Analysis
- user interaction
yes - max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-uk - resource tags
- submitted
14/08/2026, 12:12
General
- Target Installer-1.0.9.exe
- Size 9.8MB
- Sample260814-pc961stset
- SHA256 6c1bfdb571e85b8a1e0566f008f9eef8dab6baa4088a48d3b9c7ea9c7e9bfd9a
Malware Config
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 24 IoCs
- Suspicious use of SetWindowsHookEx 9 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Installer-1.0.9.exe"C:\Users\Admin\AppData\Local\Temp\Installer-1.0.9.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-36C521BD-4598-4D77-8522-8351E24FB71F\MadiumInstaller.exe"C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-36C521BD-4598-4D77-8522-8351E24FB71F\MadiumInstaller.exe" --from-sfx --first-install2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Stop'; if ($null -eq (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue)) { exit 0 }; $status=Get-MpComputerStatus -ErrorAction SilentlyContinue; if ($null -eq $status -or $status.AntivirusEnabled -ne $true) { exit 0 }; $p='C:\Users\Admin\AppData\Local\Madium'.TrimEnd('\'); $current=@((Get-MpPreference -ErrorAction Stop).ExclusionPath); $has=@($current | Where-Object { $_ -and $_.TrimEnd('\') -ieq $p }).Count -gt 0; if (-not $has) { Add-MpPreference -ExclusionPath $p -ErrorAction Stop; $current=@((Get-MpPreference -ErrorAction Stop).ExclusionPath); $has=@($current | Where-Object { $_ -and $_.TrimEnd('\') -ieq $p }).Count -gt 0; if (-not $has) { throw 'Defender did not save the exclusion.' } }"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -Command "$created = Invoke-CimMethod -ClassName Win32_Process -MethodName Create -Arguments @{CommandLine='\"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe\" -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File \"C:\Users\Admin\AppData\Local\Temp\MadiumUpdate-2704.ps1\"'}; if ($created.ReturnValue -ne 0) { exit [int]$created.ReturnValue }"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\MadiumUpdate-2704.ps1"1⤵
- Process spawned unexpected child process
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-1.1.0-2704.exe"C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-1.1.0-2704.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-1E881AD7-BEAF-4F5F-9303-A49F9364F35A\MadiumInstaller.exe"C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-1E881AD7-BEAF-4F5F-9303-A49F9364F35A\MadiumInstaller.exe" --from-sfx --first-install3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
install-state.json
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
MadiumInstaller-1.1.0-2704.exe
MadiumInstaller.exe
app.so
MadiumInstaller.exe
app.so
AssetManifest.bin
FontManifest.json
NOTICES.Z
NativeAssetsManifest.json
MaterialIcons-Regular.otf
ink_sparkle.frag
stretch_effect.frag
icudtl.dat
flutter_windows.dll
MadiumUpdate-2704.ps1
MadiumUpdate-2704.ps1.ready
__PSScriptPolicyTest_clois0ev.kym.ps1
memory/1340-103-0x000001EA49960000-0x000001EA4998A000-memory.dmp
memory/1340-104-0x000001EA49960000-0x000001EA49984000-memory.dmp
memory/2704-24-0x000002C98F580000-0x000002C98F581000-memory.dmp
memory/2704-20-0x000002C98F570000-0x000002C98F571000-memory.dmp
memory/2704-21-0x000002C992600000-0x000002C992B59000-memory.dmp
memory/2704-23-0x000002C992600000-0x000002C992B59000-memory.dmp
memory/2704-27-0x000002C992B80000-0x000002C992C00000-memory.dmp
memory/2704-28-0x000002C992B80000-0x000002C992C00000-memory.dmp
memory/2704-22-0x000002C992600000-0x000002C992B59000-memory.dmp
memory/3720-140-0x000001507B260000-0x000001507B261000-memory.dmp
memory/3720-141-0x000001507B410000-0x000001507B975000-memory.dmp
memory/3720-144-0x000001507B270000-0x000001507B271000-memory.dmp
memory/3720-148-0x000001507B380000-0x000001507B400000-memory.dmp
memory/3720-147-0x000001507B380000-0x000001507B400000-memory.dmp
memory/3720-143-0x000001507B410000-0x000001507B975000-memory.dmp
memory/3720-142-0x000001507B410000-0x000001507B975000-memory.dmp
memory/5072-84-0x00000248ED390000-0x00000248ED3B2000-memory.dmp