Analysis
- user interaction
yes - max time kernel
344s - max time network
361s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
07/11/2026, 14:02
General
- Target Installer-1.1.2.exe
- Size 9.8MB
- Sample261107-rcfcrayv3j
- SHA256 9d5b3be1f5525dc84ae008563f0131e6c1af40f9c73febdd4746aec078359bee
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Installer-1.1.2.exe"C:\Users\Admin\AppData\Local\Temp\Installer-1.1.2.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-7CF5D2A8-2CDB-4140-BD72-F7C0BF21B24B\MadiumInstaller.exe"C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-7CF5D2A8-2CDB-4140-BD72-F7C0BF21B24B\MadiumInstaller.exe" --from-sfx --first-install2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Stop'; if ($null -eq (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue)) { exit 0 }; $status=Get-MpComputerStatus -ErrorAction SilentlyContinue; if ($null -eq $status -or $status.AntivirusEnabled -ne $true) { exit 0 }; $p='C:\Users\Admin\AppData\Local\Madium'.TrimEnd('\'); $current=@((Get-MpPreference -ErrorAction Stop).ExclusionPath); $has=@($current | Where-Object { $_ -and $_.TrimEnd('\') -ieq $p }).Count -gt 0; if (-not $has) { Add-MpPreference -ExclusionPath $p -ErrorAction Stop; $current=@((Get-MpPreference -ErrorAction Stop).ExclusionPath); $has=@($current | Where-Object { $_ -and $_.TrimEnd('\') -ieq $p }).Count -gt 0; if (-not $has) { throw 'Defender did not save the exclusion.' } }"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
MadiumInstaller.exe
app.so
AssetManifest.bin
FontManifest.json
NOTICES.Z
NativeAssetsManifest.json
MaterialIcons-Regular.otf
ink_sparkle.frag
stretch_effect.frag
icudtl.dat
flutter_windows.dll
__PSScriptPolicyTest_xt13j5jt.amq.psm1
memory/3672-28-0x000001D987000000-0x000001D987080000-memory.dmp
memory/3672-25-0x000001D9868F0000-0x000001D9868F1000-memory.dmp
memory/3672-29-0x000001D987000000-0x000001D987080000-memory.dmp
memory/3672-22-0x000001D986A50000-0x000001D986FB5000-memory.dmp
memory/3672-21-0x000001D9868E0000-0x000001D9868E1000-memory.dmp
memory/3672-23-0x000001D986A50000-0x000001D986FB5000-memory.dmp
memory/3672-24-0x000001D986A50000-0x000001D986FB5000-memory.dmp
memory/5896-65-0x000002289FB30000-0x000002289FB52000-memory.dmp
memory/5896-68-0x000002289FBD0000-0x000002289FBEE000-memory.dmp
memory/5896-69-0x000002289FE70000-0x000002289FF22000-memory.dmp
memory/5896-70-0x000002289FBF0000-0x000002289FBFA000-memory.dmp