overlord | dc8745d06e37f2e80d21e47a9b4c719daf96304ec9d643a276290d3b53a7f27d

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
agent-windows-amd64-0490e661.exe
Size 12.3MB
Sample260705-vbc3sad14w
SHA256 dc8745d06e37f2e80d21e47a9b4c719daf96304ec9d643a276290d3b53a7f27d
MD5 7861a3b92e6e2cf812361d4c00c3ae02
SHA1 ef7b53cc83440c4b01f20c2cb83357aeee8390ad
SHA512 b6791ba9d5370414153185e19ee6e194e7f6e6fa4fbe8c85d767528a3559f4b213fa917cd09d392084dcaf6abd3b229d93d7d6e583585d59dd45f7f31dece85f
SSDEEP 98304:3IdfgMU+FpwOlGJvzOU08aIjPckb7uKoEp9XLUUs2RAD6CHApEsS2C77y:36JU+FpTFTGckb75B8D6qL2
TLSH
T1ACD63957ED6909E4C4AEC530C576A6137B717C486B2123D72FA0B6386F72BE0ADB9700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution overlord persistence rat

Malware Config

Extracted

Family

overlord

wss://127.0.0.1:5173

Signatures

Family: Overlord
Overlord is an open-source Windows RAT written in Golang.
rat overlord

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1448	powershell.exe
2788	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\agent-2287310855.tmp	agent-windows-amd64-0490e661.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\agent-1837336875.tmp	ovd_60c2afe1e2fa.exe

Executes dropped EXE 1 IoCs

pid	Process
4748	ovd_60c2afe1e2fa.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Windows\CurrentVersion\Run\OverlordAgent-4f1543ba = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\DeviceSync\\ovd_60c2afe1e2fa.exe\""	ovd_60c2afe1e2fa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Windows\CurrentVersion\Run\OverlordAgent-4f1543ba = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\DeviceSync\\ovd_60c2afe1e2fa.exe\""	agent-windows-amd64-0490e661.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1448	powershell.exe
1448	powershell.exe
2788	powershell.exe
2788	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1448	powershell.exe
Token: SeIncreaseQuotaPrivilege	1448	powershell.exe
Token: SeSecurityPrivilege	1448	powershell.exe
Token: SeTakeOwnershipPrivilege	1448	powershell.exe
Token: SeLoadDriverPrivilege	1448	powershell.exe
Token: SeSystemProfilePrivilege	1448	powershell.exe
Token: SeSystemtimePrivilege	1448	powershell.exe
Token: SeProfSingleProcessPrivilege	1448	powershell.exe
Token: SeIncBasePriorityPrivilege	1448	powershell.exe
Token: SeCreatePagefilePrivilege	1448	powershell.exe
Token: SeBackupPrivilege	1448	powershell.exe
Token: SeRestorePrivilege	1448	powershell.exe
Token: SeShutdownPrivilege	1448	powershell.exe
Token: SeDebugPrivilege	1448	powershell.exe
Token: SeSystemEnvironmentPrivilege	1448	powershell.exe
Token: SeRemoteShutdownPrivilege	1448	powershell.exe
Token: SeUndockPrivilege	1448	powershell.exe
Token: SeManageVolumePrivilege	1448	powershell.exe
Token: 33	1448	powershell.exe
Token: 34	1448	powershell.exe
Token: 35	1448	powershell.exe
Token: 36	1448	powershell.exe
Token: SeDebugPrivilege	2788	powershell.exe
Token: SeIncreaseQuotaPrivilege	1448	powershell.exe
Token: SeSecurityPrivilege	1448	powershell.exe
Token: SeTakeOwnershipPrivilege	1448	powershell.exe
Token: SeLoadDriverPrivilege	1448	powershell.exe
Token: SeSystemProfilePrivilege	1448	powershell.exe
Token: SeSystemtimePrivilege	1448	powershell.exe
Token: SeProfSingleProcessPrivilege	1448	powershell.exe
Token: SeIncBasePriorityPrivilege	1448	powershell.exe
Token: SeCreatePagefilePrivilege	1448	powershell.exe
Token: SeBackupPrivilege	1448	powershell.exe
Token: SeRestorePrivilege	1448	powershell.exe
Token: SeShutdownPrivilege	1448	powershell.exe
Token: SeDebugPrivilege	1448	powershell.exe
Token: SeSystemEnvironmentPrivilege	1448	powershell.exe
Token: SeRemoteShutdownPrivilege	1448	powershell.exe
Token: SeUndockPrivilege	1448	powershell.exe
Token: SeManageVolumePrivilege	1448	powershell.exe
Token: 33	1448	powershell.exe
Token: 34	1448	powershell.exe
Token: 35	1448	powershell.exe
Token: 36	1448	powershell.exe
Token: SeIncreaseQuotaPrivilege	1448	powershell.exe
Token: SeSecurityPrivilege	1448	powershell.exe
Token: SeTakeOwnershipPrivilege	1448	powershell.exe
Token: SeLoadDriverPrivilege	1448	powershell.exe
Token: SeSystemProfilePrivilege	1448	powershell.exe
Token: SeSystemtimePrivilege	1448	powershell.exe
Token: SeProfSingleProcessPrivilege	1448	powershell.exe
Token: SeIncBasePriorityPrivilege	1448	powershell.exe
Token: SeCreatePagefilePrivilege	1448	powershell.exe
Token: SeBackupPrivilege	1448	powershell.exe
Token: SeRestorePrivilege	1448	powershell.exe
Token: SeShutdownPrivilege	1448	powershell.exe
Token: SeDebugPrivilege	1448	powershell.exe
Token: SeSystemEnvironmentPrivilege	1448	powershell.exe
Token: SeRemoteShutdownPrivilege	1448	powershell.exe
Token: SeUndockPrivilege	1448	powershell.exe
Token: SeManageVolumePrivilege	1448	powershell.exe
Token: 33	1448	powershell.exe
Token: 34	1448	powershell.exe
Token: 35	1448	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 1448	1056	agent-windows-amd64-0490e661.exe	88
PID 4748 wrote to memory of 2788	4748	ovd_60c2afe1e2fa.exe	92

C:\Users\Admin\AppData\Local\Temp\agent-windows-amd64-0490e661.exe
"C:\Users\Admin\AppData\Local\Temp\agent-windows-amd64-0490e661.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_60c2afe1e2fa.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'ovd_e85d1c4a' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1448

C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_60c2afe1e2fa.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_60c2afe1e2fa.exe"
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_60c2afe1e2fa.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'ovd_e85d1c4a' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 df5de984121ab9eb702c2ef1c0716750e770551b5a5551fee347941d5bdfab01
MD5 8c274452b4cefabecd528a1214159e4a
SHA1 59fefbf3c332bed6d778918035ad778fc2d3cad5
SHA512 9bd08a264f82cf86abb106e99d71e24f4c93aac148ef207091e370f242e49fef2bdff11fb29d20b1b6e1001ccf746a6191f571e33772e0eedbd54b1ed1aa3102
TLSH
T1B0217633B3CC8654C899013A10CEAC1036BB87CB409E8E9B6B84D519A42F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_lwenke2j.y2f.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lwenke2j.y2f.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

agent-1411281220.tmp

Path C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\agent-1411281220.tmp
Size 12.3MB
SHA256 dc8745d06e37f2e80d21e47a9b4c719daf96304ec9d643a276290d3b53a7f27d
MD5 7861a3b92e6e2cf812361d4c00c3ae02
SHA1 ef7b53cc83440c4b01f20c2cb83357aeee8390ad
SHA512 b6791ba9d5370414153185e19ee6e194e7f6e6fa4fbe8c85d767528a3559f4b213fa917cd09d392084dcaf6abd3b229d93d7d6e583585d59dd45f7f31dece85f
SSDEEP 98304:3IdfgMU+FpwOlGJvzOU08aIjPckb7uKoEp9XLUUs2RAD6CHApEsS2C77y:36JU+FpTFTGckb75B8D6qL2
TLSH
T1ACD63957ED6909E4C4AEC530C576A6137B717C486B2123D72FA0B6386F72BE0ADB9700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1056-53-0x00007FF7D8F40000-0x00007FF7DBBF0000-memory.dmp

Download

memory/1056-50-0x00007FF7D8F40000-0x00007FF7DBBF0000-memory.dmp

Download

memory/1056-48-0x00007FF7D8F40000-0x00007FF7DBBF0000-memory.dmp

Download

memory/1056-45-0x00007FF7D8F40000-0x00007FF7DBBF0000-memory.dmp

Download

memory/1056-42-0x00007FF7D8F40000-0x00007FF7DBBF0000-memory.dmp

Download

memory/1448-14-0x00007FFE00740000-0x00007FFE010E4000-memory.dmp

Download

memory/1448-36-0x000002184EDD0000-0x000002184EEC0000-memory.dmp

Download

memory/1448-17-0x00007FFE00740000-0x00007FFE010E4000-memory.dmp

Download

memory/1448-18-0x00007FFE00740000-0x00007FFE010E4000-memory.dmp

Download

memory/1448-21-0x00007FFE00740000-0x00007FFE010E4000-memory.dmp

Download

memory/1448-24-0x00007FFE00740000-0x00007FFE010E4000-memory.dmp

Download

memory/1448-27-0x000002184E880000-0x000002184E89E000-memory.dmp

Download

memory/1448-28-0x000002184E8A0000-0x000002184E952000-memory.dmp

Download

memory/1448-29-0x000002184E760000-0x000002184E76A000-memory.dmp

Download

memory/1448-30-0x000002184EDF0000-0x000002184EE0E000-memory.dmp

Download

memory/1448-15-0x00007FFE00740000-0x00007FFE010E4000-memory.dmp

Download

memory/1448-16-0x00007FFE00740000-0x00007FFE010E4000-memory.dmp

Download

memory/1448-37-0x00007FFE00740000-0x00007FFE010E4000-memory.dmp

Download

memory/1448-13-0x00007FFE00740000-0x00007FFE010E4000-memory.dmp

Download

memory/1448-6-0x00007FFE008CF000-0x00007FFE008D0000-memory.dmp

Download

memory/1448-7-0x00007FFE00740000-0x00007FFE010E4000-memory.dmp

Download

memory/1448-12-0x000002184E6B0000-0x000002184E6D2000-memory.dmp

Download

memory/1448-9-0x00007FFE00740000-0x00007FFE010E4000-memory.dmp

Download

memory/1448-8-0x00007FFE00740000-0x00007FFE010E4000-memory.dmp

Download

memory/2788-40-0x0000022A5D610000-0x0000022A5D700000-memory.dmp

Download

memory/4748-41-0x00007FF7FCC70000-0x00007FF7FF920000-memory.dmp

Download