7d369ef21a49e0bcfd7875d2e000a5c6bb592e00f305e139a188f40b3dc32249

Analysis

user interaction
yes
max time kernel
95s
max time network
100s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 08:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Installer-1.1.0.exe
Size 9.8MB
Sample260828-j3qbmsgj6x
SHA256 7d369ef21a49e0bcfd7875d2e000a5c6bb592e00f305e139a188f40b3dc32249
MD5 05f15a788b381191b0c021690ee60142
SHA1 f63593f46bbbff726733225869ce29a33eefc7ae
SHA512 488f9c1da95cf47f040d2de8f767fd26a28053b152177607f84ad43736bb2237f40f7e050e7a2bbe927fe9327cf1ffba30aa6e272ab63fa0af3bdca6978bc0f2
SSDEEP 196608:p72MJ9yZ9AsAxGpA4mdlHRTabZU8iUa+Ls1TX5d0fLjdFF5OoFaQtuJ0K3:Z2MJl8pApdtwiUa6YTX5+rF5O0awK3
TLSH
T187A6331AB7513AF1F1A7D3395046490AC3B1F4721B56A6E703A264FB6E237C4CF3AA05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3200	MadiumInstaller.exe
5852	MadiumInstaller.exe

Loads dropped DLL 2 IoCs

pid	Process
3200	MadiumInstaller.exe
5852	MadiumInstaller.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4816	dotnet.exe

Modifies registry key 1 TTPs 7 IoCs

Modify Registry

T1112

pid	Process
2088	reg.exe
3112	reg.exe
4620	reg.exe
2364	reg.exe
4696	reg.exe
1196	reg.exe
5716	reg.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3200	MadiumInstaller.exe
3200	MadiumInstaller.exe
5852	MadiumInstaller.exe
5852	MadiumInstaller.exe
5852	MadiumInstaller.exe
5852	MadiumInstaller.exe
5852	MadiumInstaller.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 3200	4084	Installer-1.1.0.exe	89
PID 3200 wrote to memory of 5852	3200	MadiumInstaller.exe	90
PID 5852 wrote to memory of 4816	5852	MadiumInstaller.exe	92
PID 5852 wrote to memory of 4696	5852	MadiumInstaller.exe	93
PID 5852 wrote to memory of 1196	5852	MadiumInstaller.exe	94
PID 5852 wrote to memory of 5716	5852	MadiumInstaller.exe	95
PID 5852 wrote to memory of 2364	5852	MadiumInstaller.exe	96
PID 5852 wrote to memory of 4620	5852	MadiumInstaller.exe	97
PID 5852 wrote to memory of 3112	5852	MadiumInstaller.exe	98
PID 5852 wrote to memory of 2088	5852	MadiumInstaller.exe	100
PID 5852 wrote to memory of 1800	5852	MadiumInstaller.exe	101

C:\Users\Admin\AppData\Local\Temp\Installer-1.1.0.exe
"C:\Users\Admin\AppData\Local\Temp\Installer-1.1.0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-1106DB54-E4CF-4B44-A6CB-2AEDF2D5136B\MadiumInstaller.exe
  "C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-1106DB54-E4CF-4B44-A6CB-2AEDF2D5136B\MadiumInstaller.exe" --from-sfx --first-install
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3200
- - C:\Users\Admin\AppData\Local\Madium\Installer\MadiumInstaller.exe
    C:\Users\Admin\AppData\Local\Madium\Installer\MadiumInstaller.exe --installed
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5852
  - - C:\Program Files\dotnet\dotnet.exe
      dotnet.exe --list-runtimes
      4⤵
      System Time Discovery
      PID:4816
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe query HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x64 /v Installed
      4⤵
      Modifies registry key
      PID:4696
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe query HKLM\SOFTWARE\WOW6432Node\Microsoft\VisualStudio\14.0\VC\Runtimes\x64 /v Installed
      4⤵
      Modifies registry key
      PID:1196
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe query HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x86 /v Installed
      4⤵
      Modifies registry key
      PID:5716
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe query HKLM\SOFTWARE\WOW6432Node\Microsoft\VisualStudio\14.0\VC\Runtimes\x86 /v Installed
      4⤵
      Modifies registry key
      PID:2364
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe query HKLM\SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5} /v pv
      4⤵
      Modifies registry key
      PID:4620
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe query HKLM\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5} /v pv
      4⤵
      Modifies registry key
      PID:3112
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe query HKCU\Software\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5} /v pv
      4⤵
      Modifies registry key
      PID:2088
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe query "HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" /v Release
      4⤵
      PID:1800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Madium.exe.download

Path C:\Users\Admin\AppData\Local\Madium\Bin\Madium.exe.download
Size 12.3MB
SHA256 2863398b1a53c636009ac3f9764502e02678d7b8a5657bbbf9bf1640050d2b0d
MD5 85e95547931ca2d927c3d330708267bb
SHA1 f7e90e6b26d4308fbd002727598c9dd4332c3411
SHA512 10df883ec5c2974e72a33438ef2b077c19192ac017ec7c2f7cb6ceccea04eacf4107d8169b09b47544b86d1dbc0b07f1a2c3b89653139e135f90390b5b27bd22
SSDEEP 98304:Z06Xs4qOQBihAARp6mBt6U3B5CkW4UmClU7+kRn+W6f1+jzAYF07HR4jN08I+dQw:/sJ0qU7+on+F0DF0Lqml7BSQRwaF1wj
TLSH
T1AFD6BE07F64481F8C4AEC278C36B9637EA72B889452071AF17E45B112F2BF606F1D799
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MadiumInstaller.exe

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-1106DB54-E4CF-4B44-A6CB-2AEDF2D5136B\MadiumInstaller.exe
Size 204KB
SHA256 4ccd3c14651d1842b201c02084730fcc3b674758a75754c4c69bf64f1a7cda4b
MD5 7c786540ea668f83551dbc27c021afc1
SHA1 d15ba52aea36aecf441cd6f70600dec57ff1197a
SHA512 d3519b21f19c51d65be4b12ce6cb4dc2314e5a239a56b23bb9fc46b117c81430969da89d3e13021577081f4bb5585701ff81891a72cc4700418601ec53673083
SSDEEP 6144:OwhojjTxItRyKO/XL5n6XD+vpFtO5r1DZQ80sEC:4T55n6XajtO5rBZQvi
TLSH
T178248E1BF79410F9E167C57CCE928A41EB72B896076197CF0B500BB60F27AD85E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.so

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-1106DB54-E4CF-4B44-A6CB-2AEDF2D5136B\data\app.so
Size 5.4MB
SHA256 d40a6c1b6bb279aa9e9a6ce542aa4f7a160193126b3ad1de0035dd10c4ef2f53
MD5 7dd589717b264d9e86e482b8b01399de
SHA1 8980a35b4de339d306ee5762cd0cded2b83a5fde
SHA512 325bd207f7d5f876212e1717b6b7d898b86b3f6e13d9f58c48dbd1a6a5c88b62a77b26854761eeb761b41030a0351a67a742d90a562bbcca1898d8f8903f3c7d
SSDEEP 49152:DwzugA7PW80vZALX2PUonsFhClYHJUjFepf28vfOzWc4KsJ/JtoHsL0OzTlDPa+G:DwzugjdzeKc/JyHm0SiO90
TLSH
T15446FA4BC0E48364D472E772B75F36B5AE2438CC4E74B64606C4575A3E9ACE08ACF672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AssetManifest.bin

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-1106DB54-E4CF-4B44-A6CB-2AEDF2D5136B\data\flutter_assets\AssetManifest.bin
Size 2B
SHA256 f566cc6fccc657365c0197accf3a7d6f80f85209ff666ff774f4dcbc524aa842
MD5 0b0a3415aad49b6e9bf965ff578614f9
SHA1 db5b55a9b215f744db82517864984d073f2e8f8c
SHA512 0404c26467d39c9394c15c26d360cb48cc474aeefe2bae5fd5d46b72b5e9ebb8f1497d561dfed5a21942db92b648bab8167d8e02f5f19880a77e3afdc68526f8
MD5 SHA1 SHA512

Submit Download

FontManifest.json

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-1106DB54-E4CF-4B44-A6CB-2AEDF2D5136B\data\flutter_assets\FontManifest.json
Size 82B
SHA256 28b1eb2b3d2e1ad60b8c8b0f9100b1ccbf492f7fa97f5bebb51ea97e73926e7d
MD5 7b2a36307916a9721811788013e65289
SHA1 f83d716c83a8a1cdf2a5c7b5fa387e9a62f2d49d
SHA512 0659dbdc8042768ce6e75c5e36fef1f93fde820dced5e2cf07f0949e59b25f87c01607f97c1926a792dbda28ebd7e4334ad942dfef3782e5ceb61de893f8df67
TLSH
T141A0120F005405D540CD9045F0957051E040284B000BC4CAD164064493E2130033C307
MD5 SHA1 SHA512 TLSH

Submit Download

NOTICES.Z

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-1106DB54-E4CF-4B44-A6CB-2AEDF2D5136B\data\flutter_assets\NOTICES.Z
Size 102KB
SHA256 bdb492de2b031ec16101eede4cd2f26feefcd75c16a09239fa471a9cc552fcca
MD5 79e3b032d03665232fb84f194fc934bd
SHA1 cd30f816703e3d15a6c5d3f7c986005c044f7425
SHA512 4d2f906c47e088e8e8256063fa21425e8989e97a0ac94230ca1650177f68b332f65dcd800be281b12295596aa56d022cc88d444fa27a8cdf12e23206e7550323
SSDEEP 3072:n7tECDp05eSkCmIQ+P/sKr/bw+hoh5H3/P:n7tEC8e+o+H28oh5H3/P
TLSH
T125A3127E6A2C044171BC119D23498B64FEA6FBC630C94EFEB43352B41D7A889712D572
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NativeAssetsManifest.json

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-1106DB54-E4CF-4B44-A6CB-2AEDF2D5136B\data\flutter_assets\NativeAssetsManifest.json
Size 45B
SHA256 9548a31e4a048135c1d94f919328bfb62ae2c7bb3cab96557c7941daa97776cb
MD5 f3a664e105b4f792c6c7fe4e4d22c398
SHA1 adee29ec4f2b3cb2ec37ec3368f37ff805695d36
SHA512 b7df555970e20c6a50f650cd0df6ab782fba7004782b3f7921ccfd314db53bfb61523986628d2e05d085f4c2263dfcf54000ffdfc946b0158c5766fc6f1d0a86
MD5 SHA1 SHA512

Submit Download

MaterialIcons-Regular.otf

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-1106DB54-E4CF-4B44-A6CB-2AEDF2D5136B\data\flutter_assets\fonts\MaterialIcons-Regular.otf
Size 1.6MB
SHA256 d9865b671a09d683d13a863089d8825e0f61a37696ce5d7d448bc8023aa62453
MD5 e7069dfd19b331be16bed984668fe080
SHA1 fc25284ee3d0aaa75ec5fc8e4fd96926157ed8c4
SHA512 27d9662a22c3e9fe66c261c45bf309e81be7a738ae5dc5b07ad90d207d9901785f3f11dc227c75ca683186b4553b0aa5a621f541c039475b0f032b7688aaa484
SSDEEP 24576:PsSIRolMKvGXtkXKLkMp2fXrNsAxI6zD2/qxDoq4eeeDrG2eOeGr2lkzhlTMrRoV:P9njdzbwc9
TLSH
T1787529100276EF4CC1EF507D43B74A48F4C59AFEA53ABB1AF9B64795220BDBDA1C8181
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ink_sparkle.frag

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-1106DB54-E4CF-4B44-A6CB-2AEDF2D5136B\data\flutter_assets\shaders\ink_sparkle.frag
Size 21KB
SHA256 1fe8436a743884cb65078fe8c7b38e18f5365f2a2961270916f426fd13c604af
MD5 0a8f4531af1d1a54aee8c7d23e640d2d
SHA1 0e13f340acb6eab5ddfcf70df99d06e3fabbb454
SHA512 e93fe163ebddb759a7f53c611eedb560fce18c5f5536b8a19781a3c5c3aabb0c0fcd65159b24d60c5113f3c542bf417132f3e8aa5b9b996b5b546cdb34683b51
SSDEEP 384:TThcP2xBwl0yU6iMRRLkgpXlp+TrlI+6QkopXlp+TrlIPLmNlkf/M+c3Vp3P9KP:TdcP2xBwl0yUNeRwoL+TrlIPzgL+Trly
TLSH
T121A23348D2E60E22DD166B3D556B21043F3EF09BAB67D2033748BA547F87327468A6D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stretch_effect.frag

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-1106DB54-E4CF-4B44-A6CB-2AEDF2D5136B\data\flutter_assets\shaders\stretch_effect.frag
Size 17KB
SHA256 62a899ff4e168ac6ca888ce7c2f40e5d3fbf8ca20a1c3ded781a116a6d7907e2
MD5 4acf2167e56d604e5acd1928ac03f0cf
SHA1 38c5e7d5b2583906cc67f5c018c06c5b43bdd120
SHA512 097a61ba8ea49c29dd06c92358094a423c9baec14027f2fed616d8da24bb91beb9c82bfdb3fe42de2c1610028a2ae6dbe01ae3636a813c7f0d6fa55369e140f2
SSDEEP 192:8sVNLhNETx5kgIDkHs9tmogoxjaDViqNi6O9aNiqgiSuKRqDi64BaXiqGiaaZdBf:8Mph6Tx59HUtXYDc2/boE/
TLSH
T1FC821254D6730897CC5BA37D4E4F0218AB34C087968687037E4DF224AF8676A4AA9FD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-1106DB54-E4CF-4B44-A6CB-2AEDF2D5136B\data\icudtl.dat
Size 842KB
SHA256 998367809a821d595928089c197b3f7959f0420f81f79d4d0daee53378492ed5
MD5 018361032ba13dfeab636138ab6b9831
SHA1 8f9c259d3a330786ab8bbd49e7e79abfa1d552ed
SHA512 d7d3fffb41576cf2c90cd260727cc0ea23c5a4c458f84b01426c2a4578004b94168047c7282222e9ffade2f082e189cf167146cc3303bd7dbbb252a593236967
SSDEEP 12288:8Mlhw771h0jM7ykPG07rr4c8w0P4N48Rkjt3dPHz982VYhq:Zhw3zVtjLbGu4RjTPHzMhq
TLSH
T199056A17B0435E6FE0C48277C652E7B65637838DEB3317EAB698B5593E8A1C20241BCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flutter_windows.dll

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-1106DB54-E4CF-4B44-A6CB-2AEDF2D5136B\flutter_windows.dll
Size 20.3MB
SHA256 67db13c69a0ce93242d11c2f99dd86ccbabce18ea9de613f126e9e31817d6de6
MD5 a3a9bc0880d2166c7718120b86f5b54e
SHA1 ca12a77b625fad404ad57b6335b7bd6d014d461d
SHA512 583dab60fa9be1c58b280e700cb5298d4b56bc5f5dc8c8e0e94e400925f553fe6bdd664d54b4ea10b4e71cfe6ff4453a7a037398249a59e7f4e2f05d632b6c0a
SSDEEP 98304:x24Wmz6AP8+AmlPps4yoz95mYjH1x0q1KiROOUsMuZSxAwg5mByfcdrNh7k/WV49:xt8omoxj1IWEjEw9+BZ5vStib5Hc/
TLSH
T145276C03E29640EDC059E179971BAA27F670B8490B20BADF3B5C47213F66BE05B3E754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3200-29-0x000002141E580000-0x000002141E600000-memory.dmp

Download

memory/3200-21-0x000002141A680000-0x000002141A681000-memory.dmp

Download

memory/3200-22-0x000002141DEE0000-0x000002141E445000-memory.dmp

Download

memory/3200-25-0x000002141A690000-0x000002141A691000-memory.dmp

Download

memory/3200-23-0x000002141DEE0000-0x000002141E445000-memory.dmp

Download

memory/3200-28-0x000002141E580000-0x000002141E600000-memory.dmp

Download

memory/3200-24-0x000002141DEE0000-0x000002141E445000-memory.dmp

Download

memory/5852-47-0x0000013715200000-0x0000013715280000-memory.dmp

Download

memory/5852-46-0x0000013715200000-0x0000013715280000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads