5ad5c3fc6ac2e8061a768401fee8054ae773072c49311456ac5727a2099f6d46

Analysis

max time kernel
149s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
21/04/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
KanKan/KanKanST.exe
Size 116KB
Sample260421-ppln7aas2x
SHA256 5ad5c3fc6ac2e8061a768401fee8054ae773072c49311456ac5727a2099f6d46
MD5 3e4b6f46b36a615a72a23c9d5d3204e4
SHA1 e3ca06f58e96c00b556a0e420359563d33d6d4af
SHA512 e960e0ebbcb70ac3643bc776a97947f6c2fd54bb3a378632804b2fc380ac07f8a24eaedd00c107529d34fa5dbe8ef1f1d76ef25e0c844b12c336d456bb3e4244
SSDEEP 3072:1hKvSHUbRYOOXBz113xI6Z1i9FnCJBWCi:moUbhSz3LYb
TLSH
T163C30B037AF944B0F2B72B714C7EA7749A3AFDA45F21C69F6354DC0C0876650AC2672A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KanKanST.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3816	KanKanST.exe

C:\Users\Admin\AppData\Local\Temp\KanKan\KanKanST.exe
"C:\Users\Admin\AppData\Local\Temp\KanKan\KanKanST.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3816-0-0x00000000009A0000-0x0000000000AED000-memory.dmp

Download