bd55dc31b0c7de4388c7ab9a3f63d0de5f22f64ada1218a0ee592914a57b6aa6

General

Target
2026-10-29_09ac728b592cecff1aa45d67983fab10_cobalt-strike_icedid_njrat_satacom.exe
Size 174KB
Sample261029-v62dvsbg98
SHA256 bd55dc31b0c7de4388c7ab9a3f63d0de5f22f64ada1218a0ee592914a57b6aa6
MD5 09ac728b592cecff1aa45d67983fab10
SHA1 d3661bb25c95b51aeb3e24dbd4966408910bd533
SHA512 38b1d0a4ec61bd54cb14f41cdeaa5295226e76988099357c5118b02bd6f88de482b9221c19193ca91b76e6daac43c918731e1b379543f32bbfc7b4ad26ebbf6b
SSDEEP 3072:oEFqes0yCFIEmR6rnEbt29tv2BL8w+mfvzqXCX0lVx4n243:oEFqcFIEmRwnEbtnow+Uvs4V3
TLSH
T119046C47B7E520F9E1B7863889A54606F772B8350B308BEF47A446755F237C09D3AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 4 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	AbeAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	AbeAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService	AbeAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	AbeAgent.exe

Looks for VMWare services registry key. 1 TTPs 4 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse	AbeAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools	AbeAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMMEMCTL	AbeAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	AbeAgent.exe

Executes dropped EXE 2 IoCs

pid	Process
2460	built.exe
5448	AbeAgent.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	AbeAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	AbeAgent.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4732	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-29_09ac728b592cecff1aa45d67983fab10_cobalt-strike_icedid_njrat_satacom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-29_09ac728b592cecff1aa45d67983fab10_cobalt-strike_icedid_njrat_satacom.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	AbeAgent.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	AbeAgent.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	AbeAgent.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	AbeAgent.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4276 wrote to memory of 4732	4276	2026-10-29_09ac728b592cecff1aa45d67983fab10_cobalt-strike_icedid_njrat_satacom.exe	89
PID 4276 wrote to memory of 4648	4276	2026-10-29_09ac728b592cecff1aa45d67983fab10_cobalt-strike_icedid_njrat_satacom.exe	91
PID 4276 wrote to memory of 2460	4276	2026-10-29_09ac728b592cecff1aa45d67983fab10_cobalt-strike_icedid_njrat_satacom.exe	93
PID 2460 wrote to memory of 5448	2460	built.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-10-29_09ac728b592cecff1aa45d67983fab10_cobalt-strike_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-29_09ac728b592cecff1aa45d67983fab10_cobalt-strike_icedid_njrat_satacom.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:4276
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c if exist "C:\Users\Admin\AppData\Local\Temp\launch-4276-0e590304\extracted" rmdir /s /q "C:\Users\Admin\AppData\Local\Temp\launch-4276-0e590304\extracted"
  2⤵
  - Executes a command shell one-liner
  PID:4732
- C:\Windows\System32\tar.exe
  "C:\Windows\System32\tar.exe" -xf "C:\Users\Admin\AppData\Local\Temp\launch-4276-0e590304\app.zip" -C "C:\Users\Admin\AppData\Local\Temp\launch-4276-0e590304\extracted"
  2⤵
  PID:4648
- C:\Users\Admin\AppData\Local\Temp\launch-4276-0e590304\extracted\built.exe
  "C:\Users\Admin\AppData\Local\Temp\launch-4276-0e590304\extracted\built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2460
- - C:\Users\Admin\AbeOffice\AbeAgent.exe
    "C:\Users\Admin\AbeOffice\AbeAgent.exe"
    3⤵
    - Enumerates VirtualBox registry keys
    - Looks for VMWare services registry key.
    - Executes dropped EXE
    - Maps connected drives based on registry
    - Enumerates system info in registry
    PID:5448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Network Configuration Discovery

1

T1016

Virtualization/Sandbox Evasion

2

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

boot.log

Path C:\Users\Admin\AbeOffice\boot.log
Size 111B
SHA256 ad9bcb0d875b302beb4d9d354098a16cda24fa6ac4cd4f458d0aad908012241b
MD5 183ceab12605f9d8d5962c6c453a0bfe
SHA1 5684565033ed77dda8334d2cdfcb184e29760f41
SHA512 a8f108e74de16c8bb37bf108576ecdb7043011e9d21f0cdd1463aed0122351d820b3997e29996ad81a77635b0154cc607e39d043a325a4d75646fd2ec8cbedab
TLSH
T1EBB0123B62D3053628878E2E17313C481EB460191D30B60077AF0D56B70AC6DE6B218F
MD5 SHA1 SHA512 TLSH

Submit Download

boot.log

Path C:\Users\Admin\AbeOffice\boot.log
Size 268B
SHA256 65baf3729221999f5e164edd20b5e8be1ec619ab4cf5ab82c173bc111cef9c0f
MD5 4068cd6a8d34b5d2c54a6c3c437a37f9
SHA1 99e3b937be1dbe42876c1952f2b55a8a170a5c70
SHA512 06666325da1d460a438990c9c0002ce3c3f7a61b04b07985074524c77ef133cf393861748694e7ae55a7757df033c9229679cc64c3dbbe397d79c073e324d4ef
TLSH
T1A9D02B1732D14B3A18A24F85D23327C06DD0E2280531A40837AF8D5D9B0AC78956619E
MD5 SHA1 SHA512 TLSH

Submit Download

app.zip

Path C:\Users\Admin\AppData\Local\Temp\launch-4276-0e590304\app.zip
Size 4.8MB
SHA256 e5747121228f70e64c27303174c2da037e9a345b6b6f0a3982f14e030930b6b1
MD5 ae0817e13c922482b9b15bacc186a74f
SHA1 f41c698919ddee202914176ca4fc4381630632fc
SHA512 4c8c24bf105232f34d0ecceb36893366966ebf18ad7d358582c637a69be47d880dcfb9b2c2cb5e9d0dc017cec818ddcce222f7507e198de253b046971760cc02
SSDEEP 98304:QZ2ZuTIFnFww/sEiPELwLpsOAhvJfmTTsMUOCCye+RF4mYtuO/u7tUEdnn1+Yogm:QcZuTIFnyw0lbtsOAhBfmXO3Rivk6Edq
TLSH
T150363350569F9D29A61C44A8AFA7F264047013DCB1A7FC728BFAD327CC401EF529B7A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

built.exe

Path C:\Users\Admin\AppData\Local\Temp\launch-4276-0e590304\extracted\built.exe
Size 4.9MB
SHA256 51d722321a9d7198d7aff1326e055e26f4632beeebe96fc217ae99c17ef84f2b
MD5 7596a988f14d7a51a48043521f741d0e
SHA1 414550b4b33ccde26a51b4125d22e0c24820acf0
SHA512 a2738c0e8c4f1ccb7b0fe4c215292fc873ff94c8679124c57cf6d6c15ce3b49083e8cdf7bfcdef71e4d66e095d568e0215455f2a0a18a04f2955b90df5ae6ff3
SSDEEP 98304:Ri52Jc1Ir1lQSBs2GnaLWRfs8qnvvTmZ1WkUoAuyeCRHu6UVSOp4BjUcdnRx6AYq:Ri8Jc1Ir1+Sqdb5s8qnXTm/aNRq9QAc+
TLSH
T1C2362321DA9904BDE276C1B4CE739902E67178CE1735ADEF03E496270F126D89A3EF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads