Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
21/04/2026, 12:30
General
- Target KanKan/KanKan.exe
- Size 4.6MB
- Sample260421-ppln7aas2x
- SHA256 68111aff6f58632930f934340647991159c9e51ac7955e89599f82b6947f6f1a
Malware Config
Signatures
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of SetWindowsHookEx 13 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\KanKan\KanKan.exe"C:\Users\Admin\AppData\Local\Temp\KanKan\KanKan.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\KanKan\KanKanLive.exe"C:\Users\Admin\AppData\Local\Temp\KanKan\KanKanLive.exe" MTKK2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\KanKan\KanKanST.exe"C:\Users\Admin\AppData\Local\Temp\KanKan\KanKanST.exe" <software>MTKK</software><style>6</style><wparam></wparam><style>4</style><wparam></wparam><style>3</style><wparam></wparam><style>19</style><wparam></wparam><style>22</style><wparam></wparam>2⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\KanKan\MeituUDEx.exe"C:\Users\Admin\AppData\Local\Temp\KanKan\MeituUDEx.exe" /KanKan 21262⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Lay.ini
config.ini
config.ini
memory/1540-120-0x00000000009C0000-0x0000000000FC2000-memory.dmp
memory/1540-121-0x0000000003340000-0x0000000003347000-memory.dmp
memory/1540-86-0x00000000009C0000-0x0000000000FC2000-memory.dmp
memory/1540-87-0x0000000003340000-0x0000000003347000-memory.dmp
memory/3056-46-0x00000000009C0000-0x0000000000FC2000-memory.dmp
memory/3056-48-0x00000000031E0000-0x00000000031E7000-memory.dmp
memory/4048-69-0x0000000002E80000-0x0000000002E87000-memory.dmp
memory/4048-71-0x0000000002E80000-0x0000000002E87000-memory.dmp
memory/4048-70-0x0000000000A00000-0x0000000001002000-memory.dmp
memory/4048-68-0x0000000000A00000-0x0000000001002000-memory.dmp
memory/4584-61-0x0000000000442000-0x0000000000443000-memory.dmp
memory/4584-1-0x0000000000442000-0x0000000000443000-memory.dmp
memory/4584-63-0x0000000000FB0000-0x00000000015B2000-memory.dmp
memory/4584-65-0x0000000000400000-0x00000000008AC000-memory.dmp
memory/4584-66-0x0000000000400000-0x00000000008AC000-memory.dmp
memory/4584-67-0x0000000000400000-0x00000000008AC000-memory.dmp
memory/4584-62-0x0000000000400000-0x00000000008AC000-memory.dmp
memory/4584-64-0x0000000008430000-0x0000000008437000-memory.dmp
memory/4584-40-0x0000000000400000-0x00000000008AC000-memory.dmp
memory/4584-39-0x0000000000400000-0x00000000008AC000-memory.dmp
memory/4584-38-0x0000000000400000-0x00000000008AC000-memory.dmp
memory/4584-4-0x0000000000400000-0x00000000008AC000-memory.dmp
memory/4584-3-0x0000000000400000-0x00000000008AC000-memory.dmp
memory/4584-2-0x0000000000400000-0x00000000008AC000-memory.dmp