Analysis
- user interaction
yes - max time kernel
149s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
16/08/2026, 13:51
General
- Target Installer-1.0.9.exe
- Size 9.8MB
- Sample260816-q58z4azthy
- SHA256 6c1bfdb571e85b8a1e0566f008f9eef8dab6baa4088a48d3b9c7ea9c7e9bfd9a
Malware Config
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 5 IoCs
- Loads dropped DLL 4 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 23 IoCs
- Suspicious use of SetWindowsHookEx 18 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Installer-1.0.9.exe"C:\Users\Admin\AppData\Local\Temp\Installer-1.0.9.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-3C0DA1AB-D28C-4663-86EA-67BB8DF8E5F9\MadiumInstaller.exe"C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-3C0DA1AB-D28C-4663-86EA-67BB8DF8E5F9\MadiumInstaller.exe" --from-sfx --first-install2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Madium\Installer\MadiumInstaller.exeC:\Users\Admin\AppData\Local\Madium\Installer\MadiumInstaller.exe --installed3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -Command "$created = Invoke-CimMethod -ClassName Win32_Process -MethodName Create -Arguments @{CommandLine='\"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe\" -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File \"C:\Users\Admin\AppData\Local\Temp\MadiumUpdate-3388.ps1\"'}; if ($created.ReturnValue -ne 0) { exit [int]$created.ReturnValue }"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\MadiumUpdate-3388.ps1"1⤵
- Process spawned unexpected child process
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-1.1.0-3388.exe"C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-1.1.0-3388.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-4BD408D2-B27C-4B32-80CB-2ADF608E7C97\MadiumInstaller.exe"C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-4BD408D2-B27C-4B32-80CB-2ADF608E7C97\MadiumInstaller.exe" --from-sfx --apply-update3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Madium\Installer\MadiumInstaller.exeC:\Users\Admin\AppData\Local\Madium\Installer\MadiumInstaller.exe --updated4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
install-state.json
StartupProfileData-NonInteractive
MadiumInstaller-1.1.0-3388.exe
MadiumInstaller.exe
app.so
AssetManifest.bin
FontManifest.json
NOTICES.Z
NativeAssetsManifest.json
MaterialIcons-Regular.otf
ink_sparkle.frag
stretch_effect.frag
icudtl.dat
flutter_windows.dll
MadiumInstaller.exe
app.so
MadiumUpdate-3388.ps1
MadiumUpdate-3388.ps1.ready
__PSScriptPolicyTest_iswktfsa.joq.ps1
InstrumentSans_regular_a0d636084c04969c1f0ebde2187f920cce7c21fcb58aa2a512c4fb0a79b518b4.ttf
TM02851223[[fn=iso690]].xsl
fb3b0dbfee58fac8.customDestinations-ms
memory/568-102-0x000002612FA80000-0x000002612FB00000-memory.dmp
memory/568-98-0x000002612F390000-0x000002612F391000-memory.dmp
memory/568-94-0x000002612F380000-0x000002612F381000-memory.dmp
memory/568-95-0x000002612F3E0000-0x000002612F945000-memory.dmp
memory/568-96-0x000002612F3E0000-0x000002612F945000-memory.dmp
memory/568-101-0x000002612FA80000-0x000002612FB00000-memory.dmp
memory/568-97-0x000002612F3E0000-0x000002612F945000-memory.dmp
memory/1016-125-0x00007FFBF6EC0000-0x00007FFBF6ED0000-memory.dmp
memory/1016-129-0x00007FFBF6EC0000-0x00007FFBF6ED0000-memory.dmp
memory/1016-128-0x00007FFBF6EC0000-0x00007FFBF6ED0000-memory.dmp
memory/1016-130-0x00007FFBF4360000-0x00007FFBF4370000-memory.dmp
memory/1016-126-0x00007FFBF6EC0000-0x00007FFBF6ED0000-memory.dmp
memory/1016-131-0x00007FFBF4360000-0x00007FFBF4370000-memory.dmp
memory/1016-127-0x00007FFBF6EC0000-0x00007FFBF6ED0000-memory.dmp
memory/2100-60-0x000001B7A6E00000-0x000001B7A6EB2000-memory.dmp
memory/2100-63-0x000001B7A7040000-0x000001B7A7064000-memory.dmp
memory/2100-62-0x000001B7A7040000-0x000001B7A706A000-memory.dmp
memory/2100-59-0x000001B7A6DE0000-0x000001B7A6DFE000-memory.dmp
memory/2100-61-0x000001B7A6BD0000-0x000001B7A6BDA000-memory.dmp
memory/2100-56-0x000001B7A6B10000-0x000001B7A6B32000-memory.dmp
memory/3388-45-0x0000021720280000-0x0000021720300000-memory.dmp
memory/3388-44-0x0000021720280000-0x0000021720300000-memory.dmp
memory/3508-27-0x0000025E73B00000-0x0000025E73B80000-memory.dmp
memory/3508-24-0x0000025E6FC50000-0x0000025E6FC51000-memory.dmp
memory/3508-21-0x0000025E734B0000-0x0000025E73A09000-memory.dmp
memory/3508-28-0x0000025E73B00000-0x0000025E73B80000-memory.dmp
memory/3508-20-0x0000025E6FC40000-0x0000025E6FC41000-memory.dmp
memory/3508-23-0x0000025E734B0000-0x0000025E73A09000-memory.dmp
memory/3508-22-0x0000025E734B0000-0x0000025E73A09000-memory.dmp
memory/4324-121-0x000001DD95400000-0x000001DD95480000-memory.dmp
memory/4324-122-0x000001DD95400000-0x000001DD95480000-memory.dmp