Analysis
- max time kernel
149s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
04/08/2026, 14:13
General
- Target Installer-1.0.6.exe
- Size 12.0MB
- Sample260804-rjfbbssdpc
- SHA256 37bf42ea69b77a3d13426f3c271bd51e0f32d58a0ad6d05b3fe90f66605837bf
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Installer-1.0.6.exe"C:\Users\Admin\AppData\Local\Temp\Installer-1.0.6.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File bootstrap.ps12⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-18bb5e214d564c1b8e2f7d933412f400\MadiumInstaller.exe"C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-18bb5e214d564c1b8e2f7d933412f400\MadiumInstaller.exe" --from-sfx --first-install3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Madium\Installer\MadiumInstaller.exeC:\Users\Admin\AppData\Local\Madium\Installer\MadiumInstaller.exe --installed4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
bootstrap.ps1
payload.zip
MadiumInstaller.exe
MadiumInstaller.exp
MadiumInstaller.lib
bitsdojo_window_windows_plugin.lib
app.so
AssetManifest.bin
FontManifest.json
NOTICES.Z
NativeAssetsManifest.json
MaterialIcons-Regular.otf
ink_sparkle.frag
stretch_effect.frag
icudtl.dat
flutter_windows.dll
memory/1396-6-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
memory/1396-26-0x000001B324400000-0x000001B3244B2000-memory.dmp
memory/1396-27-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
memory/1396-25-0x000001B3243E0000-0x000001B3243FE000-memory.dmp
memory/1396-28-0x000001B3241C0000-0x000001B3241CA000-memory.dmp
memory/1396-21-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
memory/1396-30-0x000001B3241C0000-0x000001B3241CA000-memory.dmp
memory/1396-29-0x000001B3243E0000-0x000001B3243F2000-memory.dmp
memory/1396-20-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
memory/1396-4-0x00007FFEB9E9F000-0x00007FFEB9EA0000-memory.dmp
memory/1396-19-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
memory/1396-108-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
memory/1396-18-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
memory/1396-17-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
memory/1396-107-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
memory/1396-106-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
memory/1396-96-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
memory/1396-94-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
memory/1396-5-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
memory/1396-22-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
memory/1396-15-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
memory/1396-14-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
memory/1396-13-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
memory/1396-12-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
memory/1396-11-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
memory/1396-10-0x00007FFEB9D10000-0x00007FFEBA6B4000-memory.dmp
memory/1396-7-0x000001B323DC0000-0x000001B323DE2000-memory.dmp
memory/3724-73-0x0000018660FD0000-0x0000018660FD1000-memory.dmp
memory/3724-75-0x0000018664830000-0x0000018664D89000-memory.dmp
memory/3724-76-0x0000018664830000-0x0000018664D89000-memory.dmp
memory/3724-77-0x0000018660FE0000-0x0000018660FE1000-memory.dmp
memory/3724-74-0x0000018664830000-0x0000018664D89000-memory.dmp
memory/3724-81-0x0000018664780000-0x0000018664800000-memory.dmp
memory/3724-80-0x0000018664780000-0x0000018664800000-memory.dmp
memory/5784-104-0x0000019252A00000-0x0000019252A80000-memory.dmp
memory/5784-103-0x0000019252A00000-0x0000019252A80000-memory.dmp