c45f21b736c2ad5ce36a0110fb69c87c9943765b5b2fa54cd0bb489bc8d2ad90

Analysis

max time kernel
148s
max time network
138s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/06/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
agent-windows-amd64.exe
Size 9.2MB
Sample260603-wtx2cads9s
SHA256 c45f21b736c2ad5ce36a0110fb69c87c9943765b5b2fa54cd0bb489bc8d2ad90
MD5 b44085ef03bcd401e7d5126976f00616
SHA1 ee30963d7b86d23ee88d369a2ce41e7f9e923979
SHA512 a8f214d9cd0f174f56ce4bdddef26699fc7b0f4fa3ef7b7faa8651823b32c02d9cf692100815934d789150b225c1b9db5cf77225c762a4ec127c3499ca31d043
SSDEEP 98304:OKS0BCBE2B0CB69NkFgpgThCGcByOAfCkl/TZZp77EjB:O130z9NlchJcByOAqkbMjB
TLSH
T17DA64A47F8A549E5C0A9D63189769223BA717C480B3123D72B60F7786F73BD0AEB9350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4348	agent.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Run\OverlordAgent = "C:\\Users\\Admin\\AppData\\Roaming\\Overlord\\agent.exe"	agent-windows-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Run\OverlordAgent = "C:\\Users\\Admin\\AppData\\Roaming\\Overlord\\agent.exe"	agent.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1020	agent-windows-amd64.exe

C:\Users\Admin\AppData\Local\Temp\agent-windows-amd64.exe
"C:\Users\Admin\AppData\Local\Temp\agent-windows-amd64.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
PID:1020

C:\Users\Admin\AppData\Roaming\Overlord\agent.exe
C:\Users\Admin\AppData\Roaming\Overlord\agent.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

agent.exe

Path C:\Users\Admin\AppData\Roaming\Overlord\agent.exe
Size 9.2MB
SHA256 c45f21b736c2ad5ce36a0110fb69c87c9943765b5b2fa54cd0bb489bc8d2ad90
MD5 b44085ef03bcd401e7d5126976f00616
SHA1 ee30963d7b86d23ee88d369a2ce41e7f9e923979
SHA512 a8f214d9cd0f174f56ce4bdddef26699fc7b0f4fa3ef7b7faa8651823b32c02d9cf692100815934d789150b225c1b9db5cf77225c762a4ec127c3499ca31d043
SSDEEP 98304:OKS0BCBE2B0CB69NkFgpgThCGcByOAfCkl/TZZp77EjB:O130z9NlchJcByOAqkbMjB
TLSH
T17DA64A47F8A549E5C0A9D63189769223BA717C480B3123D72B60F7786F73BD0AEB9350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads