2f7590090c0bbafa403dacffb2d0266be397b8d99b8d2f65118601587038a561

General

Target
2026-10-28_15f293bf9a00dcf42fa43e6790286919_cobalt-strike_icedid_njrat_satacom.exe
Size 174KB
Sample261030-lrjqtsbs21
SHA256 2f7590090c0bbafa403dacffb2d0266be397b8d99b8d2f65118601587038a561
MD5 15f293bf9a00dcf42fa43e6790286919
SHA1 b93c4294a2770ea85ab3f6350c806c47d65b02f4
SHA512 d585e3877f000ec5ab10e71fe791ea5dda2eb5404e622dbcc463f954fdcc83bb287485ec5bda0e5fe624d6f65d728444a46a8e14e1c56d7e618abc420a98ad28
SSDEEP 3072:FEFqes0yCFIEmR6rnEbt29tv2BL8w+mfvzqXCX0lVx4n24EL:FEFqcFIEmRwnEbtnow+Uvs4VEL
TLSH
T1AE046C47B7E520F9E1B7D63889A14606F772B8350B208BEF47A446755F237C09D3AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 4 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	AbeAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	AbeAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService	AbeAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	AbeAgent.exe

Looks for VMWare services registry key. 1 TTPs 4 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse	AbeAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools	AbeAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMMEMCTL	AbeAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	AbeAgent.exe

Executes dropped EXE 2 IoCs

pid	Process
1196	built.exe
4676	AbeAgent.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	AbeAgent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	AbeAgent.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4136	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-28_15f293bf9a00dcf42fa43e6790286919_cobalt-strike_icedid_njrat_satacom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-28_15f293bf9a00dcf42fa43e6790286919_cobalt-strike_icedid_njrat_satacom.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	AbeAgent.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	AbeAgent.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	AbeAgent.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	AbeAgent.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 4136	4228	2026-10-28_15f293bf9a00dcf42fa43e6790286919_cobalt-strike_icedid_njrat_satacom.exe	89
PID 4228 wrote to memory of 2680	4228	2026-10-28_15f293bf9a00dcf42fa43e6790286919_cobalt-strike_icedid_njrat_satacom.exe	91
PID 4228 wrote to memory of 1196	4228	2026-10-28_15f293bf9a00dcf42fa43e6790286919_cobalt-strike_icedid_njrat_satacom.exe	93
PID 1196 wrote to memory of 4676	1196	built.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-10-28_15f293bf9a00dcf42fa43e6790286919_cobalt-strike_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_15f293bf9a00dcf42fa43e6790286919_cobalt-strike_icedid_njrat_satacom.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c if exist "C:\Users\Admin\AppData\Local\Temp\launch-4228-0e599215\extracted" rmdir /s /q "C:\Users\Admin\AppData\Local\Temp\launch-4228-0e599215\extracted"
  2⤵
  - Executes a command shell one-liner
  PID:4136
- C:\Windows\System32\tar.exe
  "C:\Windows\System32\tar.exe" -xf "C:\Users\Admin\AppData\Local\Temp\launch-4228-0e599215\app.zip" -C "C:\Users\Admin\AppData\Local\Temp\launch-4228-0e599215\extracted"
  2⤵
  PID:2680
- C:\Users\Admin\AppData\Local\Temp\launch-4228-0e599215\extracted\built.exe
  "C:\Users\Admin\AppData\Local\Temp\launch-4228-0e599215\extracted\built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1196
- - C:\Users\Admin\AbeOffice\AbeAgent.exe
    "C:\Users\Admin\AbeOffice\AbeAgent.exe"
    3⤵
    - Enumerates VirtualBox registry keys
    - Looks for VMWare services registry key.
    - Executes dropped EXE
    - Maps connected drives based on registry
    - Enumerates system info in registry
    PID:4676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Network Configuration Discovery

1

T1016

Virtualization/Sandbox Evasion

2

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

boot.log

Path C:\Users\Admin\AbeOffice\boot.log
Size 111B
SHA256 ad9bcb0d875b302beb4d9d354098a16cda24fa6ac4cd4f458d0aad908012241b
MD5 183ceab12605f9d8d5962c6c453a0bfe
SHA1 5684565033ed77dda8334d2cdfcb184e29760f41
SHA512 a8f108e74de16c8bb37bf108576ecdb7043011e9d21f0cdd1463aed0122351d820b3997e29996ad81a77635b0154cc607e39d043a325a4d75646fd2ec8cbedab
TLSH
T1EBB0123B62D3053628878E2E17313C481EB460191D30B60077AF0D56B70AC6DE6B218F
MD5 SHA1 SHA512 TLSH

Submit Download

app.zip

Path C:\Users\Admin\AppData\Local\Temp\launch-4228-0e599215\app.zip
Size 4.8MB
SHA256 e707e34e38c96155956434d7ef0faf4b6086e3e9091c60367270e0c9637a5b4b
MD5 364b6c0f8463addc71eb17b5cce65388
SHA1 ba6e9d615bde7a4336d4cbb86cd31514085da582
SHA512 430f5a2eb09c558c35353f9ce5c48ad753adfee828f83e27f03e5ae81643ffbe096689ba2b5de9fd3f2a39701c943af346111a2da6ca23899d95dda37765ef02
SSDEEP 98304:QZ2ZuTIFnFww/sEiPELwLpsOAhvJfmTTsMUOCCye+RF4mYtuO/u7tUEdnn1+YogV:QcZuTIFnyw0lbtsOAhBfmXO3Rivk6Edh
TLSH
T17E36335041AF9D29961C44A89EA6F268057043DCB1ABFCB39BFBD317CC412EF529B790
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

built.exe

Path C:\Users\Admin\AppData\Local\Temp\launch-4228-0e599215\extracted\built.exe
Size 4.9MB
SHA256 51d722321a9d7198d7aff1326e055e26f4632beeebe96fc217ae99c17ef84f2b
MD5 7596a988f14d7a51a48043521f741d0e
SHA1 414550b4b33ccde26a51b4125d22e0c24820acf0
SHA512 a2738c0e8c4f1ccb7b0fe4c215292fc873ff94c8679124c57cf6d6c15ce3b49083e8cdf7bfcdef71e4d66e095d568e0215455f2a0a18a04f2955b90df5ae6ff3
SSDEEP 98304:Ri52Jc1Ir1lQSBs2GnaLWRfs8qnvvTmZ1WkUoAuyeCRHu6UVSOp4BjUcdnRx6AYq:Ri8Jc1Ir1+Sqdb5s8qnXTm/aNRq9QAc+
TLSH
T1C2362321DA9904BDE276C1B4CE739902E67178CE1735ADEF03E496270F126D89A3EF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads