overlord | 9db003db614b0b289c62c5ea01e798819dfc7c6445c6a91176199f79beeae780

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 22:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
agent-windows-amd64-46182331.exe
Size 12.2MB
Sample260728-2lspjsztex
SHA256 9db003db614b0b289c62c5ea01e798819dfc7c6445c6a91176199f79beeae780
MD5 d5faaf92eddd62bc6f0e8e4c6bb46518
SHA1 270d1c5489590b502cd48983878f7592af6652ab
SHA512 86ee400a6691d8ee63bf5023c0ca424233d83e8824c27ab7fc47c461f74a26c480dd1eadd8961bcc6d79e88060d158ef95b3c84b3aa2d2a3e7cf5f4ad2f40954
SSDEEP 49152:COcq1CLk2FHXqcJ5loKHob9u4BpKcTPdH+FX1ddGYEB0pKrKpxz+NQWfWYN3hKYs:COBQAOzM+H
TLSH
T19CD60222EDAA18EAC4BEE2318973A4553F667CA41F2593DB1E9077682F31FC05DB1311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery overlord rat

Malware Config

Extracted

Family

overlord

45.38.20.110:5173

Signatures

Family: Overlord
Overlord is an open-source Windows RAT written in Golang.
rat overlord

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
4524	tasklist.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4520 set thread context of 5504	4520	agent-windows-amd64-46182331.exe	92

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4524	tasklist.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4520 wrote to memory of 4524	4520	agent-windows-amd64-46182331.exe	89
PID 4520 wrote to memory of 5504	4520	agent-windows-amd64-46182331.exe	92
PID 4520 wrote to memory of 5504	4520	agent-windows-amd64-46182331.exe	92

C:\Users\Admin\AppData\Local\Temp\agent-windows-amd64-46182331.exe
"C:\Users\Admin\AppData\Local\Temp\agent-windows-amd64-46182331.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Windows\system32\tasklist.exe
  tasklist.exe
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:4524
- C:\Windows\System32\msiexec.exe
  C:\Windows\System32\msiexec.exe
  2⤵
  PID:5504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5504-10-0x0000003E06400000-0x0000003E06600000-memory.dmp

Download

memory/5504-0-0x0000000140000000-0x0000000143034000-memory.dmp