Analysis
- max time kernel
898s - max time network
354s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
17/05/2026, 10:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Files/Telegram Files/Overdrive.exe
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
900 seconds
General
- Target Files/Telegram Files/Overdrive.exe
- Size 6.7MB
- Sample260517-mem36aey9x
- SHA256 ca6ebc974547f34ba9ae0325b031768a5bd30dbef95ddf5d4201662ee317a347
- MD5 9b455406802cc7f24f0c65317a3950fb
- SHA1 d047e3586e52f71f3dc7c778ce11d494bd1e48c4
- SHA512 12961580f473512b13235854a8b18e7c170e9bbed841c3679b2c72c153eb2cba903d5ceb61c851b0af0eb328fafc24192a5fb84566ef080b7d1a66af81dc395c
- SSDEEP 98304:Fotj3hLMpc0UV8sTdCPG5b/1aBvZ3ZC1PeU78jVY++y:FotjhLMpcJVRdCPG5b/1aBxygYy
- TLSH T187669DA9A2BC01D5D8ABC1B8C2465227EB72785517B057CF5A649AF60F23FE01F7B700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 ipinfo.io 3 ipinfo.io - Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 4660 ipconfig.exe - Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3852 WMIC.exe Token: SeSecurityPrivilege 3852 WMIC.exe Token: SeTakeOwnershipPrivilege 3852 WMIC.exe Token: SeLoadDriverPrivilege 3852 WMIC.exe Token: SeSystemProfilePrivilege 3852 WMIC.exe Token: SeSystemtimePrivilege 3852 WMIC.exe Token: SeProfSingleProcessPrivilege 3852 WMIC.exe Token: SeIncBasePriorityPrivilege 3852 WMIC.exe Token: SeCreatePagefilePrivilege 3852 WMIC.exe Token: SeBackupPrivilege 3852 WMIC.exe Token: SeRestorePrivilege 3852 WMIC.exe Token: SeShutdownPrivilege 3852 WMIC.exe Token: SeDebugPrivilege 3852 WMIC.exe Token: SeSystemEnvironmentPrivilege 3852 WMIC.exe Token: SeRemoteShutdownPrivilege 3852 WMIC.exe Token: SeUndockPrivilege 3852 WMIC.exe Token: SeManageVolumePrivilege 3852 WMIC.exe Token: 33 3852 WMIC.exe Token: 34 3852 WMIC.exe Token: 35 3852 WMIC.exe Token: 36 3852 WMIC.exe Token: SeIncreaseQuotaPrivilege 3852 WMIC.exe Token: SeSecurityPrivilege 3852 WMIC.exe Token: SeTakeOwnershipPrivilege 3852 WMIC.exe Token: SeLoadDriverPrivilege 3852 WMIC.exe Token: SeSystemProfilePrivilege 3852 WMIC.exe Token: SeSystemtimePrivilege 3852 WMIC.exe Token: SeProfSingleProcessPrivilege 3852 WMIC.exe Token: SeIncBasePriorityPrivilege 3852 WMIC.exe Token: SeCreatePagefilePrivilege 3852 WMIC.exe Token: SeBackupPrivilege 3852 WMIC.exe Token: SeRestorePrivilege 3852 WMIC.exe Token: SeShutdownPrivilege 3852 WMIC.exe Token: SeDebugPrivilege 3852 WMIC.exe Token: SeSystemEnvironmentPrivilege 3852 WMIC.exe Token: SeRemoteShutdownPrivilege 3852 WMIC.exe Token: SeUndockPrivilege 3852 WMIC.exe Token: SeManageVolumePrivilege 3852 WMIC.exe Token: 33 3852 WMIC.exe Token: 34 3852 WMIC.exe Token: 35 3852 WMIC.exe Token: 36 3852 WMIC.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4324 wrote to memory of 5736 4324 Overdrive.exe 81 PID 5736 wrote to memory of 3852 5736 cmd.exe 83 PID 4324 wrote to memory of 5452 4324 Overdrive.exe 85 PID 4324 wrote to memory of 3560 4324 Overdrive.exe 87 PID 3560 wrote to memory of 4660 3560 cmd.exe 89 PID 3560 wrote to memory of 3392 3560 cmd.exe 90 PID 4324 wrote to memory of 2320 4324 Overdrive.exe 91 PID 2320 wrote to memory of 4040 2320 cmd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\Files\Telegram Files\Overdrive.exe"C:\Users\Admin\AppData\Local\Temp\Files\Telegram Files\Overdrive.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\SYSTEM32\cmd.execmd /C "wmic os get Caption,Version /value"2⤵
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\Windows\System32\Wbem\WMIC.exewmic os get Caption,Version /value3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3852
-
-
-
C:\Windows\SYSTEM32\cmd.execmd /C "ver"2⤵PID:5452
-
-
C:\Windows\SYSTEM32\cmd.execmd /C "ipconfig | findstr IPv4"2⤵
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Windows\system32\ipconfig.exeipconfig3⤵
- Gathers network information
PID:4660
-
-
C:\Windows\system32\findstr.exefindstr IPv43⤵PID:3392
-
-
-
C:\Windows\SYSTEM32\cmd.execmd /C "curl -s https://ipinfo.io/json"2⤵
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\system32\curl.execurl -s https://ipinfo.io/json3⤵PID:4040
-
-