Analysis

  • max time kernel
    151s
  • max time network
    156s
  • platform
    windows10_x64
  • resource
    win10v200430
  • submitted
    14-07-2020 07:29

General

  • Target

    banbanban.exe

  • Size

    261.7MB

  • MD5

    99feba3a31e179dd70208186c8e7ef1e

  • SHA1

    92edafe211d60ba771f1520890001a6da2709456

  • SHA256

    4db84910fd2fb23d12a93f2171fc361049ec0d8e24074495def3d561396e6789

  • SHA512

    3b42d1d882d153321c9f3b567043f9b1ce7272ffb55266c88c52d30b425f5401f0fe926c8725d1484126e7405ff651a6075920202b6f4863744b46b0d39fcb38

Score
7/10

Malware Config

Signatures

  • Drops startup file 1 IoCs
  • Enumerates connected drives 3 TTPs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

Processes

  • C:\Users\Admin\AppData\Local\Temp\banbanban.exe
    "C:\Users\Admin\AppData\Local\Temp\banbanban.exe"
    1⤵
    • Drops startup file
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Loads dropped DLL
    PID:2532

Network

  • flag-unknown
    DNS
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    Remote address:
    8.8.8.8:53
    Request
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    IN A
    Response
  • flag-unknown
    DNS
    ipinfo.io
    Remote address:
    8.8.8.8:53
    Request
    ipinfo.io
    IN A
    Response
    ipinfo.io
    IN A
    216.239.38.21
    ipinfo.io
    IN A
    216.239.36.21
    ipinfo.io
    IN A
    216.239.34.21
    ipinfo.io
    IN A
    216.239.32.21
  • flag-unknown
    DNS
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    Remote address:
    8.8.8.8:53
    Request
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    IN AAAA
    Response
  • flag-unknown
    GET
    http://ipinfo.io/json
    banbanban.exe
    Remote address:
    216.239.38.21:80
    Request
    GET /json HTTP/1.1
    Host: ipinfo.io
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
    User-Agent: Mozilla/3.0 (compatible; Indy Library)
    Response
    HTTP/1.1 200 OK
    Date: Tue, 14 Jul 2020 07:30:44 GMT
    Content-Type: application/json; charset=utf-8
    Content-Length: 269
    Vary: Accept-Encoding
    Access-Control-Allow-Origin: *
    Set-Cookie: flash=; Path=/; Expires=Thu, 01 Jan 1970 00:00:00 GMT
    X-Content-Type-Options: nosniff
    Via: 1.1 google
    Expires: Tue, 14 Jul 2020 07:30:44 GMT
    Cache-Control: private
  • flag-unknown
    GET
    http://ipinfo.io/json
    banbanban.exe
    Remote address:
    216.239.38.21:80
    Request
    GET /json HTTP/1.1
    Host: ipinfo.io
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
    User-Agent: Mozilla/3.0 (compatible; Indy Library)
    Response
    HTTP/1.1 200 OK
    Date: Tue, 14 Jul 2020 07:30:44 GMT
    Content-Type: application/json; charset=utf-8
    Content-Length: 269
    Vary: Accept-Encoding
    Access-Control-Allow-Origin: *
    Set-Cookie: flash=; Path=/; Expires=Thu, 01 Jan 1970 00:00:00 GMT
    X-Content-Type-Options: nosniff
    Via: 1.1 google
    Expires: Tue, 14 Jul 2020 07:30:44 GMT
    Cache-Control: private
  • flag-unknown
    GET
    http://ipinfo.io/json
    banbanban.exe
    Remote address:
    216.239.38.21:80
    Request
    GET /json HTTP/1.1
    Host: ipinfo.io
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
    User-Agent: Mozilla/3.0 (compatible; Indy Library)
    Response
    HTTP/1.1 200 OK
    Date: Tue, 14 Jul 2020 07:30:44 GMT
    Content-Type: application/json; charset=utf-8
    Content-Length: 269
    Vary: Accept-Encoding
    Access-Control-Allow-Origin: *
    Set-Cookie: flash=; Path=/; Expires=Thu, 01 Jan 1970 00:00:00 GMT
    X-Content-Type-Options: nosniff
    Via: 1.1 google
    Expires: Tue, 14 Jul 2020 07:30:44 GMT
    Cache-Control: private
  • flag-unknown
    DNS
    europaeuamtqvmdcvmjayma.ddnsking.com
    Remote address:
    8.8.8.8:53
    Request
    europaeuamtqvmdcvmjayma.ddnsking.com
    IN A
    Response
  • flag-unknown
    DNS
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    Remote address:
    8.8.8.8:53
    Request
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    IN A
    Response
  • flag-unknown
    DNS
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    Remote address:
    8.8.8.8:53
    Request
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    IN AAAA
    Response
  • flag-unknown
    DNS
    europaeuamtqvmdcvmjayma.ddnsking.com
    Remote address:
    8.8.8.8:53
    Request
    europaeuamtqvmdcvmjayma.ddnsking.com
    IN A
    Response
  • flag-unknown
    DNS
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    Remote address:
    8.8.8.8:53
    Request
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    IN A
    Response
  • flag-unknown
    DNS
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    Remote address:
    8.8.8.8:53
    Request
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    IN AAAA
    Response
  • flag-unknown
    DNS
    europaeuamtqvmdcvmjayma.ddnsking.com
    Remote address:
    8.8.8.8:53
    Request
    europaeuamtqvmdcvmjayma.ddnsking.com
    IN A
    Response
  • flag-unknown
    DNS
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    Remote address:
    8.8.8.8:53
    Request
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    IN A
    Response
  • flag-unknown
    DNS
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    Remote address:
    8.8.8.8:53
    Request
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    IN AAAA
    Response
  • flag-unknown
    DNS
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    Remote address:
    8.8.8.8:53
    Request
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    IN A
    Response
  • flag-unknown
    DNS
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    Remote address:
    8.8.8.8:53
    Request
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    IN AAAA
    Response
  • flag-unknown
    DNS
    europaeuamtqvmdcvmjayma.ddnsking.com
    Remote address:
    8.8.8.8:53
    Request
    europaeuamtqvmdcvmjayma.ddnsking.com
    IN A
    Response
  • flag-unknown
    DNS
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    Remote address:
    8.8.8.8:53
    Request
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    IN A
    Response
  • flag-unknown
    DNS
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    Remote address:
    8.8.8.8:53
    Request
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    IN AAAA
    Response
  • flag-unknown
    DNS
    europaeuamtqvmdcvmjayma.ddnsking.com
    Remote address:
    8.8.8.8:53
    Request
    europaeuamtqvmdcvmjayma.ddnsking.com
    IN A
    Response
  • flag-unknown
    DNS
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    Remote address:
    8.8.8.8:53
    Request
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    IN A
    Response
  • flag-unknown
    DNS
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    Remote address:
    8.8.8.8:53
    Request
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    IN AAAA
    Response
  • flag-unknown
    DNS
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    Remote address:
    8.8.8.8:53
    Request
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    IN A
    Response
  • flag-unknown
    DNS
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    Remote address:
    8.8.8.8:53
    Request
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    IN AAAA
    Response
  • flag-unknown
    DNS
    europaeuamtqvmdcvmjayma.ddnsking.com
    Remote address:
    8.8.8.8:53
    Request
    europaeuamtqvmdcvmjayma.ddnsking.com
    IN A
    Response
  • flag-unknown
    DNS
    europaeuamtqvmdcvmjayma.ddnsking.com
    Remote address:
    8.8.8.8:53
    Request
    europaeuamtqvmdcvmjayma.ddnsking.com
    IN A
    Response
  • flag-unknown
    DNS
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    Remote address:
    8.8.8.8:53
    Request
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    IN A
    Response
  • flag-unknown
    DNS
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    Remote address:
    8.8.8.8:53
    Request
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    IN AAAA
    Response
  • flag-unknown
    DNS
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    Remote address:
    8.8.8.8:53
    Request
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    IN A
    Response
  • flag-unknown
    DNS
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    Remote address:
    8.8.8.8:53
    Request
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    IN AAAA
    Response
  • flag-unknown
    DNS
    europaeuamtqvmdcvmjayma.ddnsking.com
    Remote address:
    8.8.8.8:53
    Request
    europaeuamtqvmdcvmjayma.ddnsking.com
    IN A
    Response
  • flag-unknown
    DNS
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    Remote address:
    8.8.8.8:53
    Request
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    IN A
    Response
  • flag-unknown
    DNS
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    Remote address:
    8.8.8.8:53
    Request
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    IN AAAA
    Response
  • flag-unknown
    DNS
    europaeuamtqvmdcvmjayma.ddnsking.com
    Remote address:
    8.8.8.8:53
    Request
    europaeuamtqvmdcvmjayma.ddnsking.com
    IN A
    Response
  • flag-unknown
    DNS
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    Remote address:
    8.8.8.8:53
    Request
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    IN A
    Response
  • flag-unknown
    DNS
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    Remote address:
    8.8.8.8:53
    Request
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    IN AAAA
    Response
  • flag-unknown
    DNS
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    Remote address:
    8.8.8.8:53
    Request
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    IN A
    Response
  • flag-unknown
    DNS
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    Remote address:
    8.8.8.8:53
    Request
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    IN AAAA
    Response
  • flag-unknown
    DNS
    europaeuamtqvmdcvmjayma.ddnsking.com
    Remote address:
    8.8.8.8:53
    Request
    europaeuamtqvmdcvmjayma.ddnsking.com
    IN A
    Response
  • flag-unknown
    DNS
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    Remote address:
    8.8.8.8:53
    Request
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    IN A
    Response
  • flag-unknown
    DNS
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    Remote address:
    8.8.8.8:53
    Request
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    IN AAAA
    Response
  • 216.239.38.21:80
    http://ipinfo.io/json
    http
    banbanban.exe
    394 B
    801 B
    5
    4

    HTTP Request

    GET http://ipinfo.io/json

    HTTP Response

    200
  • 216.239.38.21:80
    http://ipinfo.io/json
    http
    banbanban.exe
    394 B
    801 B
    5
    4

    HTTP Request

    GET http://ipinfo.io/json

    HTTP Response

    200
  • 216.239.38.21:80
    http://ipinfo.io/json
    http
    banbanban.exe
    394 B
    801 B
    5
    4

    HTTP Request

    GET http://ipinfo.io/json

    HTTP Response

    200
  • 239.255.255.250:1900
    330 B
    2
  • 8.8.8.8:53
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    dns
    82 B
    139 B
    1
    1

    DNS Request

    europaeuaMTQvMDcvMjAyMA.ddnsking.com

  • 8.8.8.8:53
    ipinfo.io
    dns
    55 B
    119 B
    1
    1

    DNS Request

    ipinfo.io

    DNS Response

    216.239.38.21
    216.239.36.21
    216.239.34.21
    216.239.32.21

  • 8.8.8.8:53
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    dns
    82 B
    139 B
    1
    1

    DNS Request

    europaeuaMTQvMDcvMjAyMA.ddnsking.com

  • 8.8.8.8:53
    europaeuamtqvmdcvmjayma.ddnsking.com
    dns
    82 B
    139 B
    1
    1

    DNS Request

    europaeuamtqvmdcvmjayma.ddnsking.com

  • 8.8.8.8:53
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    dns
    82 B
    139 B
    1
    1

    DNS Request

    europaeuaMTQvMDcvMjAyMA.ddnsking.com

  • 8.8.8.8:53
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    dns
    82 B
    139 B
    1
    1

    DNS Request

    europaeuaMTQvMDcvMjAyMA.ddnsking.com

  • 8.8.8.8:53
    europaeuamtqvmdcvmjayma.ddnsking.com
    dns
    82 B
    139 B
    1
    1

    DNS Request

    europaeuamtqvmdcvmjayma.ddnsking.com

  • 8.8.8.8:53
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    dns
    82 B
    139 B
    1
    1

    DNS Request

    europaeuaMTQvMDcvMjAyMA.ddnsking.com

  • 8.8.8.8:53
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    dns
    82 B
    139 B
    1
    1

    DNS Request

    europaeuaMTQvMDcvMjAyMA.ddnsking.com

  • 8.8.8.8:53
    europaeuamtqvmdcvmjayma.ddnsking.com
    dns
    82 B
    139 B
    1
    1

    DNS Request

    europaeuamtqvmdcvmjayma.ddnsking.com

  • 8.8.8.8:53
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    dns
    82 B
    139 B
    1
    1

    DNS Request

    europaeuaMTQvMDcvMjAyMA.ddnsking.com

  • 8.8.8.8:53
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    dns
    82 B
    139 B
    1
    1

    DNS Request

    europaeuaMTQvMDcvMjAyMA.ddnsking.com

  • 8.8.8.8:53
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    dns
    82 B
    139 B
    1
    1

    DNS Request

    europaeuaMTQvMDcvMjAyMA.ddnsking.com

  • 8.8.8.8:53
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    dns
    82 B
    139 B
    1
    1

    DNS Request

    europaeuaMTQvMDcvMjAyMA.ddnsking.com

  • 8.8.8.8:53
    europaeuamtqvmdcvmjayma.ddnsking.com
    dns
    82 B
    139 B
    1
    1

    DNS Request

    europaeuamtqvmdcvmjayma.ddnsking.com

  • 8.8.8.8:53
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    dns
    82 B
    139 B
    1
    1

    DNS Request

    europaeuaMTQvMDcvMjAyMA.ddnsking.com

  • 8.8.8.8:53
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    dns
    82 B
    139 B
    1
    1

    DNS Request

    europaeuaMTQvMDcvMjAyMA.ddnsking.com

  • 8.8.8.8:53
    europaeuamtqvmdcvmjayma.ddnsking.com
    dns
    82 B
    139 B
    1
    1

    DNS Request

    europaeuamtqvmdcvmjayma.ddnsking.com

  • 8.8.8.8:53
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    dns
    82 B
    139 B
    1
    1

    DNS Request

    europaeuaMTQvMDcvMjAyMA.ddnsking.com

  • 8.8.8.8:53
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    dns
    82 B
    139 B
    1
    1

    DNS Request

    europaeuaMTQvMDcvMjAyMA.ddnsking.com

  • 8.8.8.8:53
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    dns
    82 B
    139 B
    1
    1

    DNS Request

    europaeuaMTQvMDcvMjAyMA.ddnsking.com

  • 8.8.8.8:53
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    dns
    82 B
    139 B
    1
    1

    DNS Request

    europaeuaMTQvMDcvMjAyMA.ddnsking.com

  • 8.8.8.8:53
    europaeuamtqvmdcvmjayma.ddnsking.com
    dns
    82 B
    139 B
    1
    1

    DNS Request

    europaeuamtqvmdcvmjayma.ddnsking.com

  • 8.8.8.8:53
    europaeuamtqvmdcvmjayma.ddnsking.com
    dns
    82 B
    139 B
    1
    1

    DNS Request

    europaeuamtqvmdcvmjayma.ddnsking.com

  • 8.8.8.8:53
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    dns
    82 B
    139 B
    1
    1

    DNS Request

    europaeuaMTQvMDcvMjAyMA.ddnsking.com

  • 8.8.8.8:53
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    dns
    82 B
    139 B
    1
    1

    DNS Request

    europaeuaMTQvMDcvMjAyMA.ddnsking.com

  • 8.8.8.8:53
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    dns
    82 B
    139 B
    1
    1

    DNS Request

    europaeuaMTQvMDcvMjAyMA.ddnsking.com

  • 8.8.8.8:53
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    dns
    82 B
    139 B
    1
    1

    DNS Request

    europaeuaMTQvMDcvMjAyMA.ddnsking.com

  • 8.8.8.8:53
    europaeuamtqvmdcvmjayma.ddnsking.com
    dns
    82 B
    139 B
    1
    1

    DNS Request

    europaeuamtqvmdcvmjayma.ddnsking.com

  • 8.8.8.8:53
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    dns
    82 B
    139 B
    1
    1

    DNS Request

    europaeuaMTQvMDcvMjAyMA.ddnsking.com

  • 8.8.8.8:53
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    dns
    82 B
    139 B
    1
    1

    DNS Request

    europaeuaMTQvMDcvMjAyMA.ddnsking.com

  • 8.8.8.8:53
    europaeuamtqvmdcvmjayma.ddnsking.com
    dns
    82 B
    139 B
    1
    1

    DNS Request

    europaeuamtqvmdcvmjayma.ddnsking.com

  • 8.8.8.8:53
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    dns
    82 B
    139 B
    1
    1

    DNS Request

    europaeuaMTQvMDcvMjAyMA.ddnsking.com

  • 8.8.8.8:53
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    dns
    82 B
    139 B
    1
    1

    DNS Request

    europaeuaMTQvMDcvMjAyMA.ddnsking.com

  • 8.8.8.8:53
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    dns
    82 B
    139 B
    1
    1

    DNS Request

    europaeuaMTQvMDcvMjAyMA.ddnsking.com

  • 8.8.8.8:53
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    dns
    82 B
    139 B
    1
    1

    DNS Request

    europaeuaMTQvMDcvMjAyMA.ddnsking.com

  • 8.8.8.8:53
    europaeuamtqvmdcvmjayma.ddnsking.com
    dns
    82 B
    139 B
    1
    1

    DNS Request

    europaeuamtqvmdcvmjayma.ddnsking.com

  • 8.8.8.8:53
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    dns
    82 B
    139 B
    1
    1

    DNS Request

    europaeuaMTQvMDcvMjAyMA.ddnsking.com

  • 8.8.8.8:53
    europaeuaMTQvMDcvMjAyMA.ddnsking.com
    dns
    82 B
    139 B
    1
    1

    DNS Request

    europaeuaMTQvMDcvMjAyMA.ddnsking.com

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.