{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "MS-SQL servers are frequent targets for high-impact ransomware. Brute-force and exploitation of administrative features (xp_cmdshell) are durable TTPs used by Mallox affiliates to achieve initial access." }, "name": "Mallox MS-SQL Exploitation and Initial Delivery", "type": "investigation", "labels": [ "hunt", "attack.t1110", "attack.t1190", "attack.t1059.003", "attack.t1059.001", "attack.t1047" ], "series": { "slug": "mallox-ransomware-affiliate-leverages-purecrypter-in-mssql-exploitation", "index": 1, "title": "Mallox ransomware affiliate leverages PureCrypter in MSSQL exploitation", "total": 2 }, "related": [ { "hunt": "purecrypter-loader-evasion", "reason": "The next phase of this attack involves PureCrypter's anti-analysis and loader behavior.", "relation": "follows" }, { "hunt": "mallox-impact-and-encryption", "reason": "A sibling hunt focusing on the final encryption and shadow copy deletion phases.", "relation": "sibling" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] }, "identity": { "name": "Identity / sign-in telemetry", "category": "identity", "telemetry": [ "identity" ] } }, "analysis": "A rule might flag any shell spawned by sqlservr.exe, but this hunt provides the context of external brute-force and specific staging patterns (redirection to ProgramData) to confirm an active intrusion versus an administrator task.", "coverage": [ { "stage": "sql-brute-force-access", "steps": [ "mssql-brute-force" ], "status": "covered" }, { "stage": "sql-server-exploitation", "steps": [ "sqlservr-child-processes" ], "status": "covered" }, { "stage": "initial-payload-delivery", "steps": [ "scripted-payload-staging" ], "status": "covered" }, { "stage": "loader-evasion-and-anti-analysis", "reason": "Belongs to another part of the 'Mallox ransomware affiliate leverages PureCrypter in MSSQL exploitation' series.", "status": "out_of_scope" }, { "stage": "persistence-run-key", "reason": "Belongs to another part of the 'Mallox ransomware affiliate leverages PureCrypter in MSSQL exploitation' series.", "status": "out_of_scope" }, { "stage": "mallox-ransomware-execution", "reason": "Belongs to another part of the 'Mallox ransomware affiliate leverages PureCrypter in MSSQL exploitation' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "MS-SQL Brute Force", "slug": "sql-brute-force-access", "tactic": "initial-access", "techniques": [ "T1110", "T1190" ], "observables": [ "Brute-force attempts against 'sa' account", "Source IP address in AS208091 (XHost Internet Solution)", "Approximately 320 authentication attempts per minute", "Targeting MS-SQL port (1433)" ] }, { "name": "MS-SQL Feature Exploitation", "slug": "sql-server-exploitation", "tactic": "execution", "techniques": [ "T1059.003" ], "observables": [ "Enabling 'TRUSTWORTHY' database parameter", "Enabling 'clr enabled' parameter", "Creating assembly named 'shell' (SqlShell DLL)", "Creating stored procedure 'cmd_exec'", "Enabling 'xp_cmdshell' configuration", "Enabling 'Ole Automation Procedures'", "Use of 'sp_oacreate' to create 'wscript.shell' OLE object", "Application name 'vYMiFrYR' in SQL connection logs" ] }, { "name": "PowerShell Downloader and WMIC Execution", "slug": "initial-payload-delivery", "tactic": "execution", "techniques": [ "T1059.001", "T1047" ], "observables": [ "echo and redirect used to create PowerShell script", "PowerShell script saved to C:\\ProgramData", "WMIC used to execute downloaded binary", "Downloading multimedia-themed files (e.g., .mp4, .wav, .pdf) containing encrypted payloads" ] }, { "name": "PureCrypter Anti-Analysis and Evasion", "slug": "loader-evasion-and-anti-analysis", "tactic": "defense-evasion", "techniques": [ "T1497.001", "T1562.001", "T1129" ], "observables": [ "WMI query 'select * from Win32_BIOS' to check for VMWare, Virtual, AMI, or Xen", "WMI query 'select * from Win32_ComputerSystem' to check for Microsoft or VMWare", "Process search for 'SbieDll.dll'", "Monitor size check for 1440x900", "Username check for 'john', 'anna', or 'xxxxxxxx'", "Execution of 'ipconfig /renew' and 'ipconfig /release' for network testing", "Patching 'EtwEventWrite' and 'AmsiScanBuffer' in memory", "Adding Windows Defender exclusions via 'MpPreference -Exclusion'" ] }, { "name": "Registry Run Key Persistence", "slug": "persistence-run-key", "tactic": "persistence", "techniques": [ "T1547.001" ], "observables": [ "Registry key addition in 'Software\\Microsoft\\Windows\\CurrentVersion\\Run\\'" ] }, { "name": "Mallox Ransomware Execution", "slug": "mallox-ransomware-execution", "tactic": "impact", "techniques": [ "T1486" ], "observables": [ "Ransomware executable named 'Ydxhjxwf.exe' in %appdata%", "Reflective code loading of stage 2 DLL", "Elevation of process privileges with 'SeDebugPrivilege'" ] } ], "summary": "An affiliate of Mallox ransomware targets internet-facing MS-SQL servers using brute-force attacks against the 'sa' account. Upon gaining access, the attacker exploits SQL features such as CLR assemblies and xp_cmdshell to deliver PureCrypter, a .NET loader that employs extensive anti-analysis and evasion techniques before executing the final Mallox ransomware payload." }, "severity": "high", "rationale": "Focus on servers identified as running Microsoft SQL Server. If the estate is large, prioritize those with external exposure.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An adversary is targeting MS-SQL servers via brute-force of the sa account to execute administrative commands that stage payloads in public directories.", "parameters": { "sa_account": { "from": { "ref": "https://blog.sekoia.io/mallox-ransomware-affiliate-leverages-purecrypter-in-microsoft-sql-exploitation-campaigns/", "kind": "article", "observed": "2024-05-02" }, "type": "string", "default": "sa", "description": "The SQL administrator account name to monitor for brute-force." }, "scope_hosts": { "from": { "ref": "hunt-standard", "kind": "manual", "observed": "2024-05-02" }, "type": "list[host]", "default": [], "description": "Limit the hunt to these hostnames; leave empty to hunt across the entire estate." }, "lookback_days": { "from": { "ref": "hunt-standard", "kind": "manual", "observed": "2024-05-02" }, "type": "number", "default": "14", "description": "Days of history to examine." }, "suspicious_sql_child_procs": { "from": { "ref": "https://blog.sekoia.io/mallox-ransomware-affiliate-leverages-purecrypter-in-microsoft-sql-exploitation-campaigns/", "kind": "article", "observed": "2024-05-02" }, "type": "list[string]", "default": [ "cmd.exe", "powershell.exe", "wmic.exe", "scrcons.exe" ], "description": "Process names spawned by sqlservr.exe that suggest feature abuse." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://blog.sekoia.io/mallox-ransomware-affiliate-leverages-purecrypter-in-microsoft-sql-exploitation-campaigns/", "gates": [ "dry-run", "lint", "critic" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://blog.sekoia.io/mallox-ransomware-affiliate-leverages-purecrypter-in-microsoft-sql-exploitation-campaigns/", "name": "Sekoia \u2014 Mallox ransomware affiliate leverages PureCrypter in MSSQL exploitation" } ], "blind_spots": [ { "id": "no-sql-audit-logs", "risk": "Internal configuration changes in the database engine are invisible to endpoint process monitoring.", "stage": "sql-server-exploitation", "question": "Were 'TRUSTWORTHY' or 'clr enabled' parameters changed?", "requires": "Native MS-SQL Audit logs" }, { "id": "in-memory-assembly", "risk": "The SqlShell malware may run as a reflectively loaded assembly, bypassing file-on-disk and process-launch detection.", "stage": "sql-server-exploitation", "question": "Was a malicious DLL loaded into the SQL process memory?", "requires": "hb_module_activity with CLR monitoring" } ] }, "name": "Mallox MS-SQL Exploitation and Initial Delivery", "description": "This hunt identifies the early stages of a Mallox ransomware intrusion by monitoring the intersection of authentication failure volume, database engine process anomalies, and shell-based payload staging. It specifically targets the exploitation of MS-SQL features like xp_cmdshell or OLE automation used to drop and execute PureCrypter or Mallox loaders." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "mallox-ransomware-affiliate-leverages-purecrypter-in-mssql-exploitation", "index": 1, "title": "Mallox ransomware affiliate leverages PureCrypter in MSSQL exploitation", "total": 2 }, "coverage": [ { "stage": "sql-brute-force-access", "steps": [ "mssql-brute-force" ], "status": "covered" }, { "stage": "sql-server-exploitation", "steps": [ "sqlservr-child-processes" ], "status": "covered" }, { "stage": "initial-payload-delivery", "steps": [ "scripted-payload-staging" ], "status": "covered" }, { "stage": "loader-evasion-and-anti-analysis", "reason": "Belongs to another part of the 'Mallox ransomware affiliate leverages PureCrypter in MSSQL exploitation' series.", "status": "out_of_scope" }, { "stage": "persistence-run-key", "reason": "Belongs to another part of the 'Mallox ransomware affiliate leverages PureCrypter in MSSQL exploitation' series.", "status": "out_of_scope" }, { "stage": "mallox-ransomware-execution", "reason": "Belongs to another part of the 'Mallox ransomware affiliate leverages PureCrypter in MSSQL exploitation' series.", "status": "out_of_scope" } ], "rationale": "An adversary is targeting MS-SQL servers via brute-force of the sa account to execute administrative commands that stage payloads in public directories.", "blind_spots": [ { "id": "no-sql-audit-logs", "risk": "Internal configuration changes in the database engine are invisible to endpoint process monitoring.", "stage": "sql-server-exploitation", "question": "Were 'TRUSTWORTHY' or 'clr enabled' parameters changed?", "requires": "Native MS-SQL Audit logs" }, { "id": "in-memory-assembly", "risk": "The SqlShell malware may run as a reflectively loaded assembly, bypassing file-on-disk and process-launch detection.", "stage": "sql-server-exploitation", "question": "Was a malicious DLL loaded into the SQL process memory?", "requires": "hb_module_activity with CLR monitoring" } ], "scoping_notes": "Focus on servers identified as running Microsoft SQL Server. If the estate is large, prioritize those with external exposure.", "beyond_detection": "A rule might flag any shell spawned by sqlservr.exe, but this hunt provides the context of external brute-force and specific staging patterns (redirection to ProgramData) to confirm an active intrusion versus an administrator task." } }, { "id": "sql-server-inventory", "type": "query", "label": "Identify SQL Server Hosts", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT DISTINCT device_hostname FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%sql server%' OR LOWER(vendor_name) LIKE '%microsoft%sql%')", "surface": "hb_software_inventory", "description": "Scope the hunt to hosts known to run MS-SQL packages.", "expected_signal": "A list of hostnames. Silence indicates no SQL servers are inventoried." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Identify SQL Server Hosts", "reads": [ "device_hostname", "package_name", "vendor_name" ], "source": "hb_software_inventory", "target": "endpoint", "content": "SELECT DISTINCT device_hostname FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%sql server%' OR LOWER(vendor_name) LIKE '%microsoft%sql%')", "silence": "not_evidence_of_absence", "expected": "A list of hostnames. Silence indicates no SQL servers are inventoried.", "verified": "dry-run", "verified_at": "2026-09-17" } }, { "id": "mssql-brute-force", "type": "query", "label": "MS-SQL sa Account Brute-Force", "config": { "dsl": "sqlite", "role": "baseline", "source": "identity", "content": "SELECT src_endpoint_ip, dst_endpoint_name, COUNT(*) as attempt_count, MIN(time) as first_seen, MAX(time) as last_seen FROM hb_auth_signin WHERE LOWER(actor_user_name) = '{{sa_account}}' AND activity_id = 5 AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || dst_endpoint_name || ',') > 0) GROUP BY src_endpoint_ip, dst_endpoint_name HAVING attempt_count > 100 ORDER BY attempt_count DESC", "surface": "hb_auth_signin", "description": "Detect high-frequency login failures on the SQL admin account.", "expected_signal": "One or more source IPs with hundreds of failures. Silence means no sa-targeted brute-force detected." }, "parents": [ { "id": "sql-server-inventory" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "MS-SQL sa Account Brute-Force", "reads": [ "src_endpoint_ip", "dst_endpoint_name", "actor_user_name", "activity_id", "time" ], "source": "hb_auth_signin", "target": "identity", "content": "SELECT src_endpoint_ip, dst_endpoint_name, COUNT(*) as attempt_count, MIN(time) as first_seen, MAX(time) as last_seen FROM hb_auth_signin WHERE LOWER(actor_user_name) = '{{sa_account}}' AND activity_id = 5 AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || dst_endpoint_name || ',') > 0) GROUP BY src_endpoint_ip, dst_endpoint_name HAVING attempt_count > 100 ORDER BY attempt_count DESC", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "new_this_window" }, "expected": "One or more source IPs with hundreds of failures. Silence means no sa-targeted brute-force detected.", "verified": "dry-run", "prevalence": { "by": "dst_endpoint_name", "key": [ "src_endpoint_ip" ], "rare_below": 5 }, "verified_at": "2026-09-17" } }, { "id": "sqlservr-child-processes", "type": "query", "label": "Anomalous SQL Engine Child Processes", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, time FROM hb_process_activity WHERE LOWER(parent_process_name) LIKE '%sqlservr.exe' AND instr(',' || '{{suspicious_sql_child_procs}}' || ',', ',' || LOWER(process_name) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "surface": "hb_process_activity", "description": "Detect instances of sqlservr.exe spawning shells or WMIC, indicative of xp_cmdshell abuse.", "expected_signal": "Rows showing the SQL engine spawning cmd.exe or powershell.exe. Silence proves no such shells were captured by process logging." }, "parents": [ { "id": "sql-server-inventory" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Anomalous SQL Engine Child Processes", "reads": [ "device_hostname", "process_name", "process_cmd_line", "parent_process_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, time FROM hb_process_activity WHERE LOWER(parent_process_name) LIKE '%sqlservr.exe' AND instr(',' || '{{suspicious_sql_child_procs}}' || ',', ',' || LOWER(process_name) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "silence": "evidence_of_absence", "expected": "Rows showing the SQL engine spawning cmd.exe or powershell.exe. Silence proves no such shells were captured by process logging.", "verified": "dry-run", "verified_at": "2026-09-17" } }, { "id": "scripted-payload-staging", "type": "query", "label": "Payload Staging via Echo Redirection", "config": { "dsl": "sqlite", "role": "triage", "source": "endpoint", "content": "SELECT device_hostname, script_path, script_content, time FROM hb_script_activity WHERE (LOWER(script_content) LIKE '%echo%' AND (LOWER(script_content) LIKE '%>%' OR LOWER(script_content) LIKE '%>>%') AND LOWER(script_content) LIKE '%\\programdata\\%') AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "surface": "hb_script_activity", "description": "Find script blocks writing to ProgramData using shell redirection, as seen in Mallox affiliate scripts.", "expected_signal": "Script content showing binary creation or downloader staging. Silence suggests this specific affiliate tradecraft is absent." }, "parents": [ { "id": "sql-server-inventory" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "Payload Staging via Echo Redirection", "reads": [ "device_hostname", "script_path", "script_content", "time" ], "source": "hb_script_activity", "target": "endpoint", "content": "SELECT device_hostname, script_path, script_content, time FROM hb_script_activity WHERE (LOWER(script_content) LIKE '%echo%' AND (LOWER(script_content) LIKE '%>%' OR LOWER(script_content) LIKE '%>>%') AND LOWER(script_content) LIKE '%\\programdata\\%') AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "silence": "not_evidence_of_absence", "expected": "Script content showing binary creation or downloader staging. Silence suggests this specific affiliate tradecraft is absent.", "verified": "dry-run", "verified_at": "2026-09-17" } }, { "id": "triage-exploitation", "type": "analytic", "label": "Evaluate Intrusion Evidence", "config": { "cite": "required", "tools": [ "endpoint", "identity" ], "context": [ "mssql-brute-force", "sqlservr-child-processes", "scripted-payload-staging" ], "objective": "Decide if the brute-force and subsequent SQL processes indicate a successful MS-SQL compromise.", "description": "Analyze the timeline and causal link between authentication volume and process execution.", "max_iterations": 4, "expected_signal": "A per-host verdict.", "success_criteria": "A verdict of malicious | suspicious for any host with brute-force followed by shell execution." }, "parents": [ { "id": "mssql-brute-force", "kind": "merge" }, { "id": "sqlservr-child-processes", "kind": "merge" }, { "id": "scripted-payload-staging", "kind": "merge" } ] }, { "id": "route-verdict", "type": "checkpoint", "label": "Route on Verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the triage verdict is malicious for at least one host, specifically showing shell execution originating from sqlservr.exe", "condition": "the triage verdict is malicious for at least one host, specifically showing shell execution originating from sqlservr.exe", "blind_spot": "no-sql-audit-logs", "confidence": "high", "description": "Escalate confirmed intrusions or review ambiguous signals.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "triage-exploitation" } ] }, { "id": "isolate-host", "type": "action", "label": "Isolate Database Server", "config": { "target": "endpoint", "description": "Prevent secondary payload execution or lateral movement from the database beachhead.", "instructions": "Isolate the compromised host and rotate the 'sa' account password.", "action_approval": "required" }, "parents": [ { "id": "route-verdict", "branch": "on_supports" } ] }, { "id": "analyst-review", "type": "task", "label": "Analyst Review and Triage", "config": { "assignee": "analyst", "description": "Confirm the presence of malicious assemblies or stored procedures.", "instructions": "Review internal SQL tables for 'shell' assembly and 'cmd_exec' stored procedure. Check C:\\ProgramData for scripts or multimedia-extension files (.mp4, .wav)." }, "parents": [ { "id": "route-verdict", "branch": "default" }, { "id": "route-verdict", "branch": "on_unavailable" }, { "id": "isolate-host" } ] }, { "id": "close-out", "type": "task", "label": "Close Out", "config": { "assignee": "analyst", "description": "Record findings and tuning recommendations.", "instructions": "Document absence of SQL exploitation and recommend implementing account lockout policies for the sa account." }, "parents": [ { "id": "route-verdict", "branch": "on_refutes" } ] } ] }