Analysis
- user interaction
yes - max time kernel
0s - max time network
9s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
04/08/2026, 16:25
General
- Target Installer-1.0.6.exe
- Size 12.0MB
- Sample260804-txc48svcpf
- SHA256 37bf42ea69b77a3d13426f3c271bd51e0f32d58a0ad6d05b3fe90f66605837bf
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Installer-1.0.6.exe"C:\Users\Admin\AppData\Local\Temp\Installer-1.0.6.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File bootstrap.ps12⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-9cad598d1ad947539fa0ce9d888cd568\MadiumInstaller.exe"C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-9cad598d1ad947539fa0ce9d888cd568\MadiumInstaller.exe" --from-sfx --first-install3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
MadiumInstaller.exp
MadiumInstaller.lib
AssetManifest.bin
FontManifest.json
NOTICES.Z
MaterialIcons-Regular.otf
ink_sparkle.frag
stretch_effect.frag
flutter_windows.dll
bootstrap.ps1
payload.zip
MadiumInstaller.exe
bitsdojo_window_windows_plugin.lib
app.so
NativeAssetsManifest.json
icudtl.dat
flutter_windows.dll
flutter_windows.dll
__PSScriptPolicyTest_mebsckjr.fem.ps1
memory/2212-69-0x0000020119E80000-0x0000020119F00000-memory.dmp
memory/2212-63-0x0000020119F60000-0x000002011A4B9000-memory.dmp
memory/2212-64-0x0000020119F60000-0x000002011A4B9000-memory.dmp
memory/2212-70-0x0000020119E80000-0x0000020119F00000-memory.dmp
memory/2212-65-0x0000020119F60000-0x000002011A4B9000-memory.dmp
memory/2212-62-0x0000020119D60000-0x0000020119D61000-memory.dmp
memory/2212-66-0x0000020119D70000-0x0000020119D71000-memory.dmp
memory/3300-16-0x000001D61A5C0000-0x000001D61A5D2000-memory.dmp
memory/3300-15-0x000001D61A5F0000-0x000001D61A600000-memory.dmp
memory/3300-17-0x000001D6023E0000-0x000001D6023EA000-memory.dmp
memory/3300-11-0x000001D61A510000-0x000001D61A532000-memory.dmp
memory/3300-5-0x000001D61A5F0000-0x000001D61A600000-memory.dmp
memory/3300-4-0x000001D61A5F0000-0x000001D61A600000-memory.dmp
memory/3300-135-0x000001D61A5F0000-0x000001D61A600000-memory.dmp
memory/3300-136-0x000001D61A5F0000-0x000001D61A600000-memory.dmp
memory/3300-137-0x000001D61A5F0000-0x000001D61A600000-memory.dmp