Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
05/10/2026, 14:11
General
- Target BTMOB.exe
- Size 23.8MB
- Sample261005-rhd2wahc43
- SHA256 bc1f4aced516d10f5cfcd5663fa9b94c34f81d9a19cb391034f920de09617a8b
Malware Config
Extracted
-
overlord
-
162.35.96.43:5173
Signatures
- Family: BTMOB
BTMOB is a Windows RAT written in C#.
- Family: Overlord
Overlord is an open-source Windows RAT written in Golang.
- Detects BTMOB RAT 2 IoCs
- Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 4 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\BTMOB.exe"C:\Users\Admin\AppData\Local\Temp\BTMOB.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Packages\d61b7da8\4bd6a3b1d0e0.exe"C:\Users\Admin\AppData\Local\Packages\d61b7da8\4bd6a3b1d0e0.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Packages\d61b7da8\comp0.exe"C:\Users\Admin\AppData\Local\Packages\d61b7da8\comp0.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Packages\SP_26e9ab85\agent-windows-amd64-891d7ab5.exe"C:\Users\Admin\AppData\Local\Packages\SP_26e9ab85\agent-windows-amd64-891d7ab5.exe"3⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_8a7b32599838.exe"C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_8a7b32599838.exe"1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
agent-windows-amd64-891d7ab5.exe
4bd6a3b1d0e0.exe
comp0.exe
comp_manifest.txt
memory/244-38-0x00007FF750FB0000-0x00007FF753B7D000-memory.dmp
memory/244-41-0x00007FF750FB0000-0x00007FF753B7D000-memory.dmp
memory/244-50-0x00007FF750FB0000-0x00007FF753B7D000-memory.dmp
memory/244-48-0x00007FF750FB0000-0x00007FF753B7D000-memory.dmp
memory/244-46-0x00007FF750FB0000-0x00007FF753B7D000-memory.dmp
memory/244-44-0x00007FF750FB0000-0x00007FF753B7D000-memory.dmp
memory/668-16-0x00007FFD56C40000-0x00007FFD575E4000-memory.dmp
memory/668-10-0x0000018BCCA20000-0x0000018BCCA70000-memory.dmp
memory/668-19-0x00007FFD56C40000-0x00007FFD575E4000-memory.dmp
memory/668-20-0x00007FFD56C40000-0x00007FFD575E4000-memory.dmp
memory/668-23-0x00007FFD56C40000-0x00007FFD575E4000-memory.dmp
memory/668-11-0x00007FFD56C40000-0x00007FFD575E4000-memory.dmp
memory/668-14-0x00007FFD56C40000-0x00007FFD575E4000-memory.dmp
memory/668-39-0x00007FFD56C40000-0x00007FFD575E4000-memory.dmp
memory/3276-0-0x00007FFD56DCF000-0x00007FFD56DD0000-memory.dmp
memory/3276-25-0x00007FFD56C40000-0x00007FFD575E4000-memory.dmp
memory/3276-2-0x00007FFD56C40000-0x00007FFD575E4000-memory.dmp
memory/3276-1-0x000002387F630000-0x000002387F63A000-memory.dmp
memory/3276-6-0x00007FFD56C40000-0x00007FFD575E4000-memory.dmp
memory/3648-37-0x00007FF64AA90000-0x00007FF64D65D000-memory.dmp
memory/5584-17-0x000001BEBAC90000-0x000001BEBB462000-memory.dmp