (read-only)	\??\r:	zango.exe
File opened (read-only)	\??\v:	zango.exe
File opened (read-only)	\??\i:	zango.exe
File opened (read-only)	\??\n:	zango.exe
File opened (read-only)	\??\s:	zango.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral27/files/0x00070000000241bc-39.dat	upx
behavioral27/memory/1556-41-0x0000000000400000-0x0000000000545000-memory.dmp	upx
behavioral27/memory/1556-63-0x0000000000400000-0x0000000000545000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Zango\zango.exe	8e751b8765f733f3f7682fd1247a27a70.exe
File opened for modification	C:\Program Files (x86)\Zango\zango.exe	8e751b8765f733f3f7682fd1247a27a70.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Downloaded Program Files\ClientAX.dll	8e751b8765f733f3f7682fd1247a27a70.exe
File created	C:\Windows\Downloaded Program Files\clientax.inf	8e751b8765f733f3f7682fd1247a27a70.exe
File opened for modification	C:\Windows\Downloaded Program Files\clientax.inf	8e751b8765f733f3f7682fd1247a27a70.exe
File created	C:\Windows\Downloaded Program Files\clientax.dll	8e751b8765f733f3f7682fd1247a27a70.exe
File opened for modification	C:\Windows\Downloaded Program Files\RCXBFA8.tmp	8e751b8765f733f3f7682fd1247a27a70.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8e751b8765f733f3f7682fd1247a27a70.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zango.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\Control	8e751b8765f733f3f7682fd1247a27a70.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\ToolboxBitmap32\ = "C:\\Windows\\Downloaded Program Files\\ClientAX.dll, 101"	8e751b8765f733f3f7682fd1247a27a70.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AC49246-419B-4EE0-8917-8818DAAD6A4E}\MiscStatus	8e751b8765f733f3f7682fd1247a27a70.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}	8e751b8765f733f3f7682fd1247a27a70.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1F1E775-1B21-454D-8D38-7C16519969E5}\TypeLib\Version = "1.0"	8e751b8765f733f3f7682fd1247a27a70.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\MiscStatus\1	8e751b8765f733f3f7682fd1247a27a70.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}\ = "IClientInstaller2"	8e751b8765f733f3f7682fd1247a27a70.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AC49246-419B-4EE0-8917-8818DAAD6A4E}\ToolboxBitmap32\ = "C:\\Windows\\Downloaded Program Files\\ClientAX.dll, 101"	8e751b8765f733f3f7682fd1247a27a70.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ClientAX.ClientInstaller\CLSID\ = "{99410CDE-6F16-42ce-9D49-3807F78F0287}"	8e751b8765f733f3f7682fd1247a27a70.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}	8e751b8765f733f3f7682fd1247a27a70.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\TypeLib	8e751b8765f733f3f7682fd1247a27a70.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}\1.0\HELPDIR\ = "C:\\Windows\\Downloaded Program Files\\"	8e751b8765f733f3f7682fd1247a27a70.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}\TypeLib	8e751b8765f733f3f7682fd1247a27a70.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ClientAX.ClientInstaller.1	8e751b8765f733f3f7682fd1247a27a70.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\ = "ClientInstaller Class"	8e751b8765f733f3f7682fd1247a27a70.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AC49246-419B-4EE0-8917-8818DAAD6A4E}	8e751b8765f733f3f7682fd1247a27a70.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}\TypeLib\Version = "1.0"	8e751b8765f733f3f7682fd1247a27a70.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1F1E775-1B21-454D-8D38-7C16519969E5}	8e751b8765f733f3f7682fd1247a27a70.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ClientAX.ClientInstaller.1\CLSID\ = "{99410CDE-6F16-42ce-9D49-3807F78F0287}"	8e751b8765f733f3f7682fd1247a27a70.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AC49246-419B-4EE0-8917-8818DAAD6A4E}\VersionIndependentProgID\ = "ClientAX.RequiredComponent"	8e751b8765f733f3f7682fd1247a27a70.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AC49246-419B-4EE0-8917-8818DAAD6A4E}\InprocServer32\ThreadingModel = "Apartment"	8e751b8765f733f3f7682fd1247a27a70.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}\ = "IClientInstaller"	8e751b8765f733f3f7682fd1247a27a70.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}\ProxyStubClsid32	8e751b8765f733f3f7682fd1247a27a70.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\VersionIndependentProgID	8e751b8765f733f3f7682fd1247a27a70.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\InprocServer32	8e751b8765f733f3f7682fd1247a27a70.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}	8e751b8765f733f3f7682fd1247a27a70.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}\ = "IClientInstaller2"	8e751b8765f733f3f7682fd1247a27a70.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1F1E775-1B21-454D-8D38-7C16519969E5}\TypeLib\ = "{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}"	8e751b8765f733f3f7682fd1247a27a70.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	8e751b8765f733f3f7682fd1247a27a70.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}\TypeLib\ = "{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}"	8e751b8765f733f3f7682fd1247a27a70.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1F1E775-1B21-454D-8D38-7C16519969E5}\TypeLib\Version = "1.0"	8e751b8765f733f3f7682fd1247a27a70.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ClientAX.RequiredComponent.1\CLSID\ = "{0AC49246-419B-4EE0-8917-8818DAAD6A4E}"	8e751b8765f733f3f7682fd1247a27a70.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\ProgID	8e751b8765f733f3f7682fd1247a27a70.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}\1.0\0\win32\ = "C:\\Windows\\Downloaded Program Files\\ClientAX.dll"	8e751b8765f733f3f7682fd1247a27a70.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}\TypeLib	8e751b8765f733f3f7682fd1247a27a70.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ClientAX.RequiredComponent.1	8e751b8765f733f3f7682fd1247a27a70.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AC49246-419B-4EE0-8917-8818DAAD6A4E}\Control	8e751b8765f733f3f7682fd1247a27a70.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}\TypeLib\Version = "1.0"	8e751b8765f733f3f7682fd1247a27a70.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}\TypeLib	8e751b8765f733f3f7682fd1247a27a70.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1F1E775-1B21-454D-8D38-7C16519969E5}\TypeLib	8e751b8765f733f3f7682fd1247a27a70.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ClientAX.ClientInstaller\CurVer	8e751b8765f733f3f7682fd1247a27a70.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}	8e751b8765f733f3f7682fd1247a27a70.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}\1.0\FLAGS	8e751b8765f733f3f7682fd1247a27a70.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	8e751b8765f733f3f7682fd1247a27a70.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}\TypeLib\Version = "1.0"	8e751b8765f733f3f7682fd1247a27a70.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1F1E775-1B21-454D-8D38-7C16519969E5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	8e751b8765f733f3f7682fd1247a27a70.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ClientAX.ClientInstaller\CLSID	8e751b8765f733f3f7682fd1247a27a70.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AC49246-419B-4EE0-8917-8818DAAD6A4E}\ProgID\ = "ClientAX.RequiredComponent.1"	8e751b8765f733f3f7682fd1247a27a70.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AC49246-419B-4EE0-8917-8818DAAD6A4E}\TypeLib	8e751b8765f733f3f7682fd1247a27a70.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AC49246-419B-4EE0-8917-8818DAAD6A4E}\Version	8e751b8765f733f3f7682fd1247a27a70.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\Programmable	8e751b8765f733f3f7682fd1247a27a70.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\InprocServer32\ThreadingModel = "Apartment"	8e751b8765f733f3f7682fd1247a27a70.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\VersionIndependentProgID	8e751b8765f733f3f7682fd1247a27a70.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1F1E775-1B21-454D-8D38-7C16519969E5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	8e751b8765f733f3f7682fd1247a27a70.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1F1E775-1B21-454D-8D38-7C16519969E5}\TypeLib\ = "{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}"	8e751b8765f733f3f7682fd1247a27a70.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AC49246-419B-4EE0-8917-8818DAAD6A4E}\MiscStatus\1	8e751b8765f733f3f7682fd1247a27a70.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AC49246-419B-4EE0-8917-8818DAAD6A4E}\Version\ = "1.0"	8e751b8765f733f3f7682fd1247a27a70.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\Control	8e751b8765f733f3f7682fd1247a27a70.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	8e751b8765f733f3f7682fd1247a27a70.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}\ProxyStubClsid32	8e751b8765f733f3f7682fd1247a27a70.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}\TypeLib\ = "{5B6689B5-C2D4-4DC7-BFD1-24AC17E5FCDA}"	8e751b8765f733f3f7682fd1247a27a70.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDEA2E1D-8555-45E5-AF09-EC9AA4EA27AD}	8e751b8765f733f3f7682fd1247a27a70.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2B0ECEAC-F597-4858-A542-D966B49055B9}\ProxyStubClsid32	8e751b8765f733f3f7682fd1247a27a70.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99410CDE-6F16-42ce-9D49-3807F78F0287}\ProgID	8e751b8765f733f3f7682fd1247a27a70.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3720	8e751b8765f733f3f7682fd1247a27a70.exe
3720	8e751b8765f733f3f7682fd1247a27a70.exe
3720	8e751b8765f733f3f7682fd1247a27a70.exe
3720	8e751b8765f733f3f7682fd1247a27a70.exe
3720	8e751b8765f733f3f7682fd1247a27a70.exe
3720	8e751b8765f733f3f7682fd1247a27a70.exe
3720	8e751b8765f733f3f7682fd1247a27a70.exe
3720	8e751b8765f733f3f7682fd1247a27a70.exe
3720	8e751b8765f733f3f7682fd1247a27a70.exe
3720	8e751b8765f733f3f7682fd1247a27a70.exe
3720	8e751b8765f733f3f7682fd1247a27a70.exe
3720	8e751b8765f733f3f7682fd1247a27a70.exe
1556	zango.exe
1556	zango.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1556	zango.exe
1556	zango.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3720 wrote to memory of 1556	3720	8e751b8765f733f3f7682fd1247a27a70.exe	93
PID 3720 wrote to memory of 1556	3720	8e751b8765f733f3f7682fd1247a27a70.exe	93
PID 3720 wrote to memory of 1556	3720	8e751b8765f733f3f7682fd1247a27a70.exe	93

C:\Users\Admin\AppData\Local\Temp\uploaded\8e751b8765f733f3f7682fd1247a27a70.exe
"C:\Users\Admin\AppData\Local\Temp\uploaded\8e751b8765f733f3f7682fd1247a27a70.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Program Files (x86)\Zango\zango.exe
  C:\Program Files (x86)\Zango\zango.exe /did=004206 /DID=004206 /bpu=y
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1556

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c c:\program files (x86)\zango\zango.exe
1⤵
PID:1728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

zango.exe

Path C:\Program Files (x86)\Zango\zango.exe
Size 606KB
SHA256 fc5699ac65bd88ec11eb5fc79890fbcd7d952e93f38ef94f1848ba38dd8b216f
MD5 3fc783e8c587891e6977f4e36a1f511a
SHA1 23e85d4dd1d087cfb7bc8ad82a4042f2744b8b62
SHA512 940801e6f6720cd131cf74bfaec9510b3b2304718250ebe685fc280f9490fba65f42c1a7c4545e0b7d1b01d9bed0c76d689137fa77083bf97eeb56915b20f1ae
SSDEEP 6144:NOBxG2oS4CYFSUF5k1fB8dX+/3zZB4R82E0HV6JLJ6PgG9EF06LCR3B9kPmgV6J7:2GrM1L/3zQOP6JeeRr6m
MD5 SHA1 SHA512 SSDEEP

Submit Download

180D4A5.mht

Path C:\Users\Admin\AppData\Local\Temp\180D4A5.mht
Size 7KB
SHA256 e0357ae70c1f8b6365bbaa20adfeabd63fa5cd0673e4c9ec71e26e03e00381e7
MD5 511ba54f162172b179c994d638ba4257
SHA1 078a6cb57ed6a0a93b86a2fe6a073ac57c9e5291
SHA512 8cbc5bfda0179b0c47a18bdad136d28da801e6671506120c35a487708293780a00f924e154eeaf45cc444b3c5d3a8391c506da8897ad741003a9a5df7df099f5
SSDEEP 192:nY+wYXj+b1ozIzqSkYxt1eSTkBl99Vv846:nY+w2ju1fzqSkuISTq9/v846
MD5 SHA1 SHA512 SSDEEP

Submit Download

clientax.dll

Path C:\Users\Admin\AppData\Local\Temp\clientax.dll
Size 796KB
SHA256 bbd4ac5549635ec0870f0d068d865e4dab893bbf4cc57301403d0c24966f9c1b
MD5 e96ca570a4b896f1ff3772f44b23a496
SHA1 79632754cd75f0bc7e988c3a3dcd41581067dbb5
SHA512 3269addf73197235d2984179e1ae934a5fffc63272bdee6a3f357074ec9596d679cbf6f096bc996a79210538bd1a8aefe438d389353975d32be0ca8a2104adb0
SSDEEP 6144:+gQGiG3fE86wppcRYaZqBP/HOBxG2oS4CYFSUF5k1fB8dX+/3zZB4R82E0HV6JLf:SGicfPpGZqmGrM1L/3zQOP6JeeRr6m
MD5 SHA1 SHA512 SSDEEP

Submit Download

360e9316558dc5fc61c74119e7e1abb7_fdf9caaf-3a39-46d1-9fa1-3a0b92834035

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3920234085-916416549-2700794571-1000\360e9316558dc5fc61c74119e7e1abb7_fdf9caaf-3a39-46d1-9fa1-3a0b92834035
Size 68B
SHA256 0324e28fabee037dd3a0b41147a30242b7c8c06d6c39e7d6fc20e342c93c4a5e
MD5 4766fe2c5783d803c530c88f176ebf97
SHA1 3bde73ea83344c3a3db336fb2f274e429c76acac
SHA512 880484e131d5cc669b4469a2df9737bbec9746b6862122b66cf71a4e4d9281fbe105fa73b085980fa52f2819cd10ef65cb8a03f980d2e9ec0e5dafd63c595400
MD5 SHA1 SHA512

Submit Download

clientax.dll

Path C:\Windows\Downloaded Program Files\clientax.dll
Size 796KB
SHA256 7588fd4498a24709bd95f03bc4d7b610acbc350a58d688fffa5a504a5f98decb
MD5 7c7b293e682cf0b4852af09335de27dd
SHA1 d28325d216ef737e5f416efdfc32ffb5eaecc5e9
SHA512 b5cfca87a2c00b1ca7947690ab7a7bd5e4d16d5e31f0518df221866eaa4fab2895907499ea4a31c4e9b067c678ca29d92744f9b55afb9626590a5cffc108bc4e
SSDEEP 6144:+gQGiG3fE86wppcRYaZqBP/0OBxG2oS4CYFSUF5k1fB8dX+/3zZB4R82E0HV6JLf:SGicfPpGZqrGrM1L/3zQOP6JeeRr6m
MD5 SHA1 SHA512 SSDEEP

Submit Download

clientax.inf

Path C:\Windows\Downloaded Program Files\clientax.inf
Size 229B
SHA256 b8b93f706f83f93fcda3a8c24a8092f733128b3a5d3d08d4689e53590f3b485b
MD5 cee09b7981687b1afc51cca79b2ed811
SHA1 6432d2314f25c8ff12105b6fec94d1351fd233b9
SHA512 2dd403c90fad4c83240ccbe33e067c1ad9b3efc533a22d060f548aa124885a21144cd3b2f3752a0c915c27e1a0c0f5d8bcea3ed862d244dcce64d50ba993b84e
MD5 SHA1 SHA512

Submit Download

memory/1556-41-0x0000000000400000-0x0000000000545000-memory.dmp

Download

memory/1556-63-0x0000000000400000-0x0000000000545000-memory.dmp

Download