Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
22/06/2026, 21:27
General
- Target agent-windows-amd64-a0d16802.exe
- Size 21.9MB
- Sample260622-1az4tagz21
- SHA256 aa369a74ce807a8f8507b30a936782da6d9cd84dd7265525132602582558cea7
Score
10/10
Malware Config
Extracted
Family
-
overlord
C2
-
31.76.30.236:5173
Signatures
- Family: Overlord
Overlord is an open-source Windows RAT written in Golang.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes
-
C:\Users\Admin\AppData\Local\Temp\agent-windows-amd64-a0d16802.exe"C:\Users\Admin\AppData\Local\Temp\agent-windows-amd64-a0d16802.exe"1⤵
- Checks processor information in registry
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3676-0-0x00007FF67A630000-0x00007FF67DB78000-memory.dmp
memory/3676-2-0x00007FF67A630000-0x00007FF67DB78000-memory.dmp
memory/3676-3-0x00007FF67A630000-0x00007FF67DB78000-memory.dmp
memory/3676-6-0x00007FF67A630000-0x00007FF67DB78000-memory.dmp
memory/3676-9-0x00007FF67A630000-0x00007FF67DB78000-memory.dmp
memory/3676-12-0x00007FF67A630000-0x00007FF67DB78000-memory.dmp