Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Oct. 18, 2024, 10:07 a.m.	Oct. 18, 2024, 10:20 a.m.

Size	100.0KB
Type	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
MD5	`7a8f8e764dc64d0ee5faed04014d1794`
SHA256	`c1a79af2db1fd681a749a3c496c0d40b6f493b8cef94baefcfe7d3522eceedea`
CRC32	`E9E0562D`
ssdeep	`1536:4E+YqDg5t/yMYBYKDQ0H1xOksEQT4bpMBRVMAyXcFoFOZx:EFGt/yMTI91xOkKpMAyXzOZx`
Yara	PE_Header_Zero - PE File Signature IsPE64 - (no description) Generic_Malware_Zero - Generic Malware

Swift-Sleep-bypass.exe "C:\Users\test22\AppData\Local\Temp\Swift-Sleep-bypass.exe"
940

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Allocates read-write-execute memory (usually to unpack itself) (40 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Oct. 18, 2024, 10:07 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc70000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:07 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc70000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:07 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc70000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc70000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc70000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc70000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc70000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc70000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc70000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc70000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc70000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc70000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc70000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc70000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc70000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc70000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc70000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc70000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc70000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc70000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc70000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc70000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc70000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:08 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc70000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:09 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc70000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:09 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc70000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:09 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc70000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:09 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc70000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:09 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc70000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:09 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc70000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:09 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc70000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:09 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc70000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:09 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc70000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:09 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc70000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:09 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc70000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:09 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc70000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:09 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc70000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:09 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc70000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:09 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc70000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 18, 2024, 10:09 a.m.	process_identifier: 940 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 122880 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000013fc70000 process_handle: 0xffffffffffffffff	1

File has been identified by 48 AntiVirus engines on VirusTotal as malicious (48 events)

Bkav	W64.AIDetectMalware
Lionic	Trojan.Win32.Havoc.4!c
Cynet	Malicious (score: 100)
CAT-QuickHeal	Trojan.Havocp.S33863897
Skyhigh	BehavesLike.Win64.Backdoor.cm
ALYac	Generic.Trojan.Havokiz.Marte.D.DCB0F90F
Cylance	Unsafe
VIPRE	Generic.Trojan.Havokiz.Marte.D.DCB0F90F
Sangfor	Trojan.Win64.Havoc.Veyl
CrowdStrike	win/malicious_confidence_90% (D)
BitDefender	Generic.Trojan.Havokiz.Marte.D.DCB0F90F
Arcabit	Generic.Trojan.Havokiz.Marte.D.DCB0F90F
Symantec	ML.Attribute.HighConfidence
Elastic	Windows.Generic.Threat
ESET-NOD32	a variant of Win64/Havoc.L
APEX	Malicious
Avast	Win64:Evo-gen [Trj]
ClamAV	Win.Malware.Havoc-10019364-0
Kaspersky	UDS:DangerousObject.Multi.Generic
Alibaba	Backdoor:Win64/Havoc.607e4301
MicroWorld-eScan	Generic.Trojan.Havokiz.Marte.D.DCB0F90F
Rising	Trojan.Havoc!8.9710 (CLOUD)
Emsisoft	Generic.Trojan.Havokiz.Marte.D.DCB0F90F (B)
F-Secure	Heuristic.HEUR/AGEN.1368308
DrWeb	Trojan.Siggen29.14420
McAfeeD	ti!C1A79AF2DB1F
CTX	exe.trojan.havoc
Sophos	ATK/Havoc-G
SentinelOne	Static AI - Malicious PE
FireEye	Generic.Trojan.Havokiz.Marte.D.DCB0F90F
Google	Detected
Avira	HEUR/AGEN.1368308
Antiy-AVL	Trojan/Win64.Havoc.e
Kingsoft	Win32.Troj.Unknown.a
Gridinsoft	Trojan.Win64.Agent.sa
Microsoft	Trojan:Win32/Havoc.C
ZoneAlarm	UDS:DangerousObject.Multi.Generic
GData	Generic.Trojan.Havokiz.Marte.D.DCB0F90F
Varist	W64/Havoc.A.gen!Eldorado
McAfee	Agent-FYC!7A8F8E764DC6
DeepInstinct	MALICIOUS
Malwarebytes	HackTool.Havoc
Ikarus	Trojan.Win64.Havoc
Tencent	Trojan.Win64.Havoc.16001250
Fortinet	W64/Havoc.L!tr
AVG	Win64:Evo-gen [Trj]
Paloalto	generic.ml
alibabacloud	Backdoor:Win/Havoc.L

Swift-Sleep-bypass.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All