d794df6633806fbadd683848ebe01cdc92ad706135dcf8ea79318bac7091c8ad

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/05/2026, 18:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MelonaiumInstaller.exe
Size 46KB
Sample260509-xc563ab16y
SHA256 d794df6633806fbadd683848ebe01cdc92ad706135dcf8ea79318bac7091c8ad
MD5 0f44e22db263a58fb750c6e254107fc6
SHA1 e86804c16c8d72009e6184c1d93bd6f2fc1cfcfe
SHA512 55e675ae09369ee78981c40ad3ee304966d40ddb2802b0bf3605417626950a0ccb70515636c9aafa96625e940f94f51683225f096ab9a0633d6c020e1e7c0ff7
SSDEEP 768:6gB1lRESkPCFls8livPsVbk47mbEYAyxKmPVBUiJZgsXR8CO:6qlRTICFMUVbk47+EYAY/XeCO
TLSH
T1FE231A1BB6A540ECD876C2F8D7B36A52E7B6F8094F2067CF0350D0960F666C19D7A722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 22 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
552	powershell.exe
3048	powershell.exe
512	powershell.exe
5904	powershell.exe
5300	powershell.exe
3328	powershell.exe
5280	powershell.exe
2144	powershell.exe
1240	powershell.exe
3204	powershell.exe
4928	powershell.exe
4064	powershell.exe
4488	powershell.exe
6048	powershell.exe
3096	powershell.exe
5592	powershell.exe
3868	powershell.exe
2488	powershell.exe
3132	powershell.exe
5640	powershell.exe
2496	powershell.exe
2008	powershell.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
552	powershell.exe
552	powershell.exe
2488	powershell.exe
2488	powershell.exe
2144	powershell.exe
2144	powershell.exe
3048	powershell.exe
3048	powershell.exe
3132	powershell.exe
3132	powershell.exe
6048	powershell.exe
6048	powershell.exe
1240	powershell.exe
1240	powershell.exe
3204	powershell.exe
3204	powershell.exe
512	powershell.exe
512	powershell.exe
5904	powershell.exe
5904	powershell.exe
5300	powershell.exe
5300	powershell.exe
3096	powershell.exe
3096	powershell.exe
4928	powershell.exe
4928	powershell.exe
4064	powershell.exe
4064	powershell.exe
5640	powershell.exe
5640	powershell.exe
5592	powershell.exe
5592	powershell.exe
3328	powershell.exe
3328	powershell.exe
3868	powershell.exe
3868	powershell.exe
2496	powershell.exe
2496	powershell.exe
5280	powershell.exe
5280	powershell.exe
2008	powershell.exe
2008	powershell.exe
4488	powershell.exe
4488	powershell.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	552	powershell.exe
Token: SeDebugPrivilege	2488	powershell.exe
Token: SeDebugPrivilege	2144	powershell.exe
Token: SeDebugPrivilege	3048	powershell.exe
Token: SeDebugPrivilege	3132	powershell.exe
Token: SeDebugPrivilege	6048	powershell.exe
Token: SeDebugPrivilege	1240	powershell.exe
Token: SeDebugPrivilege	3204	powershell.exe
Token: SeDebugPrivilege	512	powershell.exe
Token: SeDebugPrivilege	5904	powershell.exe
Token: SeDebugPrivilege	5300	powershell.exe
Token: SeDebugPrivilege	3096	powershell.exe
Token: SeDebugPrivilege	4928	powershell.exe
Token: SeDebugPrivilege	4064	powershell.exe
Token: SeDebugPrivilege	5640	powershell.exe
Token: SeDebugPrivilege	5592	powershell.exe
Token: SeDebugPrivilege	3328	powershell.exe
Token: SeDebugPrivilege	3868	powershell.exe
Token: SeDebugPrivilege	2496	powershell.exe
Token: SeDebugPrivilege	5280	powershell.exe
Token: SeDebugPrivilege	2008	powershell.exe
Token: SeDebugPrivilege	4488	powershell.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 552	4872	MelonaiumInstaller.exe	88
PID 4872 wrote to memory of 2488	4872	MelonaiumInstaller.exe	93
PID 4872 wrote to memory of 2144	4872	MelonaiumInstaller.exe	95
PID 4872 wrote to memory of 3048	4872	MelonaiumInstaller.exe	97
PID 4872 wrote to memory of 3132	4872	MelonaiumInstaller.exe	100
PID 4872 wrote to memory of 6048	4872	MelonaiumInstaller.exe	103
PID 4872 wrote to memory of 1240	4872	MelonaiumInstaller.exe	105
PID 4872 wrote to memory of 3204	4872	MelonaiumInstaller.exe	107
PID 4872 wrote to memory of 512	4872	MelonaiumInstaller.exe	109
PID 4872 wrote to memory of 5904	4872	MelonaiumInstaller.exe	111
PID 4872 wrote to memory of 5300	4872	MelonaiumInstaller.exe	113
PID 4872 wrote to memory of 3096	4872	MelonaiumInstaller.exe	115
PID 4872 wrote to memory of 4928	4872	MelonaiumInstaller.exe	117
PID 4872 wrote to memory of 4064	4872	MelonaiumInstaller.exe	119
PID 4872 wrote to memory of 5640	4872	MelonaiumInstaller.exe	121
PID 4872 wrote to memory of 5592	4872	MelonaiumInstaller.exe	123
PID 4872 wrote to memory of 3328	4872	MelonaiumInstaller.exe	125
PID 4872 wrote to memory of 3868	4872	MelonaiumInstaller.exe	127
PID 4872 wrote to memory of 2496	4872	MelonaiumInstaller.exe	129
PID 4872 wrote to memory of 5280	4872	MelonaiumInstaller.exe	131
PID 4872 wrote to memory of 2008	4872	MelonaiumInstaller.exe	133
PID 4872 wrote to memory of 4488	4872	MelonaiumInstaller.exe	135

C:\Users\Admin\AppData\Local\Temp\MelonaiumInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\MelonaiumInstaller.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2488
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2144
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5592
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2496
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...