9d5b3be1f5525dc84ae008563f0131e6c1af40f9c73febdd4746aec078359bee

Analysis

max time kernel
42s
max time network
25s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Installer-1.1.2.exe
Size 9.8MB
Sample261113-xtv3esfv9s
SHA256 9d5b3be1f5525dc84ae008563f0131e6c1af40f9c73febdd4746aec078359bee
MD5 79fb5ff0f573288eca4ce6ce547857a3
SHA1 3f1e2a2ab7b0b9a063e7cb54b6813eb37de3a730
SHA512 84ddcad6f27f06266a0cb63fb5b54406f2723c73565dca9a07e5fcdb80f55c8212c68c53970c4f8fbd6f31916d926f76f88991280a00961e384ad20880c043a2
SSDEEP 196608:H12eQ75UY6MQ2iUwECSAFQg9uOvRlogm1XGz9bYb7QcWOqErqneAzQb/:V2B6jMQ2iB2AFr4OvRlsdGR2EdErw5ze
TLSH
T10DA6334B30C521AAE987D33A56A00A47672AF4195F7FDB9783194B905F372C0EF74BA0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4000	MadiumInstaller.exe

Loads dropped DLL 1 IoCs

pid	Process
4000	MadiumInstaller.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MadiumInstaller.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MadiumInstaller.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4000	MadiumInstaller.exe
4000	MadiumInstaller.exe
4000	MadiumInstaller.exe
4000	MadiumInstaller.exe
4000	MadiumInstaller.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5240 wrote to memory of 4000	5240	Installer-1.1.2.exe	90

C:\Users\Admin\AppData\Local\Temp\Installer-1.1.2.exe
"C:\Users\Admin\AppData\Local\Temp\Installer-1.1.2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5240
- C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-3BCCAFA7-1A15-45E5-B43F-D8265112669E\MadiumInstaller.exe
  "C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-3BCCAFA7-1A15-45E5-B43F-D8265112669E\MadiumInstaller.exe" --from-sfx --first-install
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of SetWindowsHookEx
  PID:4000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

NOTICES.Z.new

Path C:\Users\Admin\AppData\Local\Madium\Installer.new\data\flutter_assets\NOTICES.Z.new
Size 102KB
SHA256 bdb492de2b031ec16101eede4cd2f26feefcd75c16a09239fa471a9cc552fcca
MD5 79e3b032d03665232fb84f194fc934bd
SHA1 cd30f816703e3d15a6c5d3f7c986005c044f7425
SHA512 4d2f906c47e088e8e8256063fa21425e8989e97a0ac94230ca1650177f68b332f65dcd800be281b12295596aa56d022cc88d444fa27a8cdf12e23206e7550323
SSDEEP 3072:n7tECDp05eSkCmIQ+P/sKr/bw+hoh5H3/P:n7tEC8e+o+H28oh5H3/P
TLSH
T125A3127E6A2C044171BC119D23498B64FEA6FBC630C94EFEB43352B41D7A889712D572
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stretch_effect.frag.new

Path C:\Users\Admin\AppData\Local\Madium\Installer.new\data\flutter_assets\shaders\stretch_effect.frag.new
Size 17KB
SHA256 62a899ff4e168ac6ca888ce7c2f40e5d3fbf8ca20a1c3ded781a116a6d7907e2
MD5 4acf2167e56d604e5acd1928ac03f0cf
SHA1 38c5e7d5b2583906cc67f5c018c06c5b43bdd120
SHA512 097a61ba8ea49c29dd06c92358094a423c9baec14027f2fed616d8da24bb91beb9c82bfdb3fe42de2c1610028a2ae6dbe01ae3636a813c7f0d6fa55369e140f2
SSDEEP 192:8sVNLhNETx5kgIDkHs9tmogoxjaDViqNi6O9aNiqgiSuKRqDi64BaXiqGiaaZdBf:8Mph6Tx59HUtXYDc2/boE/
TLSH
T1FC821254D6730897CC5BA37D4E4F0218AB34C087968687037E4DF224AF8676A4AA9FD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MadiumInstaller.exe

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-3BCCAFA7-1A15-45E5-B43F-D8265112669E\MadiumInstaller.exe
Size 204KB
SHA256 8c9725da60ce45561a75ce737aa3d9cb52507583ea543b72259c7bac0a46243a
MD5 2a9deab9a2029036359f50ff0d398303
SHA1 394dca3026df2944c06607e1d05b2d61896ce7d2
SHA512 45343b57be20f142e2a9399575188fe1db392e57ea5f6a6210d86c2234f50233ff6551a1e1d71abdb9995485daeb939db64bc226fd75cd643f7fd7c8f053319f
SSDEEP 6144:OwhojjTxItRyKO/XL5n6XD+vpFtO5r1DZQ80sEC:4T55n6XajtO5rBZQvi
TLSH
T19A248E1BF79410F9E167C57CCE928A41EB72B896076197CF0B500BB60F27AD85E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.so

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-3BCCAFA7-1A15-45E5-B43F-D8265112669E\data\app.so
Size 5.4MB
SHA256 05f36e97095cd0a29bc96f6ad619ddc6218237964a247097b7659800901a957e
MD5 08af723cc2097bd84264e48fd73fe353
SHA1 91d3e9ae581bb3d83004e68e422dbddcbb8129c7
SHA512 4a57984b02a63de7b4d78eb2e5c5acc79100e0ff87b88c30dc058edda4b17f9185ee8a41a3d9e629d14583ea2fac4feee6fbda2fcd1ba1b64b6e3dea05eb58e2
SSDEEP 49152:DwzugA7PW80vZALX2PUonsFhC1YEJUrF3Jhd8vfOzWc4KsJ/JtoHsL0OzTlDPa+G:Dwzugj6zeKc/JyHm0SiO90
TLSH
T14446FA4BC0E48364D472E772B75F36B5AE2438CC4E74B64606C4575A3E9ACE08ACF672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AssetManifest.bin

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-3BCCAFA7-1A15-45E5-B43F-D8265112669E\data\flutter_assets\AssetManifest.bin
Size 2B
SHA256 f566cc6fccc657365c0197accf3a7d6f80f85209ff666ff774f4dcbc524aa842
MD5 0b0a3415aad49b6e9bf965ff578614f9
SHA1 db5b55a9b215f744db82517864984d073f2e8f8c
SHA512 0404c26467d39c9394c15c26d360cb48cc474aeefe2bae5fd5d46b72b5e9ebb8f1497d561dfed5a21942db92b648bab8167d8e02f5f19880a77e3afdc68526f8
MD5 SHA1 SHA512

Submit Download

FontManifest.json

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-3BCCAFA7-1A15-45E5-B43F-D8265112669E\data\flutter_assets\FontManifest.json
Size 82B
SHA256 28b1eb2b3d2e1ad60b8c8b0f9100b1ccbf492f7fa97f5bebb51ea97e73926e7d
MD5 7b2a36307916a9721811788013e65289
SHA1 f83d716c83a8a1cdf2a5c7b5fa387e9a62f2d49d
SHA512 0659dbdc8042768ce6e75c5e36fef1f93fde820dced5e2cf07f0949e59b25f87c01607f97c1926a792dbda28ebd7e4334ad942dfef3782e5ceb61de893f8df67
TLSH
T141A0120F005405D540CD9045F0957051E040284B000BC4CAD164064493E2130033C307
MD5 SHA1 SHA512 TLSH

Submit Download

NativeAssetsManifest.json

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-3BCCAFA7-1A15-45E5-B43F-D8265112669E\data\flutter_assets\NativeAssetsManifest.json
Size 45B
SHA256 9548a31e4a048135c1d94f919328bfb62ae2c7bb3cab96557c7941daa97776cb
MD5 f3a664e105b4f792c6c7fe4e4d22c398
SHA1 adee29ec4f2b3cb2ec37ec3368f37ff805695d36
SHA512 b7df555970e20c6a50f650cd0df6ab782fba7004782b3f7921ccfd314db53bfb61523986628d2e05d085f4c2263dfcf54000ffdfc946b0158c5766fc6f1d0a86
MD5 SHA1 SHA512

Submit Download

MaterialIcons-Regular.otf

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-3BCCAFA7-1A15-45E5-B43F-D8265112669E\data\flutter_assets\fonts\MaterialIcons-Regular.otf
Size 1.6MB
SHA256 d9865b671a09d683d13a863089d8825e0f61a37696ce5d7d448bc8023aa62453
MD5 e7069dfd19b331be16bed984668fe080
SHA1 fc25284ee3d0aaa75ec5fc8e4fd96926157ed8c4
SHA512 27d9662a22c3e9fe66c261c45bf309e81be7a738ae5dc5b07ad90d207d9901785f3f11dc227c75ca683186b4553b0aa5a621f541c039475b0f032b7688aaa484
SSDEEP 24576:PsSIRolMKvGXtkXKLkMp2fXrNsAxI6zD2/qxDoq4eeeDrG2eOeGr2lkzhlTMrRoV:P9njdzbwc9
TLSH
T1787529100276EF4CC1EF507D43B74A48F4C59AFEA53ABB1AF9B64795220BDBDA1C8181
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ink_sparkle.frag

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-3BCCAFA7-1A15-45E5-B43F-D8265112669E\data\flutter_assets\shaders\ink_sparkle.frag
Size 21KB
SHA256 1fe8436a743884cb65078fe8c7b38e18f5365f2a2961270916f426fd13c604af
MD5 0a8f4531af1d1a54aee8c7d23e640d2d
SHA1 0e13f340acb6eab5ddfcf70df99d06e3fabbb454
SHA512 e93fe163ebddb759a7f53c611eedb560fce18c5f5536b8a19781a3c5c3aabb0c0fcd65159b24d60c5113f3c542bf417132f3e8aa5b9b996b5b546cdb34683b51
SSDEEP 384:TThcP2xBwl0yU6iMRRLkgpXlp+TrlI+6QkopXlp+TrlIPLmNlkf/M+c3Vp3P9KP:TdcP2xBwl0yUNeRwoL+TrlIPzgL+Trly
TLSH
T121A23348D2E60E22DD166B3D556B21043F3EF09BAB67D2033748BA547F87327468A6D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-3BCCAFA7-1A15-45E5-B43F-D8265112669E\data\icudtl.dat
Size 842KB
SHA256 998367809a821d595928089c197b3f7959f0420f81f79d4d0daee53378492ed5
MD5 018361032ba13dfeab636138ab6b9831
SHA1 8f9c259d3a330786ab8bbd49e7e79abfa1d552ed
SHA512 d7d3fffb41576cf2c90cd260727cc0ea23c5a4c458f84b01426c2a4578004b94168047c7282222e9ffade2f082e189cf167146cc3303bd7dbbb252a593236967
SSDEEP 12288:8Mlhw771h0jM7ykPG07rr4c8w0P4N48Rkjt3dPHz982VYhq:Zhw3zVtjLbGu4RjTPHzMhq
TLSH
T199056A17B0435E6FE0C48277C652E7B65637838DEB3317EAB698B5593E8A1C20241BCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flutter_windows.dll

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-3BCCAFA7-1A15-45E5-B43F-D8265112669E\flutter_windows.dll
Size 20.3MB
SHA256 67db13c69a0ce93242d11c2f99dd86ccbabce18ea9de613f126e9e31817d6de6
MD5 a3a9bc0880d2166c7718120b86f5b54e
SHA1 ca12a77b625fad404ad57b6335b7bd6d014d461d
SHA512 583dab60fa9be1c58b280e700cb5298d4b56bc5f5dc8c8e0e94e400925f553fe6bdd664d54b4ea10b4e71cfe6ff4453a7a037398249a59e7f4e2f05d632b6c0a
SSDEEP 98304:x24Wmz6AP8+AmlPps4yoz95mYjH1x0q1KiROOUsMuZSxAwg5mByfcdrNh7k/WV49:xt8omoxj1IWEjEw9+BZ5vStib5Hc/
TLSH
T145276C03E29640EDC059E179971BAA27F670B8490B20BADF3B5C47213F66BE05B3E754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4000-24-0x0000025E2D990000-0x0000025E2DEF5000-memory.dmp

Download

memory/4000-21-0x0000025E2A0E0000-0x0000025E2A0E1000-memory.dmp

Download

memory/4000-22-0x0000025E2D990000-0x0000025E2DEF5000-memory.dmp

Download

memory/4000-23-0x0000025E2D990000-0x0000025E2DEF5000-memory.dmp

Download

memory/4000-28-0x0000025E2DF00000-0x0000025E2DF80000-memory.dmp

Download

memory/4000-29-0x0000025E2DF00000-0x0000025E2DF80000-memory.dmp

Download

memory/4000-25-0x0000025E2A200000-0x0000025E2A201000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads