Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Oct. 18, 2024, 10:07 a.m.	Oct. 18, 2024, 10:11 a.m.

Size	100.0KB
Type	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
MD5	`20c633524cd5febea9dc735458b4c382`
SHA256	`12d1b3cfd5b410cc39cd4b74a699c4d31846f551fae776a542f4d26d45c61808`
CRC32	`8FB5725E`
ssdeep	`1536:3E+YqDg5t/yMYBYKDQ0H1xOksEQT4bpMBRVMAyXcFoFOpx:BFGt/yMTI91xOkKpMAyXzOpx`
Yara	PE_Header_Zero - PE File Signature IsPE64 - (no description) Generic_Malware_Zero - Generic Malware

swift-bypass-breakpoints.exe "C:\Users\test22\AppData\Local\Temp\swift-bypass-breakpoints.exe"
2552

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Allocates read-write-execute memory (usually to unpack itself) (35 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Oct. 18, 2024, 10:07 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc80000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:07 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc80000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:07 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc80000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:07 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc80000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:07 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc80000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:07 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc80000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc80000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc80000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc80000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc80000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc80000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc80000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc80000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc80000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc80000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc80000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc80000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc80000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc80000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc80000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc80000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc80000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc80000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc80000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:09 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc80000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:09 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc80000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:09 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc80000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:09 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc80000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:09 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc80000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:09 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc80000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:09 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc80000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:09 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc80000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:09 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc80000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:09 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc80000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:09 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc80000 process_handle: 0xffffffffffffffff	1

File has been identified by 38 AntiVirus engines on VirusTotal as malicious (38 events)

Bkav	W64.AIDetectMalware
Cynet	Malicious (score: 100)
CAT-QuickHeal	Trojan.Havocp.S33863897
Skyhigh	BehavesLike.Win64.Backdoor.cm
ALYac	Generic.Trojan.Havokiz.Marte.D.8219AC8B
Cylance	Unsafe
VIPRE	Generic.Trojan.Havokiz.Marte.D.8219AC8B
CrowdStrike	win/malicious_confidence_90% (D)
BitDefender	Generic.Trojan.Havokiz.Marte.D.8219AC8B
Arcabit	Generic.Trojan.Havokiz.Marte.D.8219AC8B
Symantec	ML.Attribute.HighConfidence
Elastic	Windows.Generic.Threat
ESET-NOD32	a variant of Win64/Havoc.L
APEX	Malicious
Avast	Win64:Evo-gen [Trj]
ClamAV	Win.Malware.Havoc-10019364-0
Kaspersky	Backdoor.Win64.C2.gd
MicroWorld-eScan	Generic.Trojan.Havokiz.Marte.D.8219AC8B
Emsisoft	Generic.Trojan.Havokiz.Marte.D.8219AC8B (B)
F-Secure	Heuristic.HEUR/AGEN.1368308
DrWeb	Trojan.Siggen29.14420
CTX	exe.trojan.havokiz
Sophos	ATK/Havoc-G
SentinelOne	Static AI - Malicious PE
FireEye	Generic.Trojan.Havokiz.Marte.D.8219AC8B
Google	Detected
Avira	HEUR/AGEN.1368308
Antiy-AVL	Trojan/Win64.Havoc.e
Microsoft	Trojan:Win32/Havoc.C
ZoneAlarm	Backdoor.Win64.C2.gd
GData	Generic.Trojan.Havokiz.Marte.D.8219AC8B
Varist	W64/Havoc.A.gen!Eldorado
McAfee	Agent-FYC!20C633524CD5
Malwarebytes	HackTool.Havoc
Ikarus	Trojan.Win64.Havoc
Tencent	Trojan.Win64.Havoc.16001250
Fortinet	W64/Havoc.L!tr
AVG	Win64:Evo-gen [Trj]

swift-bypass-breakpoints.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All