Analysis
- max time kernel
151s - max time network
157s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
24/08/2026, 06:02
General
- Target 2026-08-23_8d6c14f5304f7882d5280a39595ef5a6_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe
- Size 63.1MB
- Sample260824-grttkstbrf
- SHA256 ac1f8b34486eabbb9ae6c3880a4b57dbf044cbfcc7f103ab3c93ed4f26285c3b
Malware Config
Extracted
-
overlord
-
mypamella.xyz
Signatures
- Family: Overlord
Overlord is an open-source Windows RAT written in Golang.
- Detects Overlord RAT 18 IoCs
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 17 IoCs
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 1 IoCs
- Registers new Windows logon scripts automatically executed at logon. 1 TTPs 3 IoCs
- Modifies trusted root certificate store through registry 1 TTPs 2 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
- Modifies registry class 6 IoCs
- Modifies system certificate store 2 TTPs 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_8d6c14f5304f7882d5280a39595ef5a6_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-23_8d6c14f5304f7882d5280a39595ef5a6_byakugan_cobalt-strike_coinminer_glassworm_icedid_luca-s.exe"1⤵
- Loads dropped DLL
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\d8190037d28c2db0\helperclient.exeC:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\d8190037d28c2db0\helperclient.exe --install-enc C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\Data\2844d18fa479a122.bin2⤵
- Executes dropped EXE
- Registers new Windows logon scripts automatically executed at logon.
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\d8190037d28c2db0\helperclient.exeC:\Users\Admin\AppData\Local\Microsoft\EdgeUpdate\d8190037d28c2db0\helperclient.exe1⤵
- Executes dropped EXE
- Registers new Windows logon scripts automatically executed at logon.
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Programs\Common\426c0d705034666a\agent.exeC:\Users\Admin\AppData\Local\Programs\Common\426c0d705034666a\agent.exe1⤵
- Executes dropped EXE
- Registers new Windows logon scripts automatically executed at logon.
- Modifies registry class
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
helperclient.exe
2844d18fa479a122.bin
c4715c3b.node
sysinfo_16435.log
sysinfo_16435.log
memory/244-29-0x0000026209560000-0x000002620A678000-memory.dmp
memory/244-17-0x0000026206750000-0x0000026207865000-memory.dmp
memory/244-18-0x0000026209560000-0x000002620A678000-memory.dmp
memory/244-91-0x000002620D950000-0x0000026210656000-memory.dmp
memory/244-16-0x0000026205630000-0x0000026206744000-memory.dmp
memory/244-19-0x0000026206750000-0x0000026206751000-memory.dmp
memory/244-90-0x000002620D950000-0x0000026210656000-memory.dmp
memory/244-93-0x000002620D950000-0x0000026210656000-memory.dmp
memory/244-92-0x000002620D950000-0x0000026210656000-memory.dmp
memory/244-76-0x000002620BFF0000-0x000002620CC95000-memory.dmp
memory/244-78-0x000002620CCA0000-0x000002620D946000-memory.dmp
memory/244-79-0x000002620D950000-0x0000026210656000-memory.dmp
memory/1400-15-0x00007FF76C8A0000-0x00007FF76C8B0000-memory.dmp
memory/2660-64-0x0000023F895F0000-0x0000023F8A708000-memory.dmp
memory/2660-130-0x0000023F8D9E0000-0x0000023F906E6000-memory.dmp
memory/2660-73-0x0000023F895F0000-0x0000023F8A708000-memory.dmp
memory/2660-146-0x0000023F8D9E0000-0x0000023F906E6000-memory.dmp
memory/2660-95-0x00007FF686250000-0x00007FF686260000-memory.dmp
memory/2660-74-0x0000023F895F0000-0x0000023F8A708000-memory.dmp
memory/2660-104-0x0000023F8D9E0000-0x0000023F906E6000-memory.dmp
memory/2660-148-0x0000023F895F0000-0x0000023F8A708000-memory.dmp
memory/2660-150-0x00007FF686250000-0x00007FF686260000-memory.dmp
memory/2660-129-0x0000023F8D9E0000-0x0000023F906E6000-memory.dmp
memory/2660-128-0x0000023F8D9E0000-0x0000023F906E6000-memory.dmp
memory/2660-127-0x0000023F8D9E0000-0x0000023F906E6000-memory.dmp
memory/5764-61-0x0000029DB6B00000-0x0000029DB7C18000-memory.dmp
memory/5764-125-0x0000029DBAEF0000-0x0000029DBDBF6000-memory.dmp
memory/5764-124-0x0000029DBAEF0000-0x0000029DBDBF6000-memory.dmp
memory/5764-131-0x0000029DBAEF0000-0x0000029DBDBF6000-memory.dmp
memory/5764-138-0x00007FF76C8A0000-0x00007FF76C8B0000-memory.dmp
memory/5764-136-0x0000029DB6B00000-0x0000029DB7C18000-memory.dmp
memory/5764-133-0x0000029DBAEF0000-0x0000029DBDBF6000-memory.dmp
memory/5764-126-0x0000029DBAEF0000-0x0000029DBDBF6000-memory.dmp
memory/5764-109-0x0000029DBAEF0000-0x0000029DBDBF6000-memory.dmp
memory/5764-94-0x00007FF76C8A0000-0x00007FF76C8B0000-memory.dmp
memory/5764-63-0x0000029DB6B00000-0x0000029DB7C18000-memory.dmp
memory/5764-50-0x0000029DB6B00000-0x0000029DB7C18000-memory.dmp