2f7590090c0bbafa403dacffb2d0266be397b8d99b8d2f65118601587038a561

General

Target
2026-10-28_15f293bf9a00dcf42fa43e6790286919_cobalt-strike_icedid_njrat_satacom.exe
Size 174KB
Sample261030-lrjqtsbs21
SHA256 2f7590090c0bbafa403dacffb2d0266be397b8d99b8d2f65118601587038a561
MD5 15f293bf9a00dcf42fa43e6790286919
SHA1 b93c4294a2770ea85ab3f6350c806c47d65b02f4
SHA512 d585e3877f000ec5ab10e71fe791ea5dda2eb5404e622dbcc463f954fdcc83bb287485ec5bda0e5fe624d6f65d728444a46a8e14e1c56d7e618abc420a98ad28
SSDEEP 3072:FEFqes0yCFIEmR6rnEbt29tv2BL8w+mfvzqXCX0lVx4n24EL:FEFqcFIEmRwnEbtnow+Uvs4VEL
TLSH
T1AE046C47B7E520F9E1B7D63889A14606F772B8350B208BEF47A446755F237C09D3AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 4 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	AbeAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	AbeAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService	AbeAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	AbeAgent.exe

Looks for VMWare services registry key. 1 TTPs 4 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse	AbeAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools	AbeAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMMEMCTL	AbeAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	AbeAgent.exe

Executes dropped EXE 2 IoCs

pid	Process
6092	built.exe
4964	AbeAgent.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	AbeAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	AbeAgent.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5732	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-28_15f293bf9a00dcf42fa43e6790286919_cobalt-strike_icedid_njrat_satacom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-28_15f293bf9a00dcf42fa43e6790286919_cobalt-strike_icedid_njrat_satacom.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	AbeAgent.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	AbeAgent.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	AbeAgent.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	AbeAgent.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 936 wrote to memory of 5732	936	2026-10-28_15f293bf9a00dcf42fa43e6790286919_cobalt-strike_icedid_njrat_satacom.exe	86
PID 936 wrote to memory of 5712	936	2026-10-28_15f293bf9a00dcf42fa43e6790286919_cobalt-strike_icedid_njrat_satacom.exe	88
PID 936 wrote to memory of 6092	936	2026-10-28_15f293bf9a00dcf42fa43e6790286919_cobalt-strike_icedid_njrat_satacom.exe	90
PID 6092 wrote to memory of 4964	6092	built.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-10-28_15f293bf9a00dcf42fa43e6790286919_cobalt-strike_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_15f293bf9a00dcf42fa43e6790286919_cobalt-strike_icedid_njrat_satacom.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:936
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c if exist "C:\Users\Admin\AppData\Local\Temp\launch-936-0e58a2a4\extracted" rmdir /s /q "C:\Users\Admin\AppData\Local\Temp\launch-936-0e58a2a4\extracted"
  2⤵
  - Executes a command shell one-liner
  PID:5732
- C:\Windows\System32\tar.exe
  "C:\Windows\System32\tar.exe" -xf "C:\Users\Admin\AppData\Local\Temp\launch-936-0e58a2a4\app.zip" -C "C:\Users\Admin\AppData\Local\Temp\launch-936-0e58a2a4\extracted"
  2⤵
  PID:5712
- C:\Users\Admin\AppData\Local\Temp\launch-936-0e58a2a4\extracted\built.exe
  "C:\Users\Admin\AppData\Local\Temp\launch-936-0e58a2a4\extracted\built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:6092
- - C:\Users\Admin\AbeOffice\AbeAgent.exe
    "C:\Users\Admin\AbeOffice\AbeAgent.exe"
    3⤵
    - Enumerates VirtualBox registry keys
    - Looks for VMWare services registry key.
    - Executes dropped EXE
    - Maps connected drives based on registry
    - Enumerates system info in registry
    PID:4964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Network Configuration Discovery

1

T1016

Virtualization/Sandbox Evasion

2

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

boot.log

Path C:\Users\Admin\AbeOffice\boot.log
Size 111B
SHA256 ad9bcb0d875b302beb4d9d354098a16cda24fa6ac4cd4f458d0aad908012241b
MD5 183ceab12605f9d8d5962c6c453a0bfe
SHA1 5684565033ed77dda8334d2cdfcb184e29760f41
SHA512 a8f108e74de16c8bb37bf108576ecdb7043011e9d21f0cdd1463aed0122351d820b3997e29996ad81a77635b0154cc607e39d043a325a4d75646fd2ec8cbedab
TLSH
T1EBB0123B62D3053628878E2E17313C481EB460191D30B60077AF0D56B70AC6DE6B218F
MD5 SHA1 SHA512 TLSH

Submit Download

boot.log

Path C:\Users\Admin\AbeOffice\boot.log
Size 268B
SHA256 65baf3729221999f5e164edd20b5e8be1ec619ab4cf5ab82c173bc111cef9c0f
MD5 4068cd6a8d34b5d2c54a6c3c437a37f9
SHA1 99e3b937be1dbe42876c1952f2b55a8a170a5c70
SHA512 06666325da1d460a438990c9c0002ce3c3f7a61b04b07985074524c77ef133cf393861748694e7ae55a7757df033c9229679cc64c3dbbe397d79c073e324d4ef
TLSH
T1A9D02B1732D14B3A18A24F85D23327C06DD0E2280531A40837AF8D5D9B0AC78956619E
MD5 SHA1 SHA512 TLSH

Submit Download

app.zip

Path C:\Users\Admin\AppData\Local\Temp\launch-936-0e58a2a4\app.zip
Size 4.8MB
SHA256 c07d5dd69a3ce70bc14254aa6d87315a1d868b33167a5837fbc33dde27b44b38
MD5 a4e364b10ad0cfd3191d7bebe6b99060
SHA1 6d92ed3b60adff33b8965c8937d2e1769921ea70
SHA512 03c4c4aab4c7ea3b030ba979d9504a6a500f56b2236d350f2a39033a8735498d86d4278126e23f6d1422c73386dc60ce50197654594439b5e8a0c3d593e1e934
SSDEEP 98304:QZ2ZuTIFnFww/sEiPELwLpsOAhvJfmTTsMUOCCye+RF4mYtuO/u7tUEdnn1+Yogz:QcZuTIFnyw0lbtsOAhBfmXO3Rivk6Edn
TLSH
T11136335055AF9D29A71C44A49F7BF264047057CCB2A7FCB28BFAD3178C412EF524ABA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

built.exe

Path C:\Users\Admin\AppData\Local\Temp\launch-936-0e58a2a4\extracted\built.exe
Size 4.9MB
SHA256 51d722321a9d7198d7aff1326e055e26f4632beeebe96fc217ae99c17ef84f2b
MD5 7596a988f14d7a51a48043521f741d0e
SHA1 414550b4b33ccde26a51b4125d22e0c24820acf0
SHA512 a2738c0e8c4f1ccb7b0fe4c215292fc873ff94c8679124c57cf6d6c15ce3b49083e8cdf7bfcdef71e4d66e095d568e0215455f2a0a18a04f2955b90df5ae6ff3
SSDEEP 98304:Ri52Jc1Ir1lQSBs2GnaLWRfs8qnvvTmZ1WkUoAuyeCRHu6UVSOp4BjUcdnRx6AYq:Ri8Jc1Ir1+Sqdb5s8qnXTm/aNRq9QAc+
TLSH
T1C2362321DA9904BDE276C1B4CE739902E67178CE1735ADEF03E496270F126D89A3EF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads