c15305f17dcc121c4607726dfaa1b7a64a0a18332b9ae9fb10e4db93cbf02def

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/04/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
KanKan_kk360Setup.exe
Size 4.3MB
Sample260421-ppln7aas2x
SHA256 c15305f17dcc121c4607726dfaa1b7a64a0a18332b9ae9fb10e4db93cbf02def
MD5 f523ad35a76a1c97f7b3f66dee004076
SHA1 a0d923b5707854481257ca420c1c1cbff07c1809
SHA512 0f3ee8382e4fc88126058b1420eefc0770304150fc973b4016f003465a1794bfa89cbdf2125576aca7044714be83b8e3cb3b122f8ebfcb81ad54e362f08578f3
SSDEEP 98304:sZxwHNdH51tcX/jP12be2LcMCw0bkhqcHmTBmsVo1X:dgjEbe2d0bAqcHsBTVo1X
TLSH
T1152612C9A440052ED00E0ABA397FDE054A2AEFD453992E1C9DFE934F8A31D513D35B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Loads dropped DLL 17 IoCs

pid	Process
3756	KanKan_kk360Setup.exe
3756	KanKan_kk360Setup.exe
3756	KanKan_kk360Setup.exe
3756	KanKan_kk360Setup.exe
3756	KanKan_kk360Setup.exe
3756	KanKan_kk360Setup.exe
3756	KanKan_kk360Setup.exe
3756	KanKan_kk360Setup.exe
3756	KanKan_kk360Setup.exe
3756	KanKan_kk360Setup.exe
3756	KanKan_kk360Setup.exe
3756	KanKan_kk360Setup.exe
3756	KanKan_kk360Setup.exe
3756	KanKan_kk360Setup.exe
3756	KanKan_kk360Setup.exe
3756	KanKan_kk360Setup.exe
3756	KanKan_kk360Setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KanKan_kk360Setup.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3756	KanKan_kk360Setup.exe
3756	KanKan_kk360Setup.exe
3756	KanKan_kk360Setup.exe
3756	KanKan_kk360Setup.exe
3756	KanKan_kk360Setup.exe
3756	KanKan_kk360Setup.exe
3756	KanKan_kk360Setup.exe
3756	KanKan_kk360Setup.exe
3756	KanKan_kk360Setup.exe
3756	KanKan_kk360Setup.exe
3756	KanKan_kk360Setup.exe
3756	KanKan_kk360Setup.exe
3756	KanKan_kk360Setup.exe
3756	KanKan_kk360Setup.exe
3756	KanKan_kk360Setup.exe
3756	KanKan_kk360Setup.exe

C:\Users\Admin\AppData\Local\Temp\KanKan_kk360Setup.exe
"C:\Users\Admin\AppData\Local\Temp\KanKan_kk360Setup.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx1950.tmp\InstallOptions.dll
Size 14KB
SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
MD5 325b008aec81e5aaa57096f05d4212b5
SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
TLSH
T1ED622A11778888F3DBD2013EB4533707AF9D5126B4929ED2CA271ECA6D2B05D7EB2346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Processes.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx1950.tmp\Processes.dll
Size 35KB
SHA256 86b302fa9c85dfa0c1c03ba000864a928365dab571f3355347dba02da22949b7
MD5 2cfba79d485cf441c646dd40d82490fc
SHA1 83e51ac1115a50986ed456bd18729653018b9619
SHA512 cca186a7f9c5cff3f4eca410fbe8cc13dad2514a7e36aec9b1addfbcb239ace9b9b2d8427771858e3fd11783abce7e24d43c286f98da9f8b17562ca095a4c043
SSDEEP 768:uxEiycFoaj/+WSiJfmjvab7L/cUf7IIlMLRF:uxEm7sgfmjy//cgdlM/
TLSH
T190F26C117E9045F3D2DAA67115AB4B032B376A0407F585874FBE299A6F632E0B63B343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx1950.tmp\System.dll
Size 11KB
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
TLSH
T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

meituWel.ini

Path C:\Users\Admin\AppData\Local\Temp\nsx1950.tmp\meituWel.ini
Size 234B
SHA256 ff220967e9087db5b071f7327aaf7c30b006dc9e59f40f8ab91cd59ebd03b3cf
MD5 e56e2fa3033d85b21b0154704c0823a2
SHA1 3c21b1dda4faf92f582a3e6e9a3cbdab782763a1
SHA512 d7155e103912d21edfe9bb11fdf81f214f52b63fadf0e73bf0ba542cd3bb9f930d1a7e27a58ad3721d0241bfa9cd1c06ffe9a60c8e0664caf910712ff8b34bb6
TLSH
T1A7D09786445BC31E4804A00AE83277C952E00D10470065F0B42588052BC9CC5D9A91DD
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3756-13-0x0000000002220000-0x000000000222D000-memory.dmp

Download

memory/3756-101-0x0000000000610000-0x00000000006CF000-memory.dmp

Download

memory/3756-104-0x0000000000610000-0x00000000006CF000-memory.dmp

Download

memory/3756-114-0x0000000000610000-0x00000000006CF000-memory.dmp

Download