Analysis
- user interaction
yes - max time kernel
148s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
03/05/2026, 14:14
General
- Target Mad-Installer.exe
- Size 13.0MB
- Sample260503-rj96psev4j
- SHA256 2ee90a1ea33cabb04324c4c81fbf5e10324555daa15a5ce1cca057c12e61b096
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Kills process with taskkill 1 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
- Suspicious use of AdjustPrivilegeToken 9 IoCs
- Suspicious use of FindShellTrayWindow 41 IoCs
- Suspicious use of SendNotifyMessage 40 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Mad-Installer.exe"C:\Users\Admin\AppData\Local\Temp\Mad-Installer.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /F /IM Madium.exe /IM Loader.exe >nul 2>&12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /F /IM Madium.exe /IM Loader.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Madium\Bin\Madium.exe"C:\Users\Admin\AppData\Roaming\Madium\Bin\Madium.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.madium.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=5136.5140.100539984748499287813⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.madium.app\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.madium.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ffc53a6b078,0x7ffc53a6b084,0x7ffc53a6b0904⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.madium.app\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1704,i,11719277191223300450,8568317320195132075,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1700 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.madium.app\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2140,i,11719277191223300450,8568317320195132075,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:114⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.madium.app\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2376,i,11719277191223300450,8568317320195132075,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.madium.app\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3588,i,11719277191223300450,8568317320195132075,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:14⤵
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
settings.dat
settings.dat
throttle_store.dat
f_000008
the-real-index
the-real-index
data_0
data_1
data_2
data_3
MANIFEST-000001
Network Persistent State
Network Persistent State~RFe5a2397.TMP
SCT Auditing Pending Reports
Preferences
Preferences~RFe5a2387.TMP
CURRENT
Local State
Local State
Local State
Local State
Local State
Local State~RFe598c96.TMP
Madium.exe
memory/664-214-0x00007FFC73040000-0x00007FFC73041000-memory.dmp
memory/1108-70-0x00007FF774903000-0x00007FF7750EE000-memory.dmp
memory/1108-8-0x00007FF7748B0000-0x00007FF775DE6000-memory.dmp
memory/1108-0-0x00007FF774903000-0x00007FF7750EE000-memory.dmp
memory/1108-63-0x00007FF7748B0000-0x00007FF775DE6000-memory.dmp
memory/1108-62-0x000001B056CA0000-0x000001B056CAC000-memory.dmp
memory/1108-1-0x00007FFC745D0000-0x00007FFC745D2000-memory.dmp
memory/1108-2-0x00007FF7748B0000-0x00007FF775DE6000-memory.dmp
memory/1108-5-0x00007FF7748B0000-0x00007FF775DE6000-memory.dmp
memory/1108-6-0x00007FF774903000-0x00007FF7750EE000-memory.dmp
memory/1108-7-0x000001B056CA0000-0x000001B056CAC000-memory.dmp
memory/2744-30-0x00000289BBDD0000-0x00000289BBDD1000-memory.dmp
memory/2744-35-0x00000289BBDD0000-0x00000289BBDD1000-memory.dmp
memory/2744-23-0x00000289BBDD0000-0x00000289BBDD1000-memory.dmp
memory/2744-24-0x00000289BBDD0000-0x00000289BBDD1000-memory.dmp
memory/2744-25-0x00000289BBDD0000-0x00000289BBDD1000-memory.dmp
memory/2744-34-0x00000289BBDD0000-0x00000289BBDD1000-memory.dmp
memory/2744-33-0x00000289BBDD0000-0x00000289BBDD1000-memory.dmp
memory/2744-32-0x00000289BBDD0000-0x00000289BBDD1000-memory.dmp
memory/2744-31-0x00000289BBDD0000-0x00000289BBDD1000-memory.dmp
memory/2744-29-0x00000289BBDD0000-0x00000289BBDD1000-memory.dmp
memory/4088-90-0x00007FFC73040000-0x00007FFC73041000-memory.dmp