Overview

overview

6

Static

static

1

SQLTest_4....36.exe

windows10-2004-x64

6

SQLTest_4....36.exe

windows11-21h2-x64

6

Analysis

  • max time kernel
    149s
  • max time network
    130s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    02/06/2026, 12:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SQLTest_4.4.7.5436.exe
  • Size 9.8MB
  • Sample260602-pec93adz4q
  • SHA256 d7c0073991a99b6a045da6535719545117d86c28d468acd3789573f18847a1ca
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasiondiscoveryspywaretrojan

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 42 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies system certificate store 2 TTPs 5 IoCs
    defense_evasionspywaretrojan
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SQLTest_4.4.7.5436.exe
    "C:\Users\Admin\AppData\Local\Temp\SQLTest_4.4.7.5436.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4168
    • C:\Users\Admin\AppData\Local\Temp\{406FB9F2-9E90-4A6A-83D7-F87AE4D53CDD}\RedGate.Installer.UI.App.exe
      "C:\Users\Admin\AppData\Local\Temp\{406FB9F2-9E90-4A6A-83D7-F87AE4D53CDD}\RedGate.Installer.UI.App.exe"
      2⤵
      • Enumerates connected drives
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:1984
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4812
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 40188D4C3FBD42AC9713DF553DFB9728 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:2616

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
        • Size 471B
        • SHA256 65362c5950270d1450c4ad1d3e020bee110c9e78161de2b9729d4146d3415c42
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
        • Size 400B
        • SHA256 a2ae142171b0a8bf3dce13ae0f8d90a3fc96e5805e487af0236a742355010620
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
        • Size 412B
        • SHA256 d3e62d0abe2b6cb5d1293d4254b33f02d89f1fb9c8480f96b595ad37d093d63a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Autofac.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{406FB9F2-9E90-4A6A-83D7-F87AE4D53CDD}\Autofac.dll
        • Size 186KB
        • SHA256 8aaec6c836bfe934799e1f28588e6426be5d5158ebcfd4b9e0a17b5293764f46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        INTERNAL_sql test_4.4.7.5436_x86.msi
        • Path C:\Users\Admin\AppData\Local\Temp\{406FB9F2-9E90-4A6A-83D7-F87AE4D53CDD}\INTERNAL_sql test_4.4.7.5436_x86.msi
        • Size 180KB
        • SHA256 b155367d11816a20bd69a54cf4e8067d8f33c4041d6e6ff2948353add24a4327
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Newtonsoft.Json.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{406FB9F2-9E90-4A6A-83D7-F87AE4D53CDD}\Newtonsoft.Json.dll
        • Size 704KB
        • SHA256 f0c07af0e84d4dd4da4bd7823ba4535bc0481b3bf623ed40b659b68147a6bb75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ProjectItems.xml
        • Path C:\Users\Admin\AppData\Local\Temp\{406FB9F2-9E90-4A6A-83D7-F87AE4D53CDD}\ProjectItems.xml
        • Size 283B
        • SHA256 efe7802960e5c5ff1538c3f87be94af964be7f062e70fb26db811499f99763d0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        RedGate.CompressEngine.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{406FB9F2-9E90-4A6A-83D7-F87AE4D53CDD}\RedGate.CompressEngine.dll
        • Size 42KB
        • SHA256 4985b9ea69e0ba4b7ed048973c5ce10129caf502ee27b074e5a0a8d68da2237b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RedGate.Honeycomb.Wpf.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{406FB9F2-9E90-4A6A-83D7-F87AE4D53CDD}\RedGate.Honeycomb.Wpf.dll
        • Size 176KB
        • SHA256 5b240ef83fa1b00bec83f7bd2fa376f113a4159eeee1a13f3d55091a20dba920
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RedGate.Installer.Adapter.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{406FB9F2-9E90-4A6A-83D7-F87AE4D53CDD}\RedGate.Installer.Adapter.dll
        • Size 66KB
        • SHA256 20496f77ae854d04128c8d6a2801eba8cf55c5f5d15005f459b872030fae9e75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RedGate.Installer.CompressionInterfaces.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{406FB9F2-9E90-4A6A-83D7-F87AE4D53CDD}\RedGate.Installer.CompressionInterfaces.dll
        • Size 16KB
        • SHA256 ca303a60a98cc60847ae7f4c6136f87a155452f37cf39c2f74ac2ddd4b2cecde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RedGate.Installer.Compressors.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{406FB9F2-9E90-4A6A-83D7-F87AE4D53CDD}\RedGate.Installer.Compressors.dll
        • Size 54KB
        • SHA256 77cff41f805abe138364a2aaad485294be3298cfbe7186c75c89d7474a86cb7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RedGate.Installer.Logging.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{406FB9F2-9E90-4A6A-83D7-F87AE4D53CDD}\RedGate.Installer.Logging.dll
        • Size 20KB
        • SHA256 754b2b0b9b87dab1a3044ccf22562695974f86a31b79c36cbfbaaa758b9bb289
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RedGate.Installer.LongFileName.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{406FB9F2-9E90-4A6A-83D7-F87AE4D53CDD}\RedGate.Installer.LongFileName.dll
        • Size 24KB
        • SHA256 5a281068b13b5aaebd9e7720be4b7a37796cc680df02521fc89c3ffc79747ff3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RedGate.Installer.Model.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{406FB9F2-9E90-4A6A-83D7-F87AE4D53CDD}\RedGate.Installer.Model.dll
        • Size 46KB
        • SHA256 0b6a63ab64aa5651fbece6fe0a45c98a1205d460fcbf236c4fbf457f3cb02c6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RedGate.Installer.ParameterParsing.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{406FB9F2-9E90-4A6A-83D7-F87AE4D53CDD}\RedGate.Installer.ParameterParsing.dll
        • Size 21KB
        • SHA256 7e670be8a97472c3905ffff5d9a82339e876b52cb72d4af712561782928ccb07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RedGate.Installer.ThreadHelper.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{406FB9F2-9E90-4A6A-83D7-F87AE4D53CDD}\RedGate.Installer.ThreadHelper.dll
        • Size 17KB
        • SHA256 e9041524a449605668ceb4a593bd20d64f12a0d18e631f09fe1a20825a61ee9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RedGate.Installer.UI.App.exe
        • Path C:\Users\Admin\AppData\Local\Temp\{406FB9F2-9E90-4A6A-83D7-F87AE4D53CDD}\RedGate.Installer.UI.App.exe
        • Size 152KB
        • SHA256 926238ba07a7dc55d9c398a1f8bfde64ef787e628b92082e8d040159bc80fedc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RedGate.Installer.UI.App.exe.config
        • Path C:\Users\Admin\AppData\Local\Temp\{406FB9F2-9E90-4A6A-83D7-F87AE4D53CDD}\RedGate.Installer.UI.App.exe.config
        • Size 608B
        • SHA256 3c54e2c6d5c866695d4865fbd8fa3ef386942d1198f061d8fe5469a8bba64a31
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        RedGate.Installer.UI.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{406FB9F2-9E90-4A6A-83D7-F87AE4D53CDD}\RedGate.Installer.UI.dll
        • Size 252KB
        • SHA256 f4c074fdd538fa8f0534edc37427b935d60ec5be063f8c9759bf48e9421e0cad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RedGate.InstallerEngine.Interfaces.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{406FB9F2-9E90-4A6A-83D7-F87AE4D53CDD}\RedGate.InstallerEngine.Interfaces.dll
        • Size 20KB
        • SHA256 843fea41587a9243a3eb2daa4bdf0455acbaaf888c0cce9ca974e90cad16ea95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RedGate.InstallerEngine.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{406FB9F2-9E90-4A6A-83D7-F87AE4D53CDD}\RedGate.InstallerEngine.dll
        • Size 109KB
        • SHA256 6088bca733b5a4ebf65fffaf800ca0c5e812665c5f44e564cce51f32e333e9dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RedGate.Usage.Client.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{406FB9F2-9E90-4A6A-83D7-F87AE4D53CDD}\RedGate.Usage.Client.dll
        • Size 144KB
        • SHA256 b041e5c847b9bc2c53ec6a7588583ca4de0e431680f8f0a2da18454e4f1c6309
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MahApps.Metro.dll.~1
        • Path C:\Users\Admin\AppData\Local\Temp\{406FB9F2-9E90-4A6A-83D7-F87AE4D53CDD}\SQL Test\Red Gate\Uninstaller\MahApps.Metro.dll.~1
        • Size 830KB
        • SHA256 af947674017156baee5b0fd1128650f35d4ba62e1565d87d8aefe02321f423c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Deployment.WindowsInstaller.dll.~1
        • Path C:\Users\Admin\AppData\Local\Temp\{406FB9F2-9E90-4A6A-83D7-F87AE4D53CDD}\SQL Test\Red Gate\Uninstaller\Microsoft.Deployment.WindowsInstaller.dll.~1
        • Size 176KB
        • SHA256 b1a3721e374af26f54dde662166f355622a77b447e078dad4e22123df33ce1a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RedGate.Installer.ProductParsing.dll.~1
        • Path C:\Users\Admin\AppData\Local\Temp\{406FB9F2-9E90-4A6A-83D7-F87AE4D53CDD}\SQL Test\Red Gate\Uninstaller\RedGate.Installer.ProductParsing.dll.~1
        • Size 17KB
        • SHA256 80a2a687bd863f1bb61f851ccbf786ac5fb45ad9630ea449345983e25f8ba9a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RedGate.Win32.dll.~1
        • Path C:\Users\Admin\AppData\Local\Temp\{406FB9F2-9E90-4A6A-83D7-F87AE4D53CDD}\SQL Test\Red Gate\Uninstaller\RedGate.Win32.dll.~1
        • Size 56KB
        • SHA256 411c6bebddedbb73854465bb2c025ddd477c570fe84714eff56dff08f7e9ab96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SQL Test_4.4.7.5436_x86.msi.~1
        • Path C:\Users\Admin\AppData\Local\Temp\{406FB9F2-9E90-4A6A-83D7-F87AE4D53CDD}\SQL Test\SQL Test_4.4.7.5436_x86.msi.~1
        • Size 976KB
        • SHA256 c4f0c375bd44bd5ec38eb2c66d50d8163a6d8dc83e86c913b352a2f65659d7c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SQLToolBeltInstaller.project
        • Path C:\Users\Admin\AppData\Local\Temp\{406FB9F2-9E90-4A6A-83D7-F87AE4D53CDD}\SQLToolBeltInstaller.project
        • Size 92KB
        • SHA256 a28888df00d475f6b1c5fcc3d16809f18e96096257b2df5e0100e00aa80ff6c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Serilog.Sinks.File.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{406FB9F2-9E90-4A6A-83D7-F87AE4D53CDD}\Serilog.Sinks.File.dll
        • Size 27KB
        • SHA256 6d8d84c9c14201674d9a309f51e952cf148ad33cdb66507d9677ebf1b1e4432b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Serilog.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{406FB9F2-9E90-4A6A-83D7-F87AE4D53CDD}\Serilog.dll
        • Size 123KB
        • SHA256 7a26a473af5eb7a00196e275c86d773f36e1d4caef566f97f1df7e07e20b1670
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        install.bin
        • Path C:\Users\Admin\AppData\Local\Temp\{406FB9F2-9E90-4A6A-83D7-F87AE4D53CDD}\install.bin
        • Size 3.8MB
        • SHA256 320478e0f360900c8aad9277a730044a82ff003b749f8de8b79df2daebf88a91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1984-104-0x0000000006DE0000-0x0000000006DE8000-memory.dmp
        Download

        memory/1984-63-0x0000000006000000-0x0000000006042000-memory.dmp
        Download

        memory/1984-88-0x0000000006C60000-0x0000000006CC6000-memory.dmp
        Download

        memory/1984-119-0x0000000006E30000-0x0000000006E40000-memory.dmp
        Download

        memory/1984-87-0x0000000006AA0000-0x0000000006AEA000-memory.dmp
        Download

        memory/1984-121-0x0000000007650000-0x0000000007BF6000-memory.dmp
        Download

        memory/1984-86-0x00000000065E0000-0x00000000065E8000-memory.dmp
        Download

        memory/1984-126-0x000000000C1A0000-0x000000000C254000-memory.dmp
        Download

        memory/1984-130-0x000000000C390000-0x000000000C3C0000-memory.dmp
        Download

        memory/1984-82-0x00000000067D0000-0x0000000006836000-memory.dmp
        Download

        memory/1984-81-0x0000000006630000-0x00000000066CC000-memory.dmp
        Download

        memory/1984-115-0x0000000006C50000-0x0000000006C58000-memory.dmp
        Download

        memory/1984-80-0x00000000062C0000-0x0000000006482000-memory.dmp
        Download

        memory/1984-79-0x00000000060C0000-0x00000000060E6000-memory.dmp
        Download

        memory/1984-75-0x0000000005FD0000-0x0000000005FE4000-memory.dmp
        Download

        memory/1984-71-0x0000000006050000-0x0000000006086000-memory.dmp
        Download

        memory/1984-67-0x0000000005F70000-0x0000000005F7E000-memory.dmp
        Download

        memory/1984-92-0x0000000006A90000-0x0000000006A98000-memory.dmp
        Download

        memory/1984-110-0x0000000006DF0000-0x0000000006DFA000-memory.dmp
        Download

        memory/1984-59-0x0000000005F60000-0x0000000005F6E000-memory.dmp
        Download

        memory/1984-105-0x0000000006EC0000-0x0000000006F52000-memory.dmp
        Download

        memory/1984-100-0x0000000006E00000-0x0000000006E1E000-memory.dmp
        Download

        memory/1984-97-0x0000000006DD0000-0x0000000006DDE000-memory.dmp
        Download

        memory/1984-55-0x0000000005F80000-0x0000000005FA6000-memory.dmp
        Download

        memory/1984-51-0x0000000005A50000-0x0000000005A58000-memory.dmp
        Download

        memory/1984-453-0x0000000008130000-0x000000000865C000-memory.dmp
        Download

        memory/1984-47-0x0000000005B80000-0x0000000005B90000-memory.dmp
        Download

        memory/1984-46-0x0000000005B80000-0x0000000005B90000-memory.dmp
        Download

        memory/1984-45-0x0000000000FC0000-0x0000000000FE8000-memory.dmp
        Download

        memory/1984-454-0x0000000007200000-0x00000000072D6000-memory.dmp
        Download

        memory/1984-455-0x00000000072E0000-0x000000000739A000-memory.dmp
        Download

        memory/1984-456-0x0000000006E80000-0x0000000006E92000-memory.dmp
        Download

        memory/1984-457-0x0000000006EB0000-0x0000000006EB8000-memory.dmp
        Download

        memory/1984-459-0x0000000008080000-0x000000000808E000-memory.dmp
        Download

        memory/1984-458-0x00000000080B0000-0x00000000080E8000-memory.dmp
        Download

        memory/1984-460-0x0000000005B80000-0x0000000005B90000-memory.dmp
        Download