Analysis
- user interaction
yes - max time kernel
148s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
05/08/2026, 13:59
General
- Target Installer-1.0.6.exe
- Size 12.0MB
- Sample260805-ramdaattaz
- SHA256 37bf42ea69b77a3d13426f3c271bd51e0f32d58a0ad6d05b3fe90f66605837bf
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Installer-1.0.6.exe"C:\Users\Admin\AppData\Local\Temp\Installer-1.0.6.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File bootstrap.ps12⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-8bb5fbf3d6784b4dae63aeb4f658c27b\MadiumInstaller.exe"C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-8bb5fbf3d6784b4dae63aeb4f658c27b\MadiumInstaller.exe" --from-sfx --first-install3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
bitsdojo_window_windows_plugin.lib
AssetManifest.bin
NOTICES.Z
ink_sparkle.frag
bootstrap.ps1
payload.zip
MadiumInstaller.exe
MadiumInstaller.exp
MadiumInstaller.lib
app.so
FontManifest.json
NativeAssetsManifest.json
MaterialIcons-Regular.otf
stretch_effect.frag
icudtl.dat
flutter_windows.dll
__PSScriptPolicyTest_vch2pyxb.m20.ps1
memory/736-62-0x000001B30AB20000-0x000001B30AB21000-memory.dmp
memory/736-66-0x000001B30AB30000-0x000001B30AB31000-memory.dmp
memory/736-64-0x000001B30AB80000-0x000001B30B0D9000-memory.dmp
memory/736-65-0x000001B30AB80000-0x000001B30B0D9000-memory.dmp
memory/736-63-0x000001B30AB80000-0x000001B30B0D9000-memory.dmp
memory/736-69-0x000001B30B200000-0x000001B30B280000-memory.dmp
memory/736-70-0x000001B30B200000-0x000001B30B280000-memory.dmp
memory/1148-4-0x000001B8C93B0000-0x000001B8C93C0000-memory.dmp
memory/1148-15-0x000001B8C93B0000-0x000001B8C93C0000-memory.dmp
memory/1148-13-0x000001B8E3690000-0x000001B8E36B2000-memory.dmp
memory/1148-16-0x000001B8E3920000-0x000001B8E3932000-memory.dmp
memory/1148-17-0x000001B8E3910000-0x000001B8E391A000-memory.dmp
memory/1148-5-0x000001B8C93B0000-0x000001B8C93C0000-memory.dmp
memory/1148-135-0x000001B8C93B0000-0x000001B8C93C0000-memory.dmp
memory/1148-136-0x000001B8C93B0000-0x000001B8C93C0000-memory.dmp
memory/1148-138-0x000001B8C93B0000-0x000001B8C93C0000-memory.dmp