overlord | bb02ac059342fddbb71e50e4ba7df6ec5948cd492ffcb27103a8a6a14fae6660

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 18:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_d8e4b1004ba0a86be2ce99b628b9702f_cobalt-strike_icedid_satacom_vidar.exe
Size 18.0MB
Sample260709-xhqcssgz4v
SHA256 bb02ac059342fddbb71e50e4ba7df6ec5948cd492ffcb27103a8a6a14fae6660
MD5 d8e4b1004ba0a86be2ce99b628b9702f
SHA1 2c6928f6bffd926c39edc8bb864e722fcf354b9c
SHA512 c3355a19683d71fa3c15ddbc73594c568996036b2bd2b29df344d38bad1a86381400836f6b87892ba9e082d12dc0b417a299e3524c5b265960d643ab0761b1e2
SSDEEP 196608:9ckjt8nBXL9u7GUuLxmJeiZxHE9Eg4RxoSjWI6DHivMZ/uYONBe4z:ljt29dAJDq4oSy9DCvr5rea
TLSH
T1F6173345206511E5E2D3AD3EC69946F9DEF2B236E35228DF2BE553240F4A8E47D38E03
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

overlord rat

Malware Config

Extracted

Family

overlord

31.57.219.155:5173

Signatures

Family: Overlord
Overlord is an open-source Windows RAT written in Golang.
rat overlord

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000b000000011377-2.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Executes dropped EXE 1 IoCs

pid	Process
4656	0E58D5D9.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	0E58D5D9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	0E58D5D9.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 4656	1476	2026-07-09_d8e4b1004ba0a86be2ce99b628b9702f_cobalt-strike_icedid_satacom_vidar.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-09_d8e4b1004ba0a86be2ce99b628b9702f_cobalt-strike_icedid_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_d8e4b1004ba0a86be2ce99b628b9702f_cobalt-strike_icedid_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Users\Admin\AppData\Local\Temp\0E58D5D9.exe
  "C:\Users\Admin\AppData\Local\Temp\0E58D5D9.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:4656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0E58D5D9.exe

Path C:\Users\Admin\AppData\Local\Temp\0E58D5D9.exe
Size 8.9MB
SHA256 3a23f3246a2dedb412d4de6dd245d2158e8c5e709acb8ab66d772bab3b9de0ec
MD5 38ca114b5b3913adbe77bc823fa01769
SHA1 2a2e94c812a153a8a49e5c7ca694f1f8f6e80242
SHA512 372fe95be50ae71a6b492eba5862ca89f25ff06e029109a6d091f175b9f627c1bf130baf5dc11d335a4a8573454df6a61fcec2b71615acfdee7a8b4255ecbc61
SSDEEP 49152:QmzCgKxzxttm8/np80xCK9OQkm0zFDlgREZ5MOGZFk5mJvznh2hUtazS4iBmRwTM:Qm2zlY32OGZFNnc+8VBDl/bsBQIE
TLSH
T1E9963967FD6568E9C0EEC17586729252BB717C490B2123D32B50F7242F36BD0AEBA740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download