43ee839d68f9b45dc24a3e3c2fad3cba7d5e191cd18bd8bfbbc2a440cc1d5a5e

General

Target
2026-10-28_52568a009274554fd170b31cf6090236_cobalt-strike_icedid_njrat_satacom.exe
Size 174KB
Sample261030-e9c8faaw7n
SHA256 43ee839d68f9b45dc24a3e3c2fad3cba7d5e191cd18bd8bfbbc2a440cc1d5a5e
MD5 52568a009274554fd170b31cf6090236
SHA1 ff41ba0f4693eabd109da261482dcddbccd808be
SHA512 1231414ed1893531d8f599236b07e51a5b008526b7342032f0bf2d829f7df006009416807c7058dbd1e9d8702799af712c1c13e1d6a6be9d28079a94a3ebaf5d
SSDEEP 3072:CEFqes0yCFIEmR6rnEbt29tv2BL8w+mfvzqXCX0lVx4n24a:CEFqcFIEmRwnEbtnow+Uvs4Va
TLSH
T12C046C47B7E520F9E1B7863889A54606F772B8350B308BEF47A446755F237C09D3AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 4 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	AbeAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	AbeAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	AbeAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService	AbeAgent.exe

Looks for VMWare services registry key. 1 TTPs 4 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	AbeAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse	AbeAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools	AbeAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMMEMCTL	AbeAgent.exe

Executes dropped EXE 2 IoCs

pid	Process
244	built.exe
5764	AbeAgent.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	AbeAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	AbeAgent.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2860	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-28_52568a009274554fd170b31cf6090236_cobalt-strike_icedid_njrat_satacom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-28_52568a009274554fd170b31cf6090236_cobalt-strike_icedid_njrat_satacom.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	AbeAgent.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	AbeAgent.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	AbeAgent.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	AbeAgent.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 820 wrote to memory of 2860	820	2026-10-28_52568a009274554fd170b31cf6090236_cobalt-strike_icedid_njrat_satacom.exe	90
PID 820 wrote to memory of 4672	820	2026-10-28_52568a009274554fd170b31cf6090236_cobalt-strike_icedid_njrat_satacom.exe	92
PID 820 wrote to memory of 244	820	2026-10-28_52568a009274554fd170b31cf6090236_cobalt-strike_icedid_njrat_satacom.exe	94
PID 244 wrote to memory of 5764	244	built.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-10-28_52568a009274554fd170b31cf6090236_cobalt-strike_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_52568a009274554fd170b31cf6090236_cobalt-strike_icedid_njrat_satacom.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:820
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c if exist "C:\Users\Admin\AppData\Local\Temp\launch-820-0e59810d\extracted" rmdir /s /q "C:\Users\Admin\AppData\Local\Temp\launch-820-0e59810d\extracted"
  2⤵
  - Executes a command shell one-liner
  PID:2860
- C:\Windows\System32\tar.exe
  "C:\Windows\System32\tar.exe" -xf "C:\Users\Admin\AppData\Local\Temp\launch-820-0e59810d\app.zip" -C "C:\Users\Admin\AppData\Local\Temp\launch-820-0e59810d\extracted"
  2⤵
  PID:4672
- C:\Users\Admin\AppData\Local\Temp\launch-820-0e59810d\extracted\built.exe
  "C:\Users\Admin\AppData\Local\Temp\launch-820-0e59810d\extracted\built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:244
- - C:\Users\Admin\AbeOffice\AbeAgent.exe
    "C:\Users\Admin\AbeOffice\AbeAgent.exe"
    3⤵
    - Enumerates VirtualBox registry keys
    - Looks for VMWare services registry key.
    - Executes dropped EXE
    - Maps connected drives based on registry
    - Enumerates system info in registry
    PID:5764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Network Configuration Discovery

1

T1016

Virtualization/Sandbox Evasion

2

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

boot.log

Path C:\Users\Admin\AbeOffice\boot.log
Size 111B
SHA256 ad9bcb0d875b302beb4d9d354098a16cda24fa6ac4cd4f458d0aad908012241b
MD5 183ceab12605f9d8d5962c6c453a0bfe
SHA1 5684565033ed77dda8334d2cdfcb184e29760f41
SHA512 a8f108e74de16c8bb37bf108576ecdb7043011e9d21f0cdd1463aed0122351d820b3997e29996ad81a77635b0154cc607e39d043a325a4d75646fd2ec8cbedab
TLSH
T1EBB0123B62D3053628878E2E17313C481EB460191D30B60077AF0D56B70AC6DE6B218F
MD5 SHA1 SHA512 TLSH

Submit Download

boot.log

Path C:\Users\Admin\AbeOffice\boot.log
Size 268B
SHA256 65baf3729221999f5e164edd20b5e8be1ec619ab4cf5ab82c173bc111cef9c0f
MD5 4068cd6a8d34b5d2c54a6c3c437a37f9
SHA1 99e3b937be1dbe42876c1952f2b55a8a170a5c70
SHA512 06666325da1d460a438990c9c0002ce3c3f7a61b04b07985074524c77ef133cf393861748694e7ae55a7757df033c9229679cc64c3dbbe397d79c073e324d4ef
TLSH
T1A9D02B1732D14B3A18A24F85D23327C06DD0E2280531A40837AF8D5D9B0AC78956619E
MD5 SHA1 SHA512 TLSH

Submit Download

app.zip

Path C:\Users\Admin\AppData\Local\Temp\launch-820-0e59810d\app.zip
Size 4.8MB
SHA256 6238af37d2ab966c1cc93c3e38cc975feb2d0ca98a0699106c6cc8741c47e0dd
MD5 ac1bbe7e0bcda7138f41a7de4a1b270e
SHA1 92965e02062408f06e42988427d0cc6626f525d8
SHA512 cf67375aae6d67528d4596710a2472f7220fd2c5124b1388b89ba8f21a51879fed5847b2057058a75d2b57adfad7bc32cd43e002f6ee7931cc056542e3fd65f5
SSDEEP 98304:QZ2ZuTIFnFww/sEiPELwLpsOAhvJfmTTsMUOCCye+RF4mYtuO/u7tUEdnn1+Yog0:QcZuTIFnyw0lbtsOAhBfmXO3Rivk6EdY
TLSH
T13F363350929F9D29560C44A8AFBAF368056053DCB1A7FCB2DBFAD317CC401EF525A7A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

built.exe

Path C:\Users\Admin\AppData\Local\Temp\launch-820-0e59810d\extracted\built.exe
Size 4.9MB
SHA256 51d722321a9d7198d7aff1326e055e26f4632beeebe96fc217ae99c17ef84f2b
MD5 7596a988f14d7a51a48043521f741d0e
SHA1 414550b4b33ccde26a51b4125d22e0c24820acf0
SHA512 a2738c0e8c4f1ccb7b0fe4c215292fc873ff94c8679124c57cf6d6c15ce3b49083e8cdf7bfcdef71e4d66e095d568e0215455f2a0a18a04f2955b90df5ae6ff3
SSDEEP 98304:Ri52Jc1Ir1lQSBs2GnaLWRfs8qnvvTmZ1WkUoAuyeCRHu6UVSOp4BjUcdnRx6AYq:Ri8Jc1Ir1+Sqdb5s8qnXTm/aNRq9QAc+
TLSH
T1C2362321DA9904BDE276C1B4CE739902E67178CE1735ADEF03E496270F126D89A3EF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads