d794df6633806fbadd683848ebe01cdc92ad706135dcf8ea79318bac7091c8ad

Analysis

max time kernel
148s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/05/2026, 18:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MelonaiumInstaller.exe
Size 46KB
Sample260509-xc563ab16y
SHA256 d794df6633806fbadd683848ebe01cdc92ad706135dcf8ea79318bac7091c8ad
MD5 0f44e22db263a58fb750c6e254107fc6
SHA1 e86804c16c8d72009e6184c1d93bd6f2fc1cfcfe
SHA512 55e675ae09369ee78981c40ad3ee304966d40ddb2802b0bf3605417626950a0ccb70515636c9aafa96625e940f94f51683225f096ab9a0633d6c020e1e7c0ff7
SSDEEP 768:6gB1lRESkPCFls8livPsVbk47mbEYAyxKmPVBUiJZgsXR8CO:6qlRTICFMUVbk47+EYAY/XeCO
TLSH
T1FE231A1BB6A540ECD876C2F8D7B36A52E7B6F8094F2067CF0350D0960F666C19D7A722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 22 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3464	powershell.exe
2064	powershell.exe
3904	powershell.exe
2040	powershell.exe
2512	powershell.exe
3932	powershell.exe
6000	powershell.exe
1276	powershell.exe
5260	powershell.exe
5920	powershell.exe
2464	powershell.exe
4140	powershell.exe
5612	powershell.exe
2464	powershell.exe
4672	powershell.exe
6048	powershell.exe
3176	powershell.exe
4188	powershell.exe
4584	powershell.exe
4116	powershell.exe
2964	powershell.exe
4696	powershell.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
4584	powershell.exe
4584	powershell.exe
4140	powershell.exe
4140	powershell.exe
4116	powershell.exe
4116	powershell.exe
3464	powershell.exe
3464	powershell.exe
3932	powershell.exe
3932	powershell.exe
5612	powershell.exe
5612	powershell.exe
2464	powershell.exe
2464	powershell.exe
4672	powershell.exe
4672	powershell.exe
6048	powershell.exe
6048	powershell.exe
2064	powershell.exe
2064	powershell.exe
6000	powershell.exe
6000	powershell.exe
3176	powershell.exe
3176	powershell.exe
1276	powershell.exe
1276	powershell.exe
2964	powershell.exe
2964	powershell.exe
3904	powershell.exe
3904	powershell.exe
2040	powershell.exe
2040	powershell.exe
4188	powershell.exe
4188	powershell.exe
5260	powershell.exe
5260	powershell.exe
4696	powershell.exe
4696	powershell.exe
2512	powershell.exe
2512	powershell.exe
5920	powershell.exe
5920	powershell.exe
2464	powershell.exe
2464	powershell.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	4584	powershell.exe
Token: SeDebugPrivilege	4140	powershell.exe
Token: SeDebugPrivilege	4116	powershell.exe
Token: SeDebugPrivilege	3464	powershell.exe
Token: SeDebugPrivilege	3932	powershell.exe
Token: SeDebugPrivilege	5612	powershell.exe
Token: SeDebugPrivilege	2464	powershell.exe
Token: SeDebugPrivilege	4672	powershell.exe
Token: SeDebugPrivilege	6048	powershell.exe
Token: SeDebugPrivilege	2064	powershell.exe
Token: SeDebugPrivilege	6000	powershell.exe
Token: SeDebugPrivilege	3176	powershell.exe
Token: SeDebugPrivilege	1276	powershell.exe
Token: SeDebugPrivilege	2964	powershell.exe
Token: SeDebugPrivilege	3904	powershell.exe
Token: SeDebugPrivilege	2040	powershell.exe
Token: SeDebugPrivilege	4188	powershell.exe
Token: SeDebugPrivilege	5260	powershell.exe
Token: SeDebugPrivilege	4696	powershell.exe
Token: SeDebugPrivilege	2512	powershell.exe
Token: SeDebugPrivilege	5920	powershell.exe
Token: SeDebugPrivilege	2464	powershell.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 4584	2268	MelonaiumInstaller.exe	79
PID 2268 wrote to memory of 4140	2268	MelonaiumInstaller.exe	81
PID 2268 wrote to memory of 4116	2268	MelonaiumInstaller.exe	83
PID 2268 wrote to memory of 3464	2268	MelonaiumInstaller.exe	85
PID 2268 wrote to memory of 3932	2268	MelonaiumInstaller.exe	87
PID 2268 wrote to memory of 5612	2268	MelonaiumInstaller.exe	89
PID 2268 wrote to memory of 2464	2268	MelonaiumInstaller.exe	91
PID 2268 wrote to memory of 4672	2268	MelonaiumInstaller.exe	93
PID 2268 wrote to memory of 6048	2268	MelonaiumInstaller.exe	95
PID 2268 wrote to memory of 2064	2268	MelonaiumInstaller.exe	97
PID 2268 wrote to memory of 6000	2268	MelonaiumInstaller.exe	99
PID 2268 wrote to memory of 3176	2268	MelonaiumInstaller.exe	101
PID 2268 wrote to memory of 1276	2268	MelonaiumInstaller.exe	103
PID 2268 wrote to memory of 2964	2268	MelonaiumInstaller.exe	105
PID 2268 wrote to memory of 3904	2268	MelonaiumInstaller.exe	107
PID 2268 wrote to memory of 2040	2268	MelonaiumInstaller.exe	109
PID 2268 wrote to memory of 4188	2268	MelonaiumInstaller.exe	111
PID 2268 wrote to memory of 5260	2268	MelonaiumInstaller.exe	113
PID 2268 wrote to memory of 4696	2268	MelonaiumInstaller.exe	115
PID 2268 wrote to memory of 2512	2268	MelonaiumInstaller.exe	117
PID 2268 wrote to memory of 5920	2268	MelonaiumInstaller.exe	119
PID 2268 wrote to memory of 2464	2268	MelonaiumInstaller.exe	121

C:\Users\Admin\AppData\Local\Temp\MelonaiumInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\MelonaiumInstaller.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3176
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4188
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5260
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\MelonaiumPatch'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...