Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Oct. 18, 2024, 10:07 a.m.	Oct. 18, 2024, 10:11 a.m.

Size	100.0KB
Type	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
MD5	`806425052861a58f462b8e18b7502ae6`
SHA256	`db58a931d38306d3925aba738425200f14fc3e93054f5f3e3fdea3813c23e366`
CRC32	`7D28934C`
ssdeep	`1536:pE+YqDg5t/yMYBYKDQ0H1xOksEQT4bpMBRVMAyXcFoFOPx:7FGt/yMTI91xOkKpMAyXzOPx`
Yara	PE_Header_Zero - PE File Signature IsPE64 - (no description) Generic_Malware_Zero - Generic Malware

demon.x64.exe "C:\Users\test22\AppData\Local\Temp\demon.x64.exe"
1508

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Allocates read-write-execute memory (usually to unpack itself) (36 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Oct. 18, 2024, 10:07 a.m.	process_identifier: 1508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013f430000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:07 a.m.	process_identifier: 1508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013f430000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:07 a.m.	process_identifier: 1508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013f430000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:07 a.m.	process_identifier: 1508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013f430000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:07 a.m.	process_identifier: 1508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013f430000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:07 a.m.	process_identifier: 1508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013f430000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:07 a.m.	process_identifier: 1508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013f430000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 1508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013f430000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 1508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013f430000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 1508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013f430000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 1508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013f430000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 1508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013f430000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 1508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013f430000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 1508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013f430000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 1508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013f430000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 1508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013f430000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 1508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013f430000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 1508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013f430000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 1508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013f430000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 1508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013f430000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 1508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013f430000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 1508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013f430000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 1508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013f430000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 1508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013f430000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 1508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013f430000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:09 a.m.	process_identifier: 1508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013f430000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:09 a.m.	process_identifier: 1508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013f430000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:09 a.m.	process_identifier: 1508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013f430000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:09 a.m.	process_identifier: 1508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013f430000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:09 a.m.	process_identifier: 1508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013f430000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:09 a.m.	process_identifier: 1508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013f430000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:09 a.m.	process_identifier: 1508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013f430000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:09 a.m.	process_identifier: 1508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013f430000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:09 a.m.	process_identifier: 1508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013f430000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:09 a.m.	process_identifier: 1508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013f430000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:09 a.m.	process_identifier: 1508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013f430000 process_handle: 0xffffffffffffffff	1

File has been identified by 47 AntiVirus engines on VirusTotal as malicious (47 events)

Bkav	W64.AIDetectMalware
Lionic	Trojan.Win32.Havoc.4!c
Cynet	Malicious (score: 100)
CAT-QuickHeal	Trojan.Havocp.S33863897
Skyhigh	BehavesLike.Win64.Backdoor.cm
ALYac	Generic.Trojan.Havokiz.Marte.D.578BF9AC
Cylance	Unsafe
VIPRE	Generic.Trojan.Havokiz.Marte.D.578BF9AC
Sangfor	Trojan.Win64.Havoc.Vzdt
CrowdStrike	win/malicious_confidence_90% (D)
BitDefender	Generic.Trojan.Havokiz.Marte.D.578BF9AC
Arcabit	Generic.Trojan.Havokiz.Marte.D.578BF9AC
Symantec	ML.Attribute.HighConfidence
Elastic	Windows.Generic.Threat
ESET-NOD32	a variant of Win64/Havoc.L
APEX	Malicious
Avast	Win64:Evo-gen [Trj]
ClamAV	Win.Malware.Havoc-10019364-0
Kaspersky	UDS:DangerousObject.Multi.Generic
Alibaba	Trojan:Win32/Havoc.e00cba94
MicroWorld-eScan	Generic.Trojan.Havokiz.Marte.D.578BF9AC
Rising	Trojan.Havoc!8.9710 (CLOUD)
Emsisoft	Generic.Trojan.Havokiz.Marte.D.578BF9AC (B)
F-Secure	Heuristic.HEUR/AGEN.1368308
DrWeb	Trojan.Siggen29.14420
McAfeeD	ti!DB58A931D383
CTX	exe.trojan.havoc
Sophos	ATK/Havoc-G
SentinelOne	Static AI - Malicious PE
FireEye	Generic.Trojan.Havokiz.Marte.D.578BF9AC
Google	Detected
Avira	HEUR/AGEN.1368308
Antiy-AVL	Trojan/Win64.Havoc.e
Gridinsoft	Trojan.Win64.Agent.sa
Microsoft	Trojan:Win32/Havoc.C
ZoneAlarm	UDS:DangerousObject.Multi.Generic
GData	Generic.Trojan.Havokiz.Marte.D.578BF9AC
Varist	W64/Havoc.A.gen!Eldorado
McAfee	Agent-FYC!806425052861
DeepInstinct	MALICIOUS
Malwarebytes	HackTool.Havoc
Ikarus	Trojan.Win64.Havoc
Tencent	Trojan.Win64.Havoc.16001250
Fortinet	W64/Havoc.L!tr
AVG	Win64:Evo-gen [Trj]
Paloalto	generic.ml
alibabacloud	Backdoor:Win/Havoc.L

demon.x64.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All