Analysis
- user interaction
yes - max time kernel
77s - max time network
78s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
10/08/2026, 08:53
General
- Target Installer-1.0.7.exe
- Size 9.8MB
- Sample260810-ktrnsaej7s
- SHA256 48f359326787a848b89d838a318d797c51fd7feeeee602fff5f46b9d3f7b53ce
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Installer-1.0.7.exe"C:\Users\Admin\AppData\Local\Temp\Installer-1.0.7.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-EA7A0AED-4D66-43AD-8609-EC12727725E5\MadiumInstaller.exe"C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-EA7A0AED-4D66-43AD-8609-EC12727725E5\MadiumInstaller.exe" --from-sfx --first-install2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Stop'; if ($null -eq (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue)) { exit 0 }; $status=Get-MpComputerStatus -ErrorAction SilentlyContinue; if ($null -eq $status -or $status.AntivirusEnabled -ne $true) { exit 0 }; $p='C:\Users\Admin\AppData\Local\Madium'.TrimEnd('\'); $current=@((Get-MpPreference -ErrorAction Stop).ExclusionPath); $has=@($current | Where-Object { $_ -and $_.TrimEnd('\') -ieq $p }).Count -gt 0; if (-not $has) { Add-MpPreference -ExclusionPath $p -ErrorAction Stop; $current=@((Get-MpPreference -ErrorAction Stop).ExclusionPath); $has=@($current | Where-Object { $_ -and $_.TrimEnd('\') -ieq $p }).Count -gt 0; if (-not $has) { throw 'Defender did not save the exclusion.' } }"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
MadiumInstaller.exe
app.so
AssetManifest.bin
FontManifest.json
NOTICES.Z
NativeAssetsManifest.json
MaterialIcons-Regular.otf
ink_sparkle.frag
stretch_effect.frag
icudtl.dat
flutter_windows.dll
__PSScriptPolicyTest_ecoahaqw.0mj.ps1
memory/4816-108-0x0000020E19E40000-0x0000020E19E48000-memory.dmp
memory/4816-109-0x0000020E19E50000-0x0000020E19E56000-memory.dmp
memory/4816-107-0x0000020E7FE80000-0x0000020E7FE9A000-memory.dmp
memory/4816-106-0x0000020E7FDF0000-0x0000020E7FDFA000-memory.dmp
memory/4816-110-0x0000020E7FE00000-0x0000020E7FE0A000-memory.dmp
memory/4816-105-0x0000020E7FE40000-0x0000020E7FE5C000-memory.dmp
memory/4816-104-0x0000020E7FDE0000-0x0000020E7FDEA000-memory.dmp
memory/4816-103-0x0000020E19EE0000-0x0000020E19F93000-memory.dmp
memory/4816-102-0x0000020E19E20000-0x0000020E19E3C000-memory.dmp
memory/4816-94-0x0000020E7FE10000-0x0000020E7FE32000-memory.dmp
memory/5356-23-0x0000024796C10000-0x0000024797169000-memory.dmp
memory/5356-87-0x0000024790DD0000-0x0000024792255000-memory.dmp
memory/5356-88-0x0000024790DD0000-0x0000024792255000-memory.dmp
memory/5356-86-0x0000024790DD0000-0x0000024792255000-memory.dmp
memory/5356-85-0x0000024790DD0000-0x0000024792255000-memory.dmp
memory/5356-84-0x0000024790DD0000-0x0000024792255000-memory.dmp
memory/5356-83-0x0000024790DD0000-0x0000024792255000-memory.dmp
memory/5356-82-0x0000024790DD0000-0x0000024792255000-memory.dmp
memory/5356-24-0x0000024796C10000-0x0000024797169000-memory.dmp
memory/5356-25-0x0000024796C10000-0x0000024797169000-memory.dmp
memory/5356-26-0x0000024796A20000-0x0000024796A21000-memory.dmp
memory/5356-29-0x0000024796B80000-0x0000024796C00000-memory.dmp
memory/5356-30-0x0000024796B80000-0x0000024796C00000-memory.dmp
memory/5356-22-0x0000024796A10000-0x0000024796A11000-memory.dmp