Overview

overview

7

Static

static

3

KanKan_kk360Setup.exe

windows10-2004-x64

4

KanKan_kk360Setup.exe

windows11-ltsc_2024-x64

4

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...es.dll

windows10-2004-x64

3

$PLUGINSDI...es.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$TEMP/Http...ad.exe

windows10-2004-x64

3

$TEMP/Http...ad.exe

windows11-ltsc_2024-x64

3

KanKan/Cra...rt.exe

windows10-2004-x64

3

KanKan/Cra...rt.exe

windows11-ltsc_2024-x64

3

KanKan/ImgFmt.dll

windows10-2004-x64

3

KanKan/ImgFmt.dll

windows11-ltsc_2024-x64

3

KanKan/KanKan.exe

windows10-2004-x64

7

KanKan/KanKan.exe

windows11-ltsc_2024-x64

6

KanKan/KanKanLive.exe

windows10-2004-x64

3

KanKan/KanKanLive.exe

windows11-ltsc_2024-x64

3

KanKan/KanKanST.exe

windows10-2004-x64

3

KanKan/KanKanST.exe

windows11-ltsc_2024-x64

3

KanKan/LibImage19.dll

windows10-2004-x64

3

KanKan/LibImage19.dll

windows11-ltsc_2024-x64

3

KanKan/Loc...k.html

windows10-2004-x64

3

KanKan/Loc...k.html

windows11-ltsc_2024-x64

3

KanKan/Loc...t.html

windows10-2004-x64

3

KanKan/Loc...t.html

windows11-ltsc_2024-x64

3

KanKan/MeituUD.exe

windows10-2004-x64

3

KanKan/MeituUD.exe

windows11-ltsc_2024-x64

3

KanKan/MeituUDEx.exe

windows10-2004-x64

3

KanKan/MeituUDEx.exe

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    KanKan_kk360Setup.exe
  • Size 4.3MB
  • Sample260729-pl27rsthla
  • SHA256 c15305f17dcc121c4607726dfaa1b7a64a0a18332b9ae9fb10e4db93cbf02def
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
bootkitdiscoveryinstallerpersistence

Malware Config

Targets

    • Target
      KanKan_kk360Setup.exe
    • Size 4.3MB
    • SHA256 c15305f17dcc121c4607726dfaa1b7a64a0a18332b9ae9fb10e4db93cbf02def
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    discovery
    behavioral1behavioral2
    • Target
      $PLUGINSDIR/InstallOptions.dll
    • Size 14KB
    • SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      $PLUGINSDIR/KillProcDLL.dll
    • Size 32KB
    • SHA256 ae2f1658656e554f37e6eac896475a3862841a18ffc6fad2754e2d3525770729
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral5behavioral6
    • Target
      $PLUGINSDIR/Processes.dll
    • Size 35KB
    • SHA256 86b302fa9c85dfa0c1c03ba000864a928365dab571f3355347dba02da22949b7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral7behavioral8
    • Target
      $PLUGINSDIR/System.dll
    • Size 11KB
    • SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral10behavioral9
    • Target
      $TEMP/HttpDownLoad.exe
    • Size 72KB
    • SHA256 57a7207b5677be2108c2e70634c8942f4f7a7472cd84cd99683b3058e3374d25
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral11behavioral12
    • Target
      KanKan/CrashReport.exe
    • Size 128KB
    • SHA256 155b689e93aaf796449d4eb7909b1c409f9ba25f8b8b8ef91894624fafc99293
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral13behavioral14
    • Target
      KanKan/ImgFmt.dll
    • Size 540KB
    • SHA256 bd7591a56e853b79817b9848c45d5197f4e48bb353f62d91e36708feb7e2327e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral15behavioral16
    • Target
      KanKan/KanKan.exe
    • Size 4.6MB
    • SHA256 68111aff6f58632930f934340647991159c9e51ac7955e89599f82b6947f6f1a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    bootkitdiscoverypersistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral17behavioral18
    • Target
      KanKan/KanKanLive.exe
    • Size 133KB
    • SHA256 f7004233f90c59bce1c9c1b827fe0ecec730120d76c05a9d5980e6354fd18260
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral19behavioral20
    • Target
      KanKan/KanKanST.exe
    • Size 116KB
    • SHA256 5ad5c3fc6ac2e8061a768401fee8054ae773072c49311456ac5727a2099f6d46
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral21behavioral22
    • Target
      KanKan/LibImage19.dll
    • Size 486KB
    • SHA256 c676d00456eacf05fbd8c3d7fda72f5719942d30e2c367dff9ef650bcf0a6ac7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral23behavioral24
    • Target
      KanKan/Local/Pages/blank.html
    • Size 118B
    • SHA256 4c4dede773e24a6c04e1c253333a8ce4fa4397640e593aad019deee90d756ac7
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    discovery
    behavioral25behavioral26
    • Target
      KanKan/Local/Pages/unconnect.html
    • Size 177B
    • SHA256 96b21d459c313c035020ad58f48f9c55693bfb4b38e7db4d677665206908102c
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    discovery
    behavioral27behavioral28
    • Target
      KanKan/MeituUD.exe
    • Size 570KB
    • SHA256 65c9e2586b4e21a330a4b23ebfa778f4bbb8c406d10dde07e3a5e6845e69fe9e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral29behavioral30
    • Target
      KanKan/MeituUDEx.exe
    • Size 150KB
    • SHA256 2084638e9f0b78e9b8bb13846d9c2dc085234b0c02c4446b0ce060f2c31f2d98
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral31behavioral32

MITRE ATT&CK Enterprise v16

Tasks

static1

installer
Score
3/10

behavioral1

discovery
Score
4/10

behavioral2

discovery
Score
4/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
3/10

behavioral13

discovery
Score
3/10

behavioral14

discovery
Score
3/10

behavioral15

discovery
Score
3/10

behavioral16

discovery
Score
3/10

behavioral17

bootkitdiscoverypersistence
Score
7/10

behavioral18

bootkitdiscoverypersistence
Score
6/10

behavioral19

discovery
Score
3/10

behavioral20

discovery
Score
3/10

behavioral21

discovery
Score
3/10

behavioral22

discovery
Score
3/10

behavioral23

discovery
Score
3/10

behavioral24

discovery
Score
3/10

behavioral25

discovery
Score
3/10

behavioral26

discovery
Score
3/10

behavioral27

discovery
Score
3/10

behavioral28

discovery
Score
3/10

behavioral29

discovery
Score
3/10

behavioral30

discovery
Score
3/10

behavioral31

discovery
Score
3/10

behavioral32

discovery
Score
3/10