Analysis
- user interaction
yes - max time kernel
234s - max time network
238s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
- submitted
04/08/2026, 14:13
General
- Target Installer-1.0.6.exe
- Size 12.0MB
- Sample260804-rjfbbssdpc
- SHA256 37bf42ea69b77a3d13426f3c271bd51e0f32d58a0ad6d05b3fe90f66605837bf
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Modifies registry key 1 TTPs 7 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 23 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Installer-1.0.6.exe"C:\Users\Admin\AppData\Local\Temp\Installer-1.0.6.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File bootstrap.ps12⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-4d2f4465aaa8472d98ab94abf477b9a1\MadiumInstaller.exe"C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-4d2f4465aaa8472d98ab94abf477b9a1\MadiumInstaller.exe" --from-sfx --first-install3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Madium\Installer\MadiumInstaller.exeC:\Users\Admin\AppData\Local\Madium\Installer\MadiumInstaller.exe --installed4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Stop'; if ($null -eq (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue)) { exit 0 }; $status=Get-MpComputerStatus -ErrorAction SilentlyContinue; if ($null -eq $status -or $status.AntivirusEnabled -ne $true) { exit 0 }; $p='C:\Users\Admin\AppData\Local\Madium'.TrimEnd('\'); $current=@((Get-MpPreference -ErrorAction Stop).ExclusionPath); $has=@($current | Where-Object { $_ -and $_.TrimEnd('\') -ieq $p }).Count -gt 0; if (-not $has) { Add-MpPreference -ExclusionPath $p -ErrorAction Stop; $current=@((Get-MpPreference -ErrorAction Stop).ExclusionPath); $has=@($current | Where-Object { $_ -and $_.TrimEnd('\') -ieq $p }).Count -gt 0; if (-not $has) { throw 'Defender did not save the exclusion.' } }"5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\dotnet\dotnet.exedotnet.exe --list-runtimes5⤵
- System Time Discovery
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x64 /v Installed5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query HKLM\SOFTWARE\WOW6432Node\Microsoft\VisualStudio\14.0\VC\Runtimes\x64 /v Installed5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x86 /v Installed5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query HKLM\SOFTWARE\WOW6432Node\Microsoft\VisualStudio\14.0\VC\Runtimes\x86 /v Installed5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query HKLM\SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5} /v pv5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query HKLM\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5} /v pv5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query HKCU\Software\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5} /v pv5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query "HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" /v Release5⤵
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Madium.exe.download
ModuleAnalysisCache
bootstrap.ps1
payload.zip
MadiumInstaller.exe
MadiumInstaller.exp
MadiumInstaller.lib
bitsdojo_window_windows_plugin.lib
app.so
AssetManifest.bin
FontManifest.json
NOTICES.Z
NativeAssetsManifest.json
MaterialIcons-Regular.otf
ink_sparkle.frag
stretch_effect.frag
icudtl.dat
flutter_windows.dll
__PSScriptPolicyTest_qbm4u0bq.ci0.ps1
memory/564-72-0x000002118FF80000-0x0000021190000000-memory.dmp
memory/564-67-0x000002118F9E0000-0x000002118FF39000-memory.dmp
memory/564-65-0x000002118C220000-0x000002118C221000-memory.dmp
memory/564-73-0x000002118FF80000-0x0000021190000000-memory.dmp
memory/564-68-0x000002118F9E0000-0x000002118FF39000-memory.dmp
memory/564-66-0x000002118F9E0000-0x000002118FF39000-memory.dmp
memory/564-69-0x000002118C230000-0x000002118C231000-memory.dmp
memory/2660-16-0x000001A6BD960000-0x000001A6BD972000-memory.dmp
memory/2660-4-0x000001A6BA990000-0x000001A6BA9A0000-memory.dmp
memory/2660-14-0x000001A6BA990000-0x000001A6BA9A0000-memory.dmp
memory/2660-13-0x000001A6BA950000-0x000001A6BA972000-memory.dmp
memory/2660-97-0x000001A6BA990000-0x000001A6BA9A0000-memory.dmp
memory/2660-96-0x000001A6BA990000-0x000001A6BA9A0000-memory.dmp
memory/2660-99-0x000001A6BA990000-0x000001A6BA9A0000-memory.dmp
memory/2660-17-0x000001A6BA940000-0x000001A6BA94A000-memory.dmp
memory/2660-5-0x000001A6BA990000-0x000001A6BA9A0000-memory.dmp
memory/4884-93-0x00000191ED600000-0x00000191ED680000-memory.dmp
memory/4884-94-0x00000191ED600000-0x00000191ED680000-memory.dmp