overlord | 971ca31a18582eed3b1ddfe11533d698a9d3a2b5027a591cde01f7cfaa2d7cc9

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 15:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
update.exe
Size 52KB
Sample260808-stw79sttcy
SHA256 971ca31a18582eed3b1ddfe11533d698a9d3a2b5027a591cde01f7cfaa2d7cc9
MD5 f89cad44baf7b71f0546119d74f45d1b
SHA1 01037a2a57053ff0c178c4f7099a071dc58fff67
SHA512 0587ffe666a887f2f3f5eb1ae6e917d06d0cb5625fc649d3546043f9b68929b56b4439c3bad378c6a37aadf9c99d528774bdd3270bce2834e32127cffaf80aa2
SSDEEP 768:askMImbgdH6LUH/vqJ3S6GgHgezlMm8+guy1MOWtYLalOoQj0Y2lrQhp8gSEUOG:xIc/qC3S6hHgO50Dal6e90p8R
TLSH
T12B335B4E37A398FCC619C17884F75B315B32BD1915305B3E6758EE321E20E562E3EA89
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

overlord rat upx

Malware Config

Extracted

Family

overlord

104.239.66.207:5173

Signatures

Family: Overlord
Overlord is an open-source Windows RAT written in Golang.
rat overlord

Detects Overlord RAT 7 IoCs

resource	yara_rule
behavioral2/memory/1920-63-0x0000000140000000-0x0000000142D71000-memory.dmp	family_overlord
behavioral2/memory/1920-60-0x0000000140000000-0x0000000142D71000-memory.dmp	family_overlord
behavioral2/memory/1920-61-0x0000000140000000-0x0000000142D71000-memory.dmp	family_overlord
behavioral2/memory/1920-62-0x0000000140000000-0x0000000142D71000-memory.dmp	family_overlord
behavioral2/memory/1920-64-0x0000000140000000-0x0000000142D71000-memory.dmp	family_overlord
behavioral2/memory/1920-65-0x0000000140000000-0x0000000142D71000-memory.dmp	family_overlord
behavioral2/memory/1920-73-0x0000000140000000-0x0000000142D71000-memory.dmp	family_overlord

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4280 set thread context of 1920	4280	update.exe	89

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1920-63-0x0000000140000000-0x0000000142D71000-memory.dmp	upx
behavioral2/memory/1920-60-0x0000000140000000-0x0000000142D71000-memory.dmp	upx
behavioral2/memory/1920-61-0x0000000140000000-0x0000000142D71000-memory.dmp	upx
behavioral2/memory/1920-62-0x0000000140000000-0x0000000142D71000-memory.dmp	upx
behavioral2/memory/1920-64-0x0000000140000000-0x0000000142D71000-memory.dmp	upx
behavioral2/memory/1920-65-0x0000000140000000-0x0000000142D71000-memory.dmp	upx
behavioral2/memory/1920-73-0x0000000140000000-0x0000000142D71000-memory.dmp	upx

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	notepad.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	notepad.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4280	update.exe
4280	update.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4280 wrote to memory of 1920	4280	update.exe	89
PID 4280 wrote to memory of 1920	4280	update.exe	89
PID 4280 wrote to memory of 1920	4280	update.exe	89
PID 4280 wrote to memory of 1920	4280	update.exe	89

C:\Users\Admin\AppData\Local\Temp\update.exe
"C:\Users\Admin\AppData\Local\Temp\update.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4280
- C:\Windows\System32\notepad.exe
  C:\Windows\System32\notepad.exe
  2⤵
  - Checks processor information in registry
  PID:1920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

stub_debug.log

Path C:\Users\Admin\AppData\Local\Temp\stub_debug.log
Size 1KB
SHA256 57c893baf5086991763a4b4baf8e94dae1a3726399076b9035b645d9f36c9f8d
MD5 dcee026f0710bf261e61de656d74b6fe
SHA1 fb8b602983f86723704619bd8555b92959e60183
SHA512 947bda4ab9cc013a4327b9cd20ffcf1f4e60e9f4fabc30ac48dcdd001ffe0cd13c6876c267f286c062d192d0a7dfd98e50256f7599529c918c720252180ba846
TLSH
T1DD11004038F415FD4BB53187824378C57BEB2B567B540933BCF6415CD85836771B6095
MD5 SHA1 SHA512 TLSH

Submit Download

stub_debug.log

Path C:\Users\Admin\AppData\Local\Temp\stub_debug.log
Size 395B
SHA256 fabd79fbc93e6c04835ad1dfe69d660f5a3febfcfd9158d18cf5bf12e150bb2d
MD5 47d0c78196fa270d6993d023b8cf744b
SHA1 7c49186dc7d8a84b2efa22a10201528a62eea7d2
SHA512 c271cf311131480f2bf12eb68f9dd2fc60f7b60a308e3aa579c89bb96a5b693c92ebd8317773ca04b9d4321eb36efe71d799087772a8341a62890f25563a5ff5
TLSH
T1A4E0860474F412BD03F63457508730C53FEB5702BB090E3339F6459C6A5832631FA084
MD5 SHA1 SHA512 TLSH

Submit Download

stub_debug.log

Path C:\Users\Admin\AppData\Local\Temp\stub_debug.log
Size 2KB
SHA256 03940d4ccbdc4ed452bcd73d3c071768467b9e0f08a9c9f19b8bdb78ed3b3e57
MD5 095eeb31a418a71de93051fceb187fd4
SHA1 a7cabd91633b4e32eb2494a4e004b5d9dcdeb42a
SHA512 26dd474bac171d563182bb6426c3c5cd489dbb575cbd4e16ff47fd1258a25651e5c8748440579f21217a5de80a218bbd304d5948f22e00014733fde36f0ae957
TLSH
T1D2412D5134FAA1BC4BB170839213B9D53BDB7B823F9409737CF6805C99643ABB076056
MD5 SHA1 SHA512 TLSH

Submit Download

stub_debug.log

Path C:\Users\Admin\AppData\Local\Temp\stub_debug.log
Size 2KB
SHA256 fa5762ad207f2fb450be9b604e29aa16c25f3bd7cb6d47f12db4b4d926627f77
MD5 946a552dff0aa83d6359b821a8a2b893
SHA1 45c9242de096b4824cd2f69b8004b97e35905c84
SHA512 8eaf6a84bf3eab985e9559ab4408466a5737288b4e027aad80b5e740679256b07c99a6ff9aef570f14665a5d02b12848184a9d83931f9cea03f9325d69f79b50
TLSH
T135413E9134FA61BC4BB570839213B9D53BD77B823F9508737CF6806C99643ABB076096
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1920-63-0x0000000140000000-0x0000000142D71000-memory.dmp

Download

memory/1920-60-0x0000000140000000-0x0000000142D71000-memory.dmp

Download

memory/1920-61-0x0000000140000000-0x0000000142D71000-memory.dmp

Download

memory/1920-62-0x0000000140000000-0x0000000142D71000-memory.dmp

Download

memory/1920-64-0x0000000140000000-0x0000000142D71000-memory.dmp

Download

memory/1920-65-0x0000000140000000-0x0000000142D71000-memory.dmp

Download

memory/1920-73-0x0000000140000000-0x0000000142D71000-memory.dmp

Download

memory/4280-28-0x00007FF7813A0000-0x00007FF7813B4000-memory.dmp

Download