Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Oct. 8, 2021, 4:49 p.m.	Oct. 8, 2021, 4:55 p.m.

Size	3.0MB
Type	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`0db36fb815c659d43624bc706237bf1f`
SHA256	`2906d8c2aedf301e251463fb93aaafcc0dd724536c78a108c8d135c221279220`
CRC32	`46CC89EB`
ssdeep	`24576:un+Gb5BhU1yGjHlswliv6gWMzq9zEFQk0oyBgsjRXIrlB00rgbV2eK8ruqKM9QbU:czkfXA6`
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware IsPE32 - (no description) Is_DotNET_EXE - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT

Sunbathers.exe "C:\Users\test22\AppData\Local\Temp\Sunbathers.exe"
1868
- Sunbathers.exe C:\Users\test22\AppData\Local\Temp\Sunbathers.exe
  204

Name	Response	Post-Analysis Lookup
mas.to	A 88.99.75.82	88.99.75.82

IP Address	Status	Action
164.124.101.2	Active	Moloch
88.99.75.82	Active	Moloch
77.247.127.169	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.101:61479 -> 8.8.8.8:53	2027757	ET DNS Query for .to TLD	Potentially Bad Traffic
TCP 88.99.75.82:443 -> 192.168.56.101:49205	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
UDP 192.168.56.101:61479 -> 164.124.101.2:53	2027757	ET DNS Query for .to TLD	Potentially Bad Traffic
TCP 192.168.56.101:49203 -> 88.99.75.82:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49204 -> 88.99.75.82:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Oct. 8, 2021, 4:49 p.m.			0	0
IsDebuggerPresent Oct. 8, 2021, 4:49 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey Oct. 8, 2021, 4:49 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00610c18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2021, 4:49 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00610c98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2021, 4:49 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00610c98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 8, 2021, 4:49 p.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Oct. 8, 2021, 4:49 p.m.	stacktrace: exception.instruction_r: 8a 08 40 3a cb 75 f9 2b c2 50 56 b9 5c 30 4d 00 exception.symbol: sunbathers+0x113a0 exception.instruction: mov cl, byte ptr [eax] exception.module: Sunbathers.exe exception.exception_code: 0xc0000005 exception.offset: 70560 exception.address: 0x4113a0 registers.esp: 1438428 registers.edi: 4980376 registers.eax: 0 registers.ebp: 16 registers.edx: 1 registers.ebx: 0 registers.esi: 0 registers.ecx: 1438456	1	0	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (23 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 1868 region_size: 2228224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007b0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 1868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00990000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 1868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72741000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 1868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72742000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 1868 region_size: 917504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x022a0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 1868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02340000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 1868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003b2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 1868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 1868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003eb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 1868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 1868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003cc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 1868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00530000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 1868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 1868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 1868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 1868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 1868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 1868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 1868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 1868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0059f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 1868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00590000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 1868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00531000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 1868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00532000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Yara rule detected in process memory (12 events)

description	Win32 PWS Loki	rule	Win32_PWS_Loki_Zero
description	Win.Trojan.agentTesla	rule	Win_Trojan_agentTesla_Zero
description	Take ScreenShot	rule	ScreenShot
description	browser info stealer	rule	infoStealer_browser_Zero
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Communicates with host for which no DNS query was performed (1 event)

host

77.247.127.169

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 204 region_size: 888832 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000224	1	0	0

Potential code injection by writing to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Oct. 8, 2021, 4:49 p.m.	buffer: MZÿÿ¸@èº´ Í!¸LÍ!This program cannot be run in DOS mode. $Æ¥à^Ä Ä Ä Ä í² Ä ¼ Ä ¼ Ä Ä 4Ä í²$ +Ä í²% ÉÄ í² Ä RichÄ PEL[aà æ] @ Ä ÐÌ@ Ä.textµ `.rdataà @@.dataÄY0 , @À base_address: 0x00400000 process_identifier: 204 process_handle: 0x00000224	1	1	0
WriteProcessMemory Oct. 8, 2021, 4:49 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 204 process_handle: 0x00000224	1	1	0

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Oct. 8, 2021, 4:49 p.m.	buffer: MZÿÿ¸@èº´ Í!¸LÍ!This program cannot be run in DOS mode. $Æ¥à^Ä Ä Ä Ä í² Ä ¼ Ä ¼ Ä Ä 4Ä í²$ +Ä í²% ÉÄ í² Ä RichÄ PEL[aà æ] @ Ä ÐÌ@ Ä.textµ `.rdataà @@.dataÄY0 , @À base_address: 0x00400000 process_identifier: 204 process_handle: 0x00000224	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1868 called NtSetContextThread to modify thread in remote process 204
NtSetContextThread Oct. 8, 2021, 4:49 p.m.	registers.eip: 2000355780 registers.esp: 1439808 registers.edi: 0 registers.eax: 4856157 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000220 process_identifier: 204	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1868 resumed a thread in remote process 204
NtResumeThread Oct. 8, 2021, 4:49 p.m.	thread_handle: 0x00000220 suspend_count: 1 process_identifier: 204	1	0	0

Generates some ICMP traffic

Executed a process and injected code into it, probably while unpacking (21 events)

Time & API	Arguments	Status	Return
NtResumeThread Oct. 8, 2021, 4:49 p.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 1868	1	0
NtResumeThread Oct. 8, 2021, 4:49 p.m.	thread_handle: 0x00000158 suspend_count: 1 process_identifier: 1868	1	0
NtResumeThread Oct. 8, 2021, 4:49 p.m.	thread_handle: 0x00000194 suspend_count: 1 process_identifier: 1868	1	0
NtResumeThread Oct. 8, 2021, 4:49 p.m.	thread_handle: 0x0000021c suspend_count: 1 process_identifier: 1868	1	0
NtGetContextThread Oct. 8, 2021, 4:49 p.m.	thread_handle: 0x000000e8	1	0
NtGetContextThread Oct. 8, 2021, 4:49 p.m.	thread_handle: 0x000000e8	1	0
NtResumeThread Oct. 8, 2021, 4:49 p.m.	thread_handle: 0x000000e8 suspend_count: 1 process_identifier: 1868	1	0
NtGetContextThread Oct. 8, 2021, 4:49 p.m.	thread_handle: 0x000000e8	1	0
NtGetContextThread Oct. 8, 2021, 4:49 p.m.	thread_handle: 0x000000e8	1	0
NtResumeThread Oct. 8, 2021, 4:49 p.m.	thread_handle: 0x000000e8 suspend_count: 1 process_identifier: 1868	1	0
CreateProcessInternalW Oct. 8, 2021, 4:49 p.m.	thread_identifier: 1972 thread_handle: 0x00000220 process_identifier: 204 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\Sunbathers.exe filepath_r: stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x00000224	1	1
NtUnmapViewOfSection Oct. 8, 2021, 4:49 p.m.	base_address: 0x00400000 region_size: 7995392 process_identifier: 204 process_handle: 0x00000224		3221225497
NtAllocateVirtualMemory Oct. 8, 2021, 4:49 p.m.	process_identifier: 204 region_size: 888832 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000224	1	0
WriteProcessMemory Oct. 8, 2021, 4:49 p.m.	buffer: MZÿÿ¸@èº´ Í!¸LÍ!This program cannot be run in DOS mode. $Æ¥à^Ä Ä Ä Ä í² Ä ¼ Ä ¼ Ä Ä 4Ä í²$ +Ä í²% ÉÄ í² Ä RichÄ PEL[aà æ] @ Ä ÐÌ@ Ä.textµ `.rdataà @@.dataÄY0 , @À base_address: 0x00400000 process_identifier: 204 process_handle: 0x00000224	1	1
WriteProcessMemory Oct. 8, 2021, 4:49 p.m.	buffer: base_address: 0x00401000 process_identifier: 204 process_handle: 0x00000224	1	1
WriteProcessMemory Oct. 8, 2021, 4:49 p.m.	buffer: base_address: 0x004ba000 process_identifier: 204 process_handle: 0x00000224	1	1
WriteProcessMemory Oct. 8, 2021, 4:49 p.m.	buffer: base_address: 0x004d3000 process_identifier: 204 process_handle: 0x00000224	1	1
NtGetContextThread Oct. 8, 2021, 4:49 p.m.	thread_handle: 0x00000220	1	0
WriteProcessMemory Oct. 8, 2021, 4:49 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 204 process_handle: 0x00000224	1	1
NtSetContextThread Oct. 8, 2021, 4:49 p.m.	registers.eip: 2000355780 registers.esp: 1439808 registers.edi: 0 registers.eax: 4856157 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000220 process_identifier: 204	1	0
NtResumeThread Oct. 8, 2021, 4:49 p.m.	thread_handle: 0x00000220 suspend_count: 1 process_identifier: 204	1	0

File has been identified by 33 AntiVirus engines on VirusTotal as malicious (33 events)

Elastic	malicious (high confidence)
DrWeb	Trojan.PackedNET.972
MicroWorld-eScan	Trojan.GenericKDZ.78553
FireEye	Generic.mg.0db36fb815c659d4
McAfee	GenericRXQH-FN!0DB36FB815C6
Sangfor	Suspicious.Win32.Save.a
Cybereason	malicious.f90370
BitDefenderTheta	Gen:NN.ZemsilF.34170.9o0@a43bw2p
Cyren	W32/MSIL_Kryptik.FUH.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Kryptik.ADAC
APEX	Malicious
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Trojan.GenericKDZ.78553
Avast	Win32:PWSX-gen [Trj]
Ad-Aware	Trojan.GenericKDZ.78553
Sophos	ML/PE-A
McAfee-GW-Edition	BehavesLike.Win32.Generic.vz
Emsisoft	Trojan.GenericKDZ.78553 (B)
Avira	HEUR/AGEN.1144480
Microsoft	Trojan:MSIL/AgentTesla.DAC!MTB
Arcabit	Trojan.Generic.D132D9
GData	Trojan.GenericKDZ.78553
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.Generic.C4628732
ALYac	Trojan.GenericKDZ.78553
MAX	malware (ai score=84)
Malwarebytes	Trojan.Crypt.MSIL.Generic
SentinelOne	Static AI - Malicious PE
eGambit	Unsafe.AI_Score_100%
Fortinet	MSIL/Kryptik.ACCF!tr
AVG	Win32:PWSX-gen [Trj]
CrowdStrike	win/malicious_confidence_60% (D)

Sunbathers.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All