Analysis
- max time kernel
149s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
31/08/2026, 15:06
General
- Target Installer-1.0.9 (1).exe
- Size 9.8MB
- Sample260831-sg4rkshb49
- SHA256 6c1bfdb571e85b8a1e0566f008f9eef8dab6baa4088a48d3b9c7ea9c7e9bfd9a
Malware Config
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 3 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 23 IoCs
- Suspicious use of SetWindowsHookEx 12 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Installer-1.0.9 (1).exe"C:\Users\Admin\AppData\Local\Temp\Installer-1.0.9 (1).exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-749D01E4-F25C-4D0B-B513-EDE94DF9843B\MadiumInstaller.exe"C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-749D01E4-F25C-4D0B-B513-EDE94DF9843B\MadiumInstaller.exe" --from-sfx --first-install2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Madium\Installer\MadiumInstaller.exeC:\Users\Admin\AppData\Local\Madium\Installer\MadiumInstaller.exe --installed3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -Command "$created = Invoke-CimMethod -ClassName Win32_Process -MethodName Create -Arguments @{CommandLine='\"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe\" -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File \"C:\Users\Admin\AppData\Local\Temp\MadiumUpdate-5492.ps1\"'}; if ($created.ReturnValue -ne 0) { exit [int]$created.ReturnValue }"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\MadiumUpdate-5492.ps1"1⤵
- Process spawned unexpected child process
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-1.1.0-5492.exe"C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-1.1.0-5492.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-6510A554-F92E-49E5-8226-2E6EB2E7F09E\MadiumInstaller.exe"C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-6510A554-F92E-49E5-8226-2E6EB2E7F09E\MadiumInstaller.exe" --from-sfx --apply-update3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
install-state.json
StartupProfileData-NonInteractive
MadiumInstaller-1.1.0-5492.exe
MadiumInstaller.exe
app.so
MadiumInstaller.exe
app.so
AssetManifest.bin
FontManifest.json
NOTICES.Z
NativeAssetsManifest.json
MaterialIcons-Regular.otf
ink_sparkle.frag
stretch_effect.frag
icudtl.dat
flutter_windows.dll
MadiumUpdate-5492.ps1
MadiumUpdate-5492.ps1.ready
__PSScriptPolicyTest_ramdulnb.bsh.ps1
InstrumentSans_regular_a0d636084c04969c1f0ebde2187f920cce7c21fcb58aa2a512c4fb0a79b518b4.ttf
memory/260-61-0x0000023FFF660000-0x0000023FFF66A000-memory.dmp
memory/260-60-0x0000023FFF5A0000-0x0000023FFF652000-memory.dmp
memory/260-56-0x0000023FE6F90000-0x0000023FE6FB2000-memory.dmp
memory/260-62-0x0000023FFFA20000-0x0000023FFFA4A000-memory.dmp
memory/260-63-0x0000023FFFA20000-0x0000023FFFA44000-memory.dmp
memory/260-59-0x0000023FFF580000-0x0000023FFF59E000-memory.dmp
memory/3436-24-0x0000026052800000-0x0000026052801000-memory.dmp
memory/3436-27-0x0000026055F00000-0x0000026055F80000-memory.dmp
memory/3436-21-0x0000026055F90000-0x00000260564E9000-memory.dmp
memory/3436-22-0x0000026055F90000-0x00000260564E9000-memory.dmp
memory/3436-28-0x0000026055F00000-0x0000026055F80000-memory.dmp
memory/3436-23-0x0000026055F90000-0x00000260564E9000-memory.dmp
memory/3436-20-0x00000260527F0000-0x00000260527F1000-memory.dmp
memory/5492-44-0x000002C152E80000-0x000002C152F00000-memory.dmp
memory/5492-45-0x000002C152E80000-0x000002C152F00000-memory.dmp
memory/5524-101-0x000001F48E680000-0x000001F48E700000-memory.dmp
memory/5524-96-0x000001F48E740000-0x000001F48ECA5000-memory.dmp
memory/5524-95-0x000001F48E740000-0x000001F48ECA5000-memory.dmp
memory/5524-97-0x000001F48E740000-0x000001F48ECA5000-memory.dmp
memory/5524-102-0x000001F48E680000-0x000001F48E700000-memory.dmp
memory/5524-98-0x000001F48AF00000-0x000001F48AF01000-memory.dmp
memory/5524-94-0x000001F48ADE0000-0x000001F48ADE1000-memory.dmp