Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Oct. 18, 2024, 10:07 a.m.	Oct. 18, 2024, 10:14 a.m.

Size	100.0KB
Type	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
MD5	`c2649b34f50484344a60cee642baa697`
SHA256	`b646ecc8fbd94b4b583cc46ed8443bf2e6596095ff087a5591abf0f9fb1b6fb3`
CRC32	`9527C970`
ssdeep	`1536:uE+YqDg5t/yMYBYKDQ0H1xOksEQT4bpMBRVMAyXcFoFOUx:aFGt/yMTI91xOkKpMAyXzOUx`
Yara	PE_Header_Zero - PE File Signature IsPE64 - (no description) Generic_Malware_Zero - Generic Malware

demon.x641.exe "C:\Users\test22\AppData\Local\Temp\demon.x641.exe"
2552

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Allocates read-write-execute memory (usually to unpack itself) (36 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Oct. 18, 2024, 10:07 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013ffe0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:07 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013ffe0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:07 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013ffe0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:07 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013ffe0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:07 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013ffe0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:07 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013ffe0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:07 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013ffe0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:07 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013ffe0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013ffe0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013ffe0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013ffe0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013ffe0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013ffe0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013ffe0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013ffe0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013ffe0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013ffe0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013ffe0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013ffe0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013ffe0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013ffe0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013ffe0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013ffe0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013ffe0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013ffe0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013ffe0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:09 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013ffe0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:09 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013ffe0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:09 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013ffe0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:09 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013ffe0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:09 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013ffe0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:09 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013ffe0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:09 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013ffe0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:09 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013ffe0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:09 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013ffe0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:09 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013ffe0000 process_handle: 0xffffffffffffffff	1

File has been identified by 36 AntiVirus engines on VirusTotal as malicious (36 events)

Bkav	W64.AIDetectMalware
Cynet	Malicious (score: 100)
CAT-QuickHeal	Trojan.Havocp.S33863897
Skyhigh	BehavesLike.Win64.Backdoor.cm
ALYac	Generic.Trojan.Havokiz.Marte.D.E01B59FC
Cylance	Unsafe
VIPRE	Generic.Trojan.Havokiz.Marte.D.E01B59FC
CrowdStrike	win/malicious_confidence_90% (D)
BitDefender	Generic.Trojan.Havokiz.Marte.D.E01B59FC
Arcabit	Generic.Trojan.Havokiz.Marte.D.E01B59FC
Symantec	ML.Attribute.HighConfidence
Elastic	Windows.Generic.Threat
ESET-NOD32	a variant of Win64/Havoc.L
APEX	Malicious
Avast	Win64:Evo-gen [Trj]
ClamAV	Win.Malware.Havoc-10019364-0
MicroWorld-eScan	Generic.Trojan.Havokiz.Marte.D.E01B59FC
Emsisoft	Generic.Trojan.Havokiz.Marte.D.E01B59FC (B)
F-Secure	Heuristic.HEUR/AGEN.1368308
DrWeb	Trojan.Siggen29.14420
CTX	exe.trojan.havokiz
Sophos	ATK/Havoc-G
SentinelOne	Static AI - Malicious PE
FireEye	Generic.Trojan.Havokiz.Marte.D.E01B59FC
Google	Detected
Avira	HEUR/AGEN.1368308
Antiy-AVL	Trojan/Win64.Havoc.e
Microsoft	Trojan:Win32/Havoc.C
GData	Generic.Trojan.Havokiz.Marte.D.E01B59FC
Varist	W64/Havoc.A.gen!Eldorado
McAfee	Agent-FYC!C2649B34F504
Malwarebytes	HackTool.Havoc
Ikarus	Trojan.Win64.Havoc
Tencent	Trojan.Win64.Havoc.16001250
Fortinet	W64/Havoc.L!tr
AVG	Win64:Evo-gen [Trj]

demon.x641.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All