Overview

overview

10

Static

static

10

BIN/AgentC...ib.dll

windows10-2004-x64

1

BIN/AgentC...ib.dll

windows11-21h2-x64

1

BIN/Connec...is.exe

windows10-2004-x64

1

BIN/Connec...is.exe

windows11-21h2-x64

1

BIN/Coreinfo.exe

windows10-2004-x64

3

BIN/Coreinfo.exe

windows11-21h2-x64

3

BIN/Databa...er.exe

windows10-2004-x64

1

BIN/Databa...er.exe

windows11-21h2-x64

1

BIN/Displa...te.exe

windows10-2004-x64

1

BIN/MDECli...er.exe

windows10-2004-x64

3

BIN/MDECli...on.exe

windows10-2004-x64

1

BIN/MDECli...on.exe

windows11-21h2-x64

1

BIN/Procmon.exe

windows10-2004-x64

8

BIN/Procmon.exe

windows11-21h2-x64

8

BIN/SQLCheck.exe

windows10-2004-x64

5

BIN/SQLCheck.exe

windows11-21h2-x64

5

BIN/Showpriv.exe

windows10-2004-x64

3

BIN/Showpriv.exe

windows11-21h2-x64

3

BIN/Sysmon.exe

windows10-2004-x64

4

BIN/Sysmon.exe

windows11-21h2-x64

4

BIN/VmlTrace.exe

windows10-2004-x64

1

BIN/VmlTrace_2012.exe

windows10-2004-x64

1

BIN/VmlTrace_2012.exe

windows11-21h2-x64

1

BIN/WinHTTPDiag.exe

windows10-2004-x64

1

BIN/WinHTTPDiag.exe

windows11-21h2-x64

1

BIN/accesschk.exe

windows10-2004-x64

3

BIN/accesschk.exe

windows11-21h2-x64

3

BIN/autorunsc.exe

windows10-2004-x64

3

BIN/autorunsc.exe

windows11-21h2-x64

3

BIN/avdnettest.exe

windows10-2004-x64

1

BIN/avdnettest.exe

windows11-21h2-x64

1

BIN/diskspd.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    149s
  • max time network
    116s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    08/04/2026, 00:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    BIN/SQLCheck.exe
  • Size 180KB
  • Sample260408-ap29lsgs41
  • SHA256 41c4ce0a9260637568a6c70f0cfa53861b2f2cd16be4d7b5fff8059fb09befad
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
discoverypersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
    discovery
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\BIN\SQLCheck.exe
    "C:\Users\Admin\AppData\Local\Temp\BIN\SQLCheck.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4224
    • C:\Windows\SYSTEM32\NETSH.EXE
      "NETSH.EXE" INT TCP SHOW GLOBAL
      2⤵
      • Event Triggered Execution: Netsh Helper DLL
      PID:1936
    • C:\Windows\SYSTEM32\NETSH.EXE
      "NETSH.EXE" INT IPV4 SHOW DYNAMICPORT TCP
      2⤵
      • Event Triggered Execution: Netsh Helper DLL
      PID:1080
    • C:\Windows\SYSTEM32\FLTMC.EXE
      "FLTMC.EXE"
      2⤵
        PID:2920
      • C:\Windows\SYSTEM32\TASKLIST.EXE
        "TASKLIST.EXE" /M /FO CSV
        2⤵
        • Enumerates processes with tasklist
        PID:4820

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/4224-0-0x00000000008F0000-0x0000000000920000-memory.dmp
          Download

          memory/4224-1-0x0000000002B10000-0x0000000002B32000-memory.dmp
          Download

          memory/4224-2-0x000000001B780000-0x000000001B790000-memory.dmp
          Download

          memory/4224-6-0x000000001B5D0000-0x000000001B67F000-memory.dmp
          Download

          memory/4820-3-0x000002B5FB1F0000-0x000002B5FB29F000-memory.dmp
          Download