c15305f17dcc121c4607726dfaa1b7a64a0a18332b9ae9fb10e4db93cbf02def

Analysis

max time kernel
148s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 12:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
KanKan_kk360Setup.exe
Size 4.3MB
Sample260729-pl27rsthla
SHA256 c15305f17dcc121c4607726dfaa1b7a64a0a18332b9ae9fb10e4db93cbf02def
MD5 f523ad35a76a1c97f7b3f66dee004076
SHA1 a0d923b5707854481257ca420c1c1cbff07c1809
SHA512 0f3ee8382e4fc88126058b1420eefc0770304150fc973b4016f003465a1794bfa89cbdf2125576aca7044714be83b8e3cb3b122f8ebfcb81ad54e362f08578f3
SSDEEP 98304:sZxwHNdH51tcX/jP12be2LcMCw0bkhqcHmTBmsVo1X:dgjEbe2d0bAqcHsBTVo1X
TLSH
T1152612C9A440052ED00E0ABA397FDE054A2AEFD453992E1C9DFE934F8A31D513D35B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Loads dropped DLL 17 IoCs

pid	Process
4644	KanKan_kk360Setup.exe
4644	KanKan_kk360Setup.exe
4644	KanKan_kk360Setup.exe
4644	KanKan_kk360Setup.exe
4644	KanKan_kk360Setup.exe
4644	KanKan_kk360Setup.exe
4644	KanKan_kk360Setup.exe
4644	KanKan_kk360Setup.exe
4644	KanKan_kk360Setup.exe
4644	KanKan_kk360Setup.exe
4644	KanKan_kk360Setup.exe
4644	KanKan_kk360Setup.exe
4644	KanKan_kk360Setup.exe
4644	KanKan_kk360Setup.exe
4644	KanKan_kk360Setup.exe
4644	KanKan_kk360Setup.exe
4644	KanKan_kk360Setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KanKan_kk360Setup.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4644	KanKan_kk360Setup.exe
4644	KanKan_kk360Setup.exe
4644	KanKan_kk360Setup.exe
4644	KanKan_kk360Setup.exe
4644	KanKan_kk360Setup.exe
4644	KanKan_kk360Setup.exe
4644	KanKan_kk360Setup.exe
4644	KanKan_kk360Setup.exe
4644	KanKan_kk360Setup.exe
4644	KanKan_kk360Setup.exe
4644	KanKan_kk360Setup.exe
4644	KanKan_kk360Setup.exe
4644	KanKan_kk360Setup.exe
4644	KanKan_kk360Setup.exe
4644	KanKan_kk360Setup.exe
4644	KanKan_kk360Setup.exe

C:\Users\Admin\AppData\Local\Temp\KanKan_kk360Setup.exe
"C:\Users\Admin\AppData\Local\Temp\KanKan_kk360Setup.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp27A4.tmp\InstallOptions.dll
Size 14KB
SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
MD5 325b008aec81e5aaa57096f05d4212b5
SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
TLSH
T1ED622A11778888F3DBD2013EB4533707AF9D5126B4929ED2CA271ECA6D2B05D7EB2346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Processes.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp27A4.tmp\Processes.dll
Size 35KB
SHA256 86b302fa9c85dfa0c1c03ba000864a928365dab571f3355347dba02da22949b7
MD5 2cfba79d485cf441c646dd40d82490fc
SHA1 83e51ac1115a50986ed456bd18729653018b9619
SHA512 cca186a7f9c5cff3f4eca410fbe8cc13dad2514a7e36aec9b1addfbcb239ace9b9b2d8427771858e3fd11783abce7e24d43c286f98da9f8b17562ca095a4c043
SSDEEP 768:uxEiycFoaj/+WSiJfmjvab7L/cUf7IIlMLRF:uxEm7sgfmjy//cgdlM/
TLSH
T190F26C117E9045F3D2DAA67115AB4B032B376A0407F585874FBE299A6F632E0B63B343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp27A4.tmp\System.dll
Size 11KB
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
TLSH
T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

meituWel.ini

Path C:\Users\Admin\AppData\Local\Temp\nsp27A4.tmp\meituWel.ini
Size 233B
SHA256 72092a25bfb80d1a2c8a309ebb7f8eba9fe24fdc989059cf3edd5b025e938437
MD5 9620dc860a26f46e9f8fa8df3aebeaa4
SHA1 04298f5ceef0af2a814d6404c1d3fb731bf44502
SHA512 eed7e83d5bf965197fc1a299f02617c54b0ade8bcb3f5492dce613a7f48f0843dd18965345fdf845075e902eaa8e99162d32bfab6aaac6c5d1057310f14f6ffa
TLSH
T19BD0978A441BC75E04106042A87677CAA6F01D10074014F0F419980A27C8DC6EAE90CD
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4644-13-0x0000000003050000-0x000000000305D000-memory.dmp

Download