overlord | f461c95aa33b44c7fad95774705f8b6580403d7f18215d60a1bd5b63bcd95f16

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 22:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_4be91d2c9205ebe5746f6a0ff7fcb6d0_cobalt-strike_icedid_satacom.exe
Size 17.8MB
Sample260628-2rjc3afy6t
SHA256 f461c95aa33b44c7fad95774705f8b6580403d7f18215d60a1bd5b63bcd95f16
MD5 4be91d2c9205ebe5746f6a0ff7fcb6d0
SHA1 4d6a688002a239171cb8ccfa2e451771491e5c6b
SHA512 6f70b7b100729bea2a049c039bed3cddb533249e37b855516b131255cf2b98595838fb53cd1233bfcc5b7bc7874271da5c193d6d3055921216ab27c567a1c5b6
SSDEEP 196608:Mauu9W4Yv5giJfg0YDHELmPmewTpKfgO1FVm+66MiT:yP5zg0skL+ydO1mD
TLSH
T11F1733D1610FEBF8EA0926B598E18063FBDE3DAD85756FCB798810D50EA414C9E38317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

overlord rat

Malware Config

Extracted

Family

overlord

31.57.219.155:5173

Signatures

Family: Overlord
Overlord is an open-source Windows RAT written in Golang.
rat overlord

Custom signature

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000b00000001b890-2.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Executes dropped EXE 1 IoCs

pid	Process
4076	0E58BBF8.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	0E58BBF8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	0E58BBF8.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 4076	3480	2026-06-28_4be91d2c9205ebe5746f6a0ff7fcb6d0_cobalt-strike_icedid_satacom.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-06-28_4be91d2c9205ebe5746f6a0ff7fcb6d0_cobalt-strike_icedid_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_4be91d2c9205ebe5746f6a0ff7fcb6d0_cobalt-strike_icedid_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Users\Admin\AppData\Local\Temp\0E58BBF8.exe
  "C:\Users\Admin\AppData\Local\Temp\0E58BBF8.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:4076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0E58BBF8.exe

Path C:\Users\Admin\AppData\Local\Temp\0E58BBF8.exe
Size 8.9MB
SHA256 3a23f3246a2dedb412d4de6dd245d2158e8c5e709acb8ab66d772bab3b9de0ec
MD5 38ca114b5b3913adbe77bc823fa01769
SHA1 2a2e94c812a153a8a49e5c7ca694f1f8f6e80242
SHA512 372fe95be50ae71a6b492eba5862ca89f25ff06e029109a6d091f175b9f627c1bf130baf5dc11d335a4a8573454df6a61fcec2b71615acfdee7a8b4255ecbc61
SSDEEP 49152:QmzCgKxzxttm8/np80xCK9OQkm0zFDlgREZ5MOGZFk5mJvznh2hUtazS4iBmRwTM:Qm2zlY32OGZFNnc+8VBDl/bsBQIE
TLSH
T1E9963967FD6568E9C0EEC17586729252BB717C490B2123D32B50F7242F36BD0AEBA740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download