Resubmissions
24/08/2026, 19:52
260824-yls4jaywa11024/08/2026, 19:44
260824-yfxvjayvfx1024/08/2026, 19:42
260824-yevnsayvft10Analysis
- user interaction
yes - max time kernel
6s - max time network
54s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
24/08/2026, 19:42
General
- Target Loader.exe
- Size 60.4MB
- Sample260824-yevnsayvft
- SHA256 1157b2e0c5d337e099f2101f4b9474a590af18938a2f35896f0245f237653bc6
Malware Config
Extracted
-
overlord
-
wss://127.0.0.1:5173
Signatures
- Family: Overlord
Overlord is an open-source Windows RAT written in Golang.
- Detects Overlord RAT 13 IoCs
- Modifies Windows Firewall 2 TTPs 2 IoCs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 1 IoCs
- Registers new Windows logon scripts automatically executed at logon. 1 TTPs 2 IoCs
- Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of WriteProcessMemory 1 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\5e9a1d5fd7db69e9\diagnosticssvc.exeC:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\5e9a1d5fd7db69e9\diagnosticssvc.exe --install-enc C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\Data\effd56871c4c229b.bin2⤵
- Executes dropped EXE
- Registers new Windows logon scripts automatically executed at logon.
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule name=Loader.exe program=C:\Users\Admin\AppData\Local\Temp\Loader.exe2⤵
- Modifies Windows Firewall
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name=Loader.exe dir=in action=allow program=C:\Users\Admin\AppData\Local\Temp\Loader.exe enable=yes2⤵
- Modifies Windows Firewall
-
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\5e9a1d5fd7db69e9\diagnosticssvc.exeC:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\5e9a1d5fd7db69e9\diagnosticssvc.exe1⤵
- Executes dropped EXE
- Registers new Windows logon scripts automatically executed at logon.
-
C:\Users\Admin\AppData\Local\Microsoft\WinRT\22744ad853298f76\config324.exeC:\Users\Admin\AppData\Local\Microsoft\WinRT\22744ad853298f76\config324.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
diagnosticssvc.exe
26b3545ea35a0e73.dat
b15b5247c1de2c23.dat
effd56871c4c229b.bin
f78d7419.node
memory/1664-125-0x000002548AB40000-0x000002548DE20000-memory.dmp
memory/1664-139-0x000002548AB40000-0x000002548DE20000-memory.dmp
memory/1664-124-0x00007FF606770000-0x00007FF606780000-memory.dmp
memory/1664-136-0x000002548AB40000-0x000002548DE20000-memory.dmp
memory/1664-81-0x0000025484B90000-0x000002548639D000-memory.dmp
memory/1664-142-0x000002548AB40000-0x000002548DE20000-memory.dmp
memory/1664-140-0x000002548AB40000-0x000002548DE20000-memory.dmp
memory/1664-78-0x0000025484B90000-0x000002548639D000-memory.dmp
memory/1664-67-0x0000025484B90000-0x000002548639D000-memory.dmp
memory/1664-152-0x000002548AB40000-0x000002548DE20000-memory.dmp
memory/1664-138-0x000002548AB40000-0x000002548DE20000-memory.dmp
memory/4148-24-0x000002C253DD0000-0x000002C2555D9000-memory.dmp
memory/4148-119-0x000002C25B590000-0x000002C25E870000-memory.dmp
memory/4148-25-0x000002C2555E0000-0x000002C256DED000-memory.dmp
memory/4148-141-0x000002C25B590000-0x000002C25E870000-memory.dmp
memory/4148-35-0x000002C2555E0000-0x000002C256DED000-memory.dmp
memory/4148-114-0x000002C25B590000-0x000002C25E870000-memory.dmp
memory/4148-38-0x000002C2555E0000-0x000002C256DED000-memory.dmp
memory/4148-23-0x000002C250140000-0x000002C251948000-memory.dmp
memory/4148-118-0x000002C25B590000-0x000002C25E870000-memory.dmp
memory/4148-117-0x000002C25B590000-0x000002C25E870000-memory.dmp
memory/4148-100-0x000002C25B590000-0x000002C25E870000-memory.dmp
memory/4148-116-0x000002C25B590000-0x000002C25E870000-memory.dmp
memory/4148-115-0x000002C25B590000-0x000002C25E870000-memory.dmp
memory/4148-113-0x000002C25B590000-0x000002C25E870000-memory.dmp
memory/4216-55-0x00007FF623E60000-0x00007FF623E70000-memory.dmp
memory/4216-106-0x0000022FCC2A0000-0x0000022FCF580000-memory.dmp
memory/4216-103-0x0000022FCC2A0000-0x0000022FCF580000-memory.dmp
memory/4216-97-0x0000022FCC2A0000-0x0000022FCF580000-memory.dmp
memory/4216-94-0x0000022FCC2A0000-0x0000022FCF580000-memory.dmp
memory/4216-96-0x0000022FCC2A0000-0x0000022FCF580000-memory.dmp
memory/4216-95-0x0000022FCC2A0000-0x0000022FCF580000-memory.dmp
memory/4216-93-0x0000022FCC2A0000-0x0000022FCF580000-memory.dmp
memory/4216-79-0x0000022FCC2A0000-0x0000022FCF580000-memory.dmp
memory/4216-69-0x0000022FCB0C0000-0x0000022FCC29E000-memory.dmp
memory/4216-65-0x0000022FC9EE0000-0x0000022FCB0BD000-memory.dmp
memory/4216-52-0x0000022FC62F0000-0x0000022FC7AFD000-memory.dmp
memory/4216-51-0x0000022FC62F0000-0x0000022FC7AFD000-memory.dmp
memory/4216-40-0x0000022FC62F0000-0x0000022FC7AFD000-memory.dmp
memory/4216-148-0x0000022FC62F0000-0x0000022FC7AFD000-memory.dmp
memory/4216-143-0x0000022FCC2A0000-0x0000022FCF580000-memory.dmp
memory/4216-154-0x00007FF623E60000-0x00007FF623E70000-memory.dmp
memory/5468-15-0x00007FF623E60000-0x00007FF623E70000-memory.dmp