Analysis
- max time kernel
148s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/09/2026, 11:01
General
- Target ca0296dce45a22874bb7e5b564418261373a9a040fd94d044533dfef55da1618.exe
- Size 62.1MB
- Sample260910-m4kz4avyhw
- SHA256 ca0296dce45a22874bb7e5b564418261373a9a040fd94d044533dfef55da1618
Malware Config
Signatures
- Family: Overlord
Overlord is an open-source Windows RAT written in Golang.
- Detects Overlord RAT 23 IoCs
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 1 IoCs
- Registers new Windows logon scripts automatically executed at logon. 1 TTPs 3 IoCs
- Modifies registry class 12 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca0296dce45a22874bb7e5b564418261373a9a040fd94d044533dfef55da1618.exe"C:\Users\Admin\AppData\Local\Temp\ca0296dce45a22874bb7e5b564418261373a9a040fd94d044533dfef55da1618.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Programs\Common\87ba1af7ff04f1ad\runtimebrokersvc.exeC:\Users\Admin\AppData\Local\Programs\Common\87ba1af7ff04f1ad\runtimebrokersvc.exe --install-enc C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\Data\2aaf49352a5b6bc6.bin2⤵
- Executes dropped EXE
- Registers new Windows logon scripts automatically executed at logon.
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Programs\Common\87ba1af7ff04f1ad\runtimebrokersvc.exeC:\Users\Admin\AppData\Local\Programs\Common\87ba1af7ff04f1ad\runtimebrokersvc.exe1⤵
- Executes dropped EXE
- Registers new Windows logon scripts automatically executed at logon.
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\e6fd1c068ecd06a0\runtimebroker5.exeC:\Users\Admin\AppData\Local\Microsoft\Windows\WER\e6fd1c068ecd06a0\runtimebroker5.exe1⤵
- Executes dropped EXE
- Registers new Windows logon scripts automatically executed at logon.
- Modifies registry class
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
2aaf49352a5b6bc6.bin
runtimebrokersvc.exe
cf879481.node
memory/1304-149-0x000001EF56230000-0x000001EF594F9000-memory.dmp
memory/1304-80-0x00007FF7E5D80000-0x00007FF7E5D90000-memory.dmp
memory/1304-127-0x000001EF56230000-0x000001EF594F9000-memory.dmp
memory/1304-135-0x000001EF56230000-0x000001EF594F9000-memory.dmp
memory/1304-152-0x000001EF502E0000-0x000001EF51AD4000-memory.dmp
memory/1304-154-0x00007FF7E5D80000-0x00007FF7E5D90000-memory.dmp
memory/1304-138-0x000001EF56230000-0x000001EF594F9000-memory.dmp
memory/1304-125-0x000001EF56230000-0x000001EF594F9000-memory.dmp
memory/1304-61-0x000001EF502E0000-0x000001EF51AD4000-memory.dmp
memory/1304-126-0x000001EF56230000-0x000001EF594F9000-memory.dmp
memory/1304-88-0x000001EF56230000-0x000001EF594F9000-memory.dmp
memory/1304-77-0x000001EF502E0000-0x000001EF51AD4000-memory.dmp
memory/1304-74-0x000001EF502E0000-0x000001EF51AD4000-memory.dmp
memory/1304-84-0x000001EF55060000-0x000001EF5622B000-memory.dmp
memory/1304-81-0x000001EF53E90000-0x000001EF5505A000-memory.dmp
memory/2704-22-0x00007FF9DBDD0000-0x00007FF9DDCA7000-memory.dmp
memory/2704-28-0x00000253785F0000-0x0000025379DE4000-memory.dmp
memory/2704-25-0x00000253747D0000-0x0000025375FC2000-memory.dmp
memory/2704-133-0x0000025300000000-0x00000253032C9000-memory.dmp
memory/2704-156-0x0000025300000000-0x00000253032C9000-memory.dmp
memory/2704-45-0x00000253785F0000-0x0000025379DE4000-memory.dmp
memory/2704-92-0x0000025300000000-0x00000253032C9000-memory.dmp
memory/2704-155-0x0000025300000000-0x00000253032C9000-memory.dmp
memory/2704-134-0x0000025300000000-0x00000253032C9000-memory.dmp
memory/2704-137-0x0000025300000000-0x00000253032C9000-memory.dmp
memory/2704-47-0x00000253785F0000-0x0000025379DE4000-memory.dmp
memory/2704-140-0x0000025300000000-0x00000253032C9000-memory.dmp
memory/2704-136-0x0000025300000000-0x00000253032C9000-memory.dmp
memory/4972-91-0x0000024232690000-0x0000024235959000-memory.dmp
memory/4972-79-0x00007FF662A40000-0x00007FF662A50000-memory.dmp
memory/4972-130-0x0000024232690000-0x0000024235959000-memory.dmp
memory/4972-141-0x0000024232690000-0x0000024235959000-memory.dmp
memory/4972-46-0x000002422C730000-0x000002422DF24000-memory.dmp
memory/4972-66-0x000002422C730000-0x000002422DF24000-memory.dmp
memory/4972-153-0x00007FF662A40000-0x00007FF662A50000-memory.dmp
memory/4972-33-0x0000024229730000-0x000002422AF21000-memory.dmp
memory/4972-139-0x0000024232690000-0x0000024235959000-memory.dmp
memory/4972-145-0x000002422C730000-0x000002422DF24000-memory.dmp
memory/4972-131-0x0000024232690000-0x0000024235959000-memory.dmp
memory/4972-71-0x000002422C730000-0x000002422DF24000-memory.dmp
memory/4972-129-0x0000024232690000-0x0000024235959000-memory.dmp
memory/4972-128-0x0000024232690000-0x0000024235959000-memory.dmp
memory/4972-63-0x000002422C730000-0x000002422DF24000-memory.dmp
memory/5060-15-0x00007FF662A40000-0x00007FF662A50000-memory.dmp