Overview

overview

6

Static

static

1

SQLTest_4....36.exe

windows10-2004-x64

6

SQLTest_4....36.exe

windows11-21h2-x64

6

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    03/06/2026, 18:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SQLTest_4.4.7.5436.exe
  • Size 9.8MB
  • Sample260603-wwvzrsdv21
  • SHA256 d7c0073991a99b6a045da6535719545117d86c28d468acd3789573f18847a1ca
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasiondiscoveryspywaretrojan

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 42 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies system certificate store 2 TTPs 5 IoCs
    defense_evasionspywaretrojan
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SQLTest_4.4.7.5436.exe
    "C:\Users\Admin\AppData\Local\Temp\SQLTest_4.4.7.5436.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4760
    • C:\Users\Admin\AppData\Local\Temp\{A909A0CF-36D4-43FE-88E1-CFC6A691DC16}\RedGate.Installer.UI.App.exe
      "C:\Users\Admin\AppData\Local\Temp\{A909A0CF-36D4-43FE-88E1-CFC6A691DC16}\RedGate.Installer.UI.App.exe"
      2⤵
      • Enumerates connected drives
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:4736
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4364
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 642F378631E70719A988645A24F323EE C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:1728

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
        • Size 471B
        • SHA256 ab82962b753c4f4f6672e88b0dd09c63a3864d62b8e47a4e569c9c09a3de2c4f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
        • Size 400B
        • SHA256 772eef8b54d5cf5bd8da72a1cc10fc6969c6e89bcb1cee6e79c3aed7ae98adf6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
        • Size 412B
        • SHA256 749e2a8858a4c5035619d96f8b2ae0bf6278568c73d33d9edfab0b9d0d50e323
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Autofac.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{A909A0CF-36D4-43FE-88E1-CFC6A691DC16}\Autofac.dll
        • Size 186KB
        • SHA256 8aaec6c836bfe934799e1f28588e6426be5d5158ebcfd4b9e0a17b5293764f46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        INTERNAL_sql test_4.4.7.5436_x86.msi
        • Path C:\Users\Admin\AppData\Local\Temp\{A909A0CF-36D4-43FE-88E1-CFC6A691DC16}\INTERNAL_sql test_4.4.7.5436_x86.msi
        • Size 180KB
        • SHA256 b155367d11816a20bd69a54cf4e8067d8f33c4041d6e6ff2948353add24a4327
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Newtonsoft.Json.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{A909A0CF-36D4-43FE-88E1-CFC6A691DC16}\Newtonsoft.Json.dll
        • Size 704KB
        • SHA256 f0c07af0e84d4dd4da4bd7823ba4535bc0481b3bf623ed40b659b68147a6bb75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ProjectItems.xml
        • Path C:\Users\Admin\AppData\Local\Temp\{A909A0CF-36D4-43FE-88E1-CFC6A691DC16}\ProjectItems.xml
        • Size 283B
        • SHA256 efe7802960e5c5ff1538c3f87be94af964be7f062e70fb26db811499f99763d0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        RedGate.CompressEngine.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{A909A0CF-36D4-43FE-88E1-CFC6A691DC16}\RedGate.CompressEngine.dll
        • Size 42KB
        • SHA256 4985b9ea69e0ba4b7ed048973c5ce10129caf502ee27b074e5a0a8d68da2237b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RedGate.Honeycomb.Wpf.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{A909A0CF-36D4-43FE-88E1-CFC6A691DC16}\RedGate.Honeycomb.Wpf.dll
        • Size 176KB
        • SHA256 5b240ef83fa1b00bec83f7bd2fa376f113a4159eeee1a13f3d55091a20dba920
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RedGate.Installer.Adapter.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{A909A0CF-36D4-43FE-88E1-CFC6A691DC16}\RedGate.Installer.Adapter.dll
        • Size 66KB
        • SHA256 20496f77ae854d04128c8d6a2801eba8cf55c5f5d15005f459b872030fae9e75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RedGate.Installer.CompressionInterfaces.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{A909A0CF-36D4-43FE-88E1-CFC6A691DC16}\RedGate.Installer.CompressionInterfaces.dll
        • Size 16KB
        • SHA256 ca303a60a98cc60847ae7f4c6136f87a155452f37cf39c2f74ac2ddd4b2cecde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RedGate.Installer.Compressors.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{A909A0CF-36D4-43FE-88E1-CFC6A691DC16}\RedGate.Installer.Compressors.dll
        • Size 54KB
        • SHA256 77cff41f805abe138364a2aaad485294be3298cfbe7186c75c89d7474a86cb7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RedGate.Installer.Logging.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{A909A0CF-36D4-43FE-88E1-CFC6A691DC16}\RedGate.Installer.Logging.dll
        • Size 20KB
        • SHA256 754b2b0b9b87dab1a3044ccf22562695974f86a31b79c36cbfbaaa758b9bb289
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RedGate.Installer.LongFileName.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{A909A0CF-36D4-43FE-88E1-CFC6A691DC16}\RedGate.Installer.LongFileName.dll
        • Size 24KB
        • SHA256 5a281068b13b5aaebd9e7720be4b7a37796cc680df02521fc89c3ffc79747ff3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RedGate.Installer.Model.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{A909A0CF-36D4-43FE-88E1-CFC6A691DC16}\RedGate.Installer.Model.dll
        • Size 46KB
        • SHA256 0b6a63ab64aa5651fbece6fe0a45c98a1205d460fcbf236c4fbf457f3cb02c6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RedGate.Installer.ParameterParsing.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{A909A0CF-36D4-43FE-88E1-CFC6A691DC16}\RedGate.Installer.ParameterParsing.dll
        • Size 21KB
        • SHA256 7e670be8a97472c3905ffff5d9a82339e876b52cb72d4af712561782928ccb07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RedGate.Installer.ThreadHelper.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{A909A0CF-36D4-43FE-88E1-CFC6A691DC16}\RedGate.Installer.ThreadHelper.dll
        • Size 17KB
        • SHA256 e9041524a449605668ceb4a593bd20d64f12a0d18e631f09fe1a20825a61ee9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RedGate.Installer.UI.App.exe
        • Path C:\Users\Admin\AppData\Local\Temp\{A909A0CF-36D4-43FE-88E1-CFC6A691DC16}\RedGate.Installer.UI.App.exe
        • Size 152KB
        • SHA256 926238ba07a7dc55d9c398a1f8bfde64ef787e628b92082e8d040159bc80fedc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RedGate.Installer.UI.App.exe.config
        • Path C:\Users\Admin\AppData\Local\Temp\{A909A0CF-36D4-43FE-88E1-CFC6A691DC16}\RedGate.Installer.UI.App.exe.config
        • Size 608B
        • SHA256 3c54e2c6d5c866695d4865fbd8fa3ef386942d1198f061d8fe5469a8bba64a31
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        RedGate.Installer.UI.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{A909A0CF-36D4-43FE-88E1-CFC6A691DC16}\RedGate.Installer.UI.dll
        • Size 252KB
        • SHA256 f4c074fdd538fa8f0534edc37427b935d60ec5be063f8c9759bf48e9421e0cad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RedGate.InstallerEngine.Interfaces.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{A909A0CF-36D4-43FE-88E1-CFC6A691DC16}\RedGate.InstallerEngine.Interfaces.dll
        • Size 20KB
        • SHA256 843fea41587a9243a3eb2daa4bdf0455acbaaf888c0cce9ca974e90cad16ea95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RedGate.InstallerEngine.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{A909A0CF-36D4-43FE-88E1-CFC6A691DC16}\RedGate.InstallerEngine.dll
        • Size 109KB
        • SHA256 6088bca733b5a4ebf65fffaf800ca0c5e812665c5f44e564cce51f32e333e9dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RedGate.Usage.Client.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{A909A0CF-36D4-43FE-88E1-CFC6A691DC16}\RedGate.Usage.Client.dll
        • Size 144KB
        • SHA256 b041e5c847b9bc2c53ec6a7588583ca4de0e431680f8f0a2da18454e4f1c6309
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MahApps.Metro.dll.~1
        • Path C:\Users\Admin\AppData\Local\Temp\{A909A0CF-36D4-43FE-88E1-CFC6A691DC16}\SQL Test\Red Gate\Uninstaller\MahApps.Metro.dll.~1
        • Size 830KB
        • SHA256 af947674017156baee5b0fd1128650f35d4ba62e1565d87d8aefe02321f423c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Deployment.WindowsInstaller.dll.~1
        • Path C:\Users\Admin\AppData\Local\Temp\{A909A0CF-36D4-43FE-88E1-CFC6A691DC16}\SQL Test\Red Gate\Uninstaller\Microsoft.Deployment.WindowsInstaller.dll.~1
        • Size 176KB
        • SHA256 b1a3721e374af26f54dde662166f355622a77b447e078dad4e22123df33ce1a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RedGate.Installer.ProductParsing.dll.~1
        • Path C:\Users\Admin\AppData\Local\Temp\{A909A0CF-36D4-43FE-88E1-CFC6A691DC16}\SQL Test\Red Gate\Uninstaller\RedGate.Installer.ProductParsing.dll.~1
        • Size 17KB
        • SHA256 80a2a687bd863f1bb61f851ccbf786ac5fb45ad9630ea449345983e25f8ba9a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RedGate.Win32.dll.~1
        • Path C:\Users\Admin\AppData\Local\Temp\{A909A0CF-36D4-43FE-88E1-CFC6A691DC16}\SQL Test\Red Gate\Uninstaller\RedGate.Win32.dll.~1
        • Size 56KB
        • SHA256 411c6bebddedbb73854465bb2c025ddd477c570fe84714eff56dff08f7e9ab96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SQL Test_4.4.7.5436_x86.msi.~1
        • Path C:\Users\Admin\AppData\Local\Temp\{A909A0CF-36D4-43FE-88E1-CFC6A691DC16}\SQL Test\SQL Test_4.4.7.5436_x86.msi.~1
        • Size 976KB
        • SHA256 c4f0c375bd44bd5ec38eb2c66d50d8163a6d8dc83e86c913b352a2f65659d7c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SQLToolBeltInstaller.project
        • Path C:\Users\Admin\AppData\Local\Temp\{A909A0CF-36D4-43FE-88E1-CFC6A691DC16}\SQLToolBeltInstaller.project
        • Size 92KB
        • SHA256 a28888df00d475f6b1c5fcc3d16809f18e96096257b2df5e0100e00aa80ff6c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Serilog.Sinks.File.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{A909A0CF-36D4-43FE-88E1-CFC6A691DC16}\Serilog.Sinks.File.dll
        • Size 27KB
        • SHA256 6d8d84c9c14201674d9a309f51e952cf148ad33cdb66507d9677ebf1b1e4432b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Serilog.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{A909A0CF-36D4-43FE-88E1-CFC6A691DC16}\Serilog.dll
        • Size 123KB
        • SHA256 7a26a473af5eb7a00196e275c86d773f36e1d4caef566f97f1df7e07e20b1670
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        install.bin
        • Path C:\Users\Admin\AppData\Local\Temp\{A909A0CF-36D4-43FE-88E1-CFC6A691DC16}\install.bin
        • Size 3.8MB
        • SHA256 320478e0f360900c8aad9277a730044a82ff003b749f8de8b79df2daebf88a91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4736-85-0x0000000005E20000-0x0000000005E28000-memory.dmp
        Download

        memory/4736-81-0x00000000066C0000-0x0000000006726000-memory.dmp
        Download

        memory/4736-117-0x0000000006CB0000-0x0000000006CC0000-memory.dmp
        Download

        memory/4736-103-0x0000000006970000-0x0000000006A02000-memory.dmp
        Download

        memory/4736-102-0x00000000068A0000-0x00000000068A8000-memory.dmp
        Download

        memory/4736-129-0x000000000BBF0000-0x000000000BC56000-memory.dmp
        Download

        memory/4736-138-0x000000000D4D0000-0x000000000DA74000-memory.dmp
        Download

        memory/4736-98-0x00000000068B0000-0x00000000068CE000-memory.dmp
        Download

        memory/4736-127-0x000000000B3E0000-0x000000000B410000-memory.dmp
        Download

        memory/4736-95-0x0000000006880000-0x000000000688E000-memory.dmp
        Download

        memory/4736-123-0x000000000B470000-0x000000000B524000-memory.dmp
        Download

        memory/4736-139-0x000000000DA80000-0x000000000DFAC000-memory.dmp
        Download

        memory/4736-90-0x0000000006660000-0x0000000006668000-memory.dmp
        Download

        memory/4736-86-0x0000000006730000-0x000000000677A000-memory.dmp
        Download

        memory/4736-80-0x00000000064B0000-0x000000000654C000-memory.dmp
        Download

        memory/4736-79-0x0000000006040000-0x0000000006202000-memory.dmp
        Download

        memory/4736-113-0x0000000006C90000-0x0000000006C98000-memory.dmp
        Download

        memory/4736-108-0x00000000068D0000-0x00000000068DA000-memory.dmp
        Download

        memory/4736-66-0x0000000005BE0000-0x0000000005BEE000-memory.dmp
        Download

        memory/4736-78-0x0000000005E40000-0x0000000005E66000-memory.dmp
        Download

        memory/4736-74-0x0000000005C50000-0x0000000005C64000-memory.dmp
        Download

        memory/4736-62-0x0000000005C80000-0x0000000005CC2000-memory.dmp
        Download

        memory/4736-70-0x0000000005CD0000-0x0000000005D06000-memory.dmp
        Download

        memory/4736-141-0x000000000C610000-0x000000000C6E6000-memory.dmp
        Download

        memory/4736-142-0x0000000006FC0000-0x000000000707A000-memory.dmp
        Download

        memory/4736-54-0x0000000005C00000-0x0000000005C26000-memory.dmp
        Download

        memory/4736-58-0x0000000005BD0000-0x0000000005BDE000-memory.dmp
        Download

        memory/4736-50-0x0000000005650000-0x0000000005658000-memory.dmp
        Download

        memory/4736-46-0x00000000056B0000-0x00000000056C0000-memory.dmp
        Download

        memory/4736-45-0x0000000000E40000-0x0000000000E68000-memory.dmp
        Download

        memory/4736-454-0x0000000006800000-0x0000000006812000-memory.dmp
        Download

        memory/4736-455-0x0000000006870000-0x0000000006878000-memory.dmp
        Download

        memory/4736-456-0x00000000082F0000-0x0000000008328000-memory.dmp
        Download

        memory/4736-457-0x00000000082C0000-0x00000000082CE000-memory.dmp
        Download

        memory/4736-458-0x00000000056B0000-0x00000000056C0000-memory.dmp
        Download