Overview

overview

6

Static

static

1

SQLTest_4....36.exe

windows10-2004-x64

6

SQLTest_4....36.exe

windows11-21h2-x64

6

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    03/06/2026, 18:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SQLTest_4.4.7.5436.exe
  • Size 9.8MB
  • Sample260603-wwvzrsdv21
  • SHA256 d7c0073991a99b6a045da6535719545117d86c28d468acd3789573f18847a1ca
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasiondiscoveryspywaretrojan

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 42 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies system certificate store 2 TTPs 5 IoCs
    defense_evasionspywaretrojan
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SQLTest_4.4.7.5436.exe
    "C:\Users\Admin\AppData\Local\Temp\SQLTest_4.4.7.5436.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2144
    • C:\Users\Admin\AppData\Local\Temp\{58571463-B7BA-460F-9F7D-2D1FD0999025}\RedGate.Installer.UI.App.exe
      "C:\Users\Admin\AppData\Local\Temp\{58571463-B7BA-460F-9F7D-2D1FD0999025}\RedGate.Installer.UI.App.exe"
      2⤵
      • Enumerates connected drives
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:1000
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2836
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding E64CBA17C39D5D463A278002CF35D442 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:5080

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
        • Size 471B
        • SHA256 ab82962b753c4f4f6672e88b0dd09c63a3864d62b8e47a4e569c9c09a3de2c4f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
        • Size 400B
        • SHA256 3f1974246ed38281efd2dde696ee7621b5e66255c188b08b38c86adebdcdd88d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
        • Size 412B
        • SHA256 e6c93323851b8b5df7b3b05976795436ad2a96bfcfd04cf26f3d1751d9cba21c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Autofac.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{58571463-B7BA-460F-9F7D-2D1FD0999025}\Autofac.dll
        • Size 186KB
        • SHA256 8aaec6c836bfe934799e1f28588e6426be5d5158ebcfd4b9e0a17b5293764f46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        INTERNAL_sql test_4.4.7.5436_x86.msi
        • Path C:\Users\Admin\AppData\Local\Temp\{58571463-B7BA-460F-9F7D-2D1FD0999025}\INTERNAL_sql test_4.4.7.5436_x86.msi
        • Size 180KB
        • SHA256 b155367d11816a20bd69a54cf4e8067d8f33c4041d6e6ff2948353add24a4327
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Newtonsoft.Json.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{58571463-B7BA-460F-9F7D-2D1FD0999025}\Newtonsoft.Json.dll
        • Size 704KB
        • SHA256 f0c07af0e84d4dd4da4bd7823ba4535bc0481b3bf623ed40b659b68147a6bb75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ProjectItems.xml
        • Path C:\Users\Admin\AppData\Local\Temp\{58571463-B7BA-460F-9F7D-2D1FD0999025}\ProjectItems.xml
        • Size 283B
        • SHA256 efe7802960e5c5ff1538c3f87be94af964be7f062e70fb26db811499f99763d0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        RedGate.CompressEngine.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{58571463-B7BA-460F-9F7D-2D1FD0999025}\RedGate.CompressEngine.dll
        • Size 42KB
        • SHA256 4985b9ea69e0ba4b7ed048973c5ce10129caf502ee27b074e5a0a8d68da2237b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RedGate.Honeycomb.Wpf.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{58571463-B7BA-460F-9F7D-2D1FD0999025}\RedGate.Honeycomb.Wpf.dll
        • Size 176KB
        • SHA256 5b240ef83fa1b00bec83f7bd2fa376f113a4159eeee1a13f3d55091a20dba920
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RedGate.Installer.Adapter.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{58571463-B7BA-460F-9F7D-2D1FD0999025}\RedGate.Installer.Adapter.dll
        • Size 66KB
        • SHA256 20496f77ae854d04128c8d6a2801eba8cf55c5f5d15005f459b872030fae9e75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RedGate.Installer.CompressionInterfaces.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{58571463-B7BA-460F-9F7D-2D1FD0999025}\RedGate.Installer.CompressionInterfaces.dll
        • Size 16KB
        • SHA256 ca303a60a98cc60847ae7f4c6136f87a155452f37cf39c2f74ac2ddd4b2cecde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RedGate.Installer.Compressors.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{58571463-B7BA-460F-9F7D-2D1FD0999025}\RedGate.Installer.Compressors.dll
        • Size 54KB
        • SHA256 77cff41f805abe138364a2aaad485294be3298cfbe7186c75c89d7474a86cb7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RedGate.Installer.Logging.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{58571463-B7BA-460F-9F7D-2D1FD0999025}\RedGate.Installer.Logging.dll
        • Size 20KB
        • SHA256 754b2b0b9b87dab1a3044ccf22562695974f86a31b79c36cbfbaaa758b9bb289
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RedGate.Installer.LongFileName.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{58571463-B7BA-460F-9F7D-2D1FD0999025}\RedGate.Installer.LongFileName.dll
        • Size 24KB
        • SHA256 5a281068b13b5aaebd9e7720be4b7a37796cc680df02521fc89c3ffc79747ff3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RedGate.Installer.Model.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{58571463-B7BA-460F-9F7D-2D1FD0999025}\RedGate.Installer.Model.dll
        • Size 46KB
        • SHA256 0b6a63ab64aa5651fbece6fe0a45c98a1205d460fcbf236c4fbf457f3cb02c6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RedGate.Installer.ParameterParsing.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{58571463-B7BA-460F-9F7D-2D1FD0999025}\RedGate.Installer.ParameterParsing.dll
        • Size 21KB
        • SHA256 7e670be8a97472c3905ffff5d9a82339e876b52cb72d4af712561782928ccb07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RedGate.Installer.ThreadHelper.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{58571463-B7BA-460F-9F7D-2D1FD0999025}\RedGate.Installer.ThreadHelper.dll
        • Size 17KB
        • SHA256 e9041524a449605668ceb4a593bd20d64f12a0d18e631f09fe1a20825a61ee9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RedGate.Installer.UI.App.exe
        • Path C:\Users\Admin\AppData\Local\Temp\{58571463-B7BA-460F-9F7D-2D1FD0999025}\RedGate.Installer.UI.App.exe
        • Size 152KB
        • SHA256 926238ba07a7dc55d9c398a1f8bfde64ef787e628b92082e8d040159bc80fedc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RedGate.Installer.UI.App.exe.config
        • Path C:\Users\Admin\AppData\Local\Temp\{58571463-B7BA-460F-9F7D-2D1FD0999025}\RedGate.Installer.UI.App.exe.config
        • Size 608B
        • SHA256 3c54e2c6d5c866695d4865fbd8fa3ef386942d1198f061d8fe5469a8bba64a31
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        RedGate.Installer.UI.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{58571463-B7BA-460F-9F7D-2D1FD0999025}\RedGate.Installer.UI.dll
        • Size 252KB
        • SHA256 f4c074fdd538fa8f0534edc37427b935d60ec5be063f8c9759bf48e9421e0cad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RedGate.InstallerEngine.Interfaces.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{58571463-B7BA-460F-9F7D-2D1FD0999025}\RedGate.InstallerEngine.Interfaces.dll
        • Size 20KB
        • SHA256 843fea41587a9243a3eb2daa4bdf0455acbaaf888c0cce9ca974e90cad16ea95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RedGate.InstallerEngine.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{58571463-B7BA-460F-9F7D-2D1FD0999025}\RedGate.InstallerEngine.dll
        • Size 109KB
        • SHA256 6088bca733b5a4ebf65fffaf800ca0c5e812665c5f44e564cce51f32e333e9dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RedGate.Usage.Client.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{58571463-B7BA-460F-9F7D-2D1FD0999025}\RedGate.Usage.Client.dll
        • Size 144KB
        • SHA256 b041e5c847b9bc2c53ec6a7588583ca4de0e431680f8f0a2da18454e4f1c6309
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MahApps.Metro.dll.~1
        • Path C:\Users\Admin\AppData\Local\Temp\{58571463-B7BA-460F-9F7D-2D1FD0999025}\SQL Test\Red Gate\Uninstaller\MahApps.Metro.dll.~1
        • Size 830KB
        • SHA256 af947674017156baee5b0fd1128650f35d4ba62e1565d87d8aefe02321f423c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Deployment.WindowsInstaller.dll.~1
        • Path C:\Users\Admin\AppData\Local\Temp\{58571463-B7BA-460F-9F7D-2D1FD0999025}\SQL Test\Red Gate\Uninstaller\Microsoft.Deployment.WindowsInstaller.dll.~1
        • Size 176KB
        • SHA256 b1a3721e374af26f54dde662166f355622a77b447e078dad4e22123df33ce1a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RedGate.Installer.ProductParsing.dll.~1
        • Path C:\Users\Admin\AppData\Local\Temp\{58571463-B7BA-460F-9F7D-2D1FD0999025}\SQL Test\Red Gate\Uninstaller\RedGate.Installer.ProductParsing.dll.~1
        • Size 17KB
        • SHA256 80a2a687bd863f1bb61f851ccbf786ac5fb45ad9630ea449345983e25f8ba9a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RedGate.Win32.dll.~1
        • Path C:\Users\Admin\AppData\Local\Temp\{58571463-B7BA-460F-9F7D-2D1FD0999025}\SQL Test\Red Gate\Uninstaller\RedGate.Win32.dll.~1
        • Size 56KB
        • SHA256 411c6bebddedbb73854465bb2c025ddd477c570fe84714eff56dff08f7e9ab96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SQL Test_4.4.7.5436_x86.msi.~1
        • Path C:\Users\Admin\AppData\Local\Temp\{58571463-B7BA-460F-9F7D-2D1FD0999025}\SQL Test\SQL Test_4.4.7.5436_x86.msi.~1
        • Size 976KB
        • SHA256 c4f0c375bd44bd5ec38eb2c66d50d8163a6d8dc83e86c913b352a2f65659d7c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SQLToolBeltInstaller.project
        • Path C:\Users\Admin\AppData\Local\Temp\{58571463-B7BA-460F-9F7D-2D1FD0999025}\SQLToolBeltInstaller.project
        • Size 92KB
        • SHA256 a28888df00d475f6b1c5fcc3d16809f18e96096257b2df5e0100e00aa80ff6c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Serilog.Sinks.File.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{58571463-B7BA-460F-9F7D-2D1FD0999025}\Serilog.Sinks.File.dll
        • Size 27KB
        • SHA256 6d8d84c9c14201674d9a309f51e952cf148ad33cdb66507d9677ebf1b1e4432b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Serilog.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{58571463-B7BA-460F-9F7D-2D1FD0999025}\Serilog.dll
        • Size 123KB
        • SHA256 7a26a473af5eb7a00196e275c86d773f36e1d4caef566f97f1df7e07e20b1670
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        install.bin
        • Path C:\Users\Admin\AppData\Local\Temp\{58571463-B7BA-460F-9F7D-2D1FD0999025}\install.bin
        • Size 3.8MB
        • SHA256 320478e0f360900c8aad9277a730044a82ff003b749f8de8b79df2daebf88a91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1000-81-0x0000000005C50000-0x0000000005CB6000-memory.dmp
        Download

        memory/1000-78-0x00000000053D0000-0x00000000053F6000-memory.dmp
        Download

        memory/1000-85-0x00000000053C0000-0x00000000053C8000-memory.dmp
        Download

        memory/1000-108-0x0000000005F50000-0x0000000005F5A000-memory.dmp
        Download

        memory/1000-119-0x000000000ABC0000-0x000000000AC26000-memory.dmp
        Download

        memory/1000-79-0x00000000055D0000-0x0000000005792000-memory.dmp
        Download

        memory/1000-74-0x00000000052E0000-0x00000000052F4000-memory.dmp
        Download

        memory/1000-124-0x000000000ACF0000-0x000000000ADA4000-memory.dmp
        Download

        memory/1000-70-0x0000000005360000-0x0000000005396000-memory.dmp
        Download

        memory/1000-128-0x000000000AC60000-0x000000000AC90000-memory.dmp
        Download

        memory/1000-66-0x0000000005280000-0x000000000528E000-memory.dmp
        Download

        memory/1000-129-0x000000000B360000-0x000000000B906000-memory.dmp
        Download

        memory/1000-103-0x0000000006030000-0x00000000060C2000-memory.dmp
        Download

        memory/1000-58-0x0000000005270000-0x000000000527E000-memory.dmp
        Download

        memory/1000-98-0x0000000005F70000-0x0000000005F8E000-memory.dmp
        Download

        memory/1000-117-0x0000000005F90000-0x0000000005FA0000-memory.dmp
        Download

        memory/1000-54-0x0000000005290000-0x00000000052B6000-memory.dmp
        Download

        memory/1000-95-0x0000000005C30000-0x0000000005C3E000-memory.dmp
        Download

        memory/1000-452-0x0000000006600000-0x00000000066D6000-memory.dmp
        Download

        memory/1000-50-0x00000000027A0000-0x00000000027A8000-memory.dmp
        Download

        memory/1000-46-0x0000000004ED0000-0x0000000004EE0000-memory.dmp
        Download

        memory/1000-45-0x00000000002D0000-0x00000000002F8000-memory.dmp
        Download

        memory/1000-102-0x0000000005C40000-0x0000000005C48000-memory.dmp
        Download

        memory/1000-80-0x0000000005A40000-0x0000000005ADC000-memory.dmp
        Download

        memory/1000-90-0x0000000005C10000-0x0000000005C18000-memory.dmp
        Download

        memory/1000-86-0x0000000005DC0000-0x0000000005E0A000-memory.dmp
        Download

        memory/1000-62-0x0000000005310000-0x0000000005352000-memory.dmp
        Download

        memory/1000-451-0x000000000D680000-0x000000000DBAC000-memory.dmp
        Download

        memory/1000-113-0x0000000005F60000-0x0000000005F68000-memory.dmp
        Download

        memory/1000-453-0x00000000069A0000-0x0000000006A5A000-memory.dmp
        Download

        memory/1000-454-0x0000000006910000-0x0000000006922000-memory.dmp
        Download

        memory/1000-455-0x0000000006980000-0x0000000006988000-memory.dmp
        Download

        memory/1000-456-0x0000000008110000-0x0000000008148000-memory.dmp
        Download

        memory/1000-457-0x00000000080F0000-0x00000000080FE000-memory.dmp
        Download

        memory/1000-458-0x0000000004ED0000-0x0000000004EE0000-memory.dmp
        Download

        memory/1000-459-0x0000000004ED0000-0x0000000004EE0000-memory.dmp
        Download