43ee839d68f9b45dc24a3e3c2fad3cba7d5e191cd18bd8bfbbc2a440cc1d5a5e

General

Target
2026-10-28_52568a009274554fd170b31cf6090236_cobalt-strike_icedid_njrat_satacom.exe
Size 174KB
Sample261030-e9c8faaw7n
SHA256 43ee839d68f9b45dc24a3e3c2fad3cba7d5e191cd18bd8bfbbc2a440cc1d5a5e
MD5 52568a009274554fd170b31cf6090236
SHA1 ff41ba0f4693eabd109da261482dcddbccd808be
SHA512 1231414ed1893531d8f599236b07e51a5b008526b7342032f0bf2d829f7df006009416807c7058dbd1e9d8702799af712c1c13e1d6a6be9d28079a94a3ebaf5d
SSDEEP 3072:CEFqes0yCFIEmR6rnEbt29tv2BL8w+mfvzqXCX0lVx4n24a:CEFqcFIEmRwnEbtnow+Uvs4Va
TLSH
T12C046C47B7E520F9E1B7863889A54606F772B8350B308BEF47A446755F237C09D3AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 4 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	AbeAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	AbeAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService	AbeAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	AbeAgent.exe

Looks for VMWare services registry key. 1 TTPs 4 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools	AbeAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMMEMCTL	AbeAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	AbeAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse	AbeAgent.exe

Executes dropped EXE 2 IoCs

pid	Process
4136	built.exe
4040	AbeAgent.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	AbeAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	AbeAgent.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1776	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-28_52568a009274554fd170b31cf6090236_cobalt-strike_icedid_njrat_satacom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-28_52568a009274554fd170b31cf6090236_cobalt-strike_icedid_njrat_satacom.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	AbeAgent.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	AbeAgent.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	AbeAgent.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	AbeAgent.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 1776	1548	2026-10-28_52568a009274554fd170b31cf6090236_cobalt-strike_icedid_njrat_satacom.exe	86
PID 1548 wrote to memory of 2764	1548	2026-10-28_52568a009274554fd170b31cf6090236_cobalt-strike_icedid_njrat_satacom.exe	88
PID 1548 wrote to memory of 4136	1548	2026-10-28_52568a009274554fd170b31cf6090236_cobalt-strike_icedid_njrat_satacom.exe	90
PID 4136 wrote to memory of 4040	4136	built.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-10-28_52568a009274554fd170b31cf6090236_cobalt-strike_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_52568a009274554fd170b31cf6090236_cobalt-strike_icedid_njrat_satacom.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c if exist "C:\Users\Admin\AppData\Local\Temp\launch-1548-0e58f47d\extracted" rmdir /s /q "C:\Users\Admin\AppData\Local\Temp\launch-1548-0e58f47d\extracted"
  2⤵
  - Executes a command shell one-liner
  PID:1776
- C:\Windows\System32\tar.exe
  "C:\Windows\System32\tar.exe" -xf "C:\Users\Admin\AppData\Local\Temp\launch-1548-0e58f47d\app.zip" -C "C:\Users\Admin\AppData\Local\Temp\launch-1548-0e58f47d\extracted"
  2⤵
  PID:2764
- C:\Users\Admin\AppData\Local\Temp\launch-1548-0e58f47d\extracted\built.exe
  "C:\Users\Admin\AppData\Local\Temp\launch-1548-0e58f47d\extracted\built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4136
- - C:\Users\Admin\AbeOffice\AbeAgent.exe
    "C:\Users\Admin\AbeOffice\AbeAgent.exe"
    3⤵
    - Enumerates VirtualBox registry keys
    - Looks for VMWare services registry key.
    - Executes dropped EXE
    - Maps connected drives based on registry
    - Enumerates system info in registry
    PID:4040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Network Configuration Discovery

1

T1016

Virtualization/Sandbox Evasion

2

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

boot.log

Path C:\Users\Admin\AbeOffice\boot.log
Size 111B
SHA256 ad9bcb0d875b302beb4d9d354098a16cda24fa6ac4cd4f458d0aad908012241b
MD5 183ceab12605f9d8d5962c6c453a0bfe
SHA1 5684565033ed77dda8334d2cdfcb184e29760f41
SHA512 a8f108e74de16c8bb37bf108576ecdb7043011e9d21f0cdd1463aed0122351d820b3997e29996ad81a77635b0154cc607e39d043a325a4d75646fd2ec8cbedab
TLSH
T1EBB0123B62D3053628878E2E17313C481EB460191D30B60077AF0D56B70AC6DE6B218F
MD5 SHA1 SHA512 TLSH

Submit Download

app.zip

Path C:\Users\Admin\AppData\Local\Temp\launch-1548-0e58f47d\app.zip
Size 4.8MB
SHA256 d89b2f9a9aacd2960d8c3744714782eca2089c2a6b551ded09b7c364f0583f02
MD5 542560ca40ec99e1c9c2293a01b0ccda
SHA1 492e748c58919e764fbc252eb3baf3134cd471f8
SHA512 d222ccd0d409a65a7396b117aa4dbe5fa431dc4aa342fcc710d5b4e372237e043aae369b328981b1c9330e28b064e8b2a3fb38548c38593992a424a4a006df99
SSDEEP 98304:QZ2ZuTIFnFww/sEiPELwLpsOAhvJfmTTsMUOCCye+RF4mYtuO/u7tUEdnn1+YogD:QcZuTIFnyw0lbtsOAhBfmXO3Rivk6EdX
TLSH
T1FC363340559F9D29A71C44A8AFB7F264047057CCB1A7FCB29BFAD3178C412EF524ABA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

built.exe

Path C:\Users\Admin\AppData\Local\Temp\launch-1548-0e58f47d\extracted\built.exe
Size 4.9MB
SHA256 51d722321a9d7198d7aff1326e055e26f4632beeebe96fc217ae99c17ef84f2b
MD5 7596a988f14d7a51a48043521f741d0e
SHA1 414550b4b33ccde26a51b4125d22e0c24820acf0
SHA512 a2738c0e8c4f1ccb7b0fe4c215292fc873ff94c8679124c57cf6d6c15ce3b49083e8cdf7bfcdef71e4d66e095d568e0215455f2a0a18a04f2955b90df5ae6ff3
SSDEEP 98304:Ri52Jc1Ir1lQSBs2GnaLWRfs8qnvvTmZ1WkUoAuyeCRHu6UVSOp4BjUcdnRx6AYq:Ri8Jc1Ir1+Sqdb5s8qnXTm/aNRq9QAc+
TLSH
T1C2362321DA9904BDE276C1B4CE739902E67178CE1735ADEF03E496270F126D89A3EF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads