Mallox MS-SQL Exploitation and Initial Delivery

Source

---
analysis: A rule might flag any shell spawned by sqlservr.exe, but this hunt provides
  the context of external brute-force and specific staging patterns (redirection to
  ProgramData) to confirm an active intrusion versus an administrator task.
blind_spots:
- id: no-sql-audit-logs
  question: Were 'TRUSTWORTHY' or 'clr enabled' parameters changed?
  requires: Native MS-SQL Audit logs
  risk: Internal configuration changes in the database engine are invisible to endpoint
    process monitoring.
  stage: sql-server-exploitation
- id: in-memory-assembly
  question: Was a malicious DLL loaded into the SQL process memory?
  requires: hb_module_activity with CLR monitoring
  risk: The SqlShell malware may run as a reflectively loaded assembly, bypassing
    file-on-disk and process-launch detection.
  stage: sql-server-exploitation
coverage:
- stage: sql-brute-force-access
  status: covered
  steps:
  - mssql-brute-force
- stage: sql-server-exploitation
  status: covered
  steps:
  - sqlservr-child-processes
- stage: initial-payload-delivery
  status: covered
  steps:
  - scripted-payload-staging
- reason: Belongs to another part of the 'Mallox ransomware affiliate leverages PureCrypter
    in MSSQL exploitation' series.
  stage: loader-evasion-and-anti-analysis
  status: out_of_scope
- reason: Belongs to another part of the 'Mallox ransomware affiliate leverages PureCrypter
    in MSSQL exploitation' series.
  stage: persistence-run-key
  status: out_of_scope
- reason: Belongs to another part of the 'Mallox ransomware affiliate leverages PureCrypter
    in MSSQL exploitation' series.
  stage: mallox-ransomware-execution
  status: out_of_scope
guardrails:
  claims: no_unsupported
  evidence: citation_required
  missing_data: not_benign
  telemetry: untrusted
hunt:
  applicability: campaign-specific
  handoff: promote-to-detection
  justification: MS-SQL servers are frequent targets for high-impact ransomware. Brute-force
    and exploitation of administrative features (xp_cmdshell) are durable TTPs used
    by Mallox affiliates to achieve initial access.
  methodology: model-assisted
  trigger: intel-report
hypothesis: An adversary is targeting MS-SQL servers via brute-force of the sa account
  to execute administrative commands that stage payloads in public directories.
labels:
- hunt
- attack.t1110
- attack.t1190
- attack.t1059.003
- attack.t1059.001
- attack.t1047
name: Mallox MS-SQL Exploitation and Initial Delivery
parameters:
  lookback_days:
    default: '14'
    description: Days of history to examine.
    from:
      kind: manual
      observed: '2024-05-02'
      ref: hunt-standard
    type: number
  sa_account:
    default: sa
    description: The SQL administrator account name to monitor for brute-force.
    from:
      kind: article
      observed: '2024-05-02'
      ref: https://blog.sekoia.io/mallox-ransomware-affiliate-leverages-purecrypter-in-microsoft-sql-exploitation-campaigns/
    type: string
  scope_hosts:
    default: []
    description: Limit the hunt to these hostnames; leave empty to hunt across the
      entire estate.
    from:
      kind: manual
      observed: '2024-05-02'
      ref: hunt-standard
    type: list[host]
  suspicious_sql_child_procs:
    default:
    - cmd.exe
    - powershell.exe
    - wmic.exe
    - scrcons.exe
    description: Process names spawned by sqlservr.exe that suggest feature abuse.
    from:
      kind: article
      observed: '2024-05-02'
      ref: https://blog.sekoia.io/mallox-ransomware-affiliate-leverages-purecrypter-in-microsoft-sql-exploitation-campaigns/
    type: list[string]
provenance:
  authors:
  - name: Huntbase hunt generation
    org: huntbase.io
  generated:
    by: huntbase-hunt-generation
    from: https://blog.sekoia.io/mallox-ransomware-affiliate-leverages-purecrypter-in-microsoft-sql-exploitation-campaigns/
    gates:
    - dry-run
    - lint
    - critic
    model: hb_google/gemini-3-flash-preview
rationale: Focus on servers identified as running Microsoft SQL Server. If the estate
  is large, prioritize those with external exposure.
references:
- name: "Sekoia \u2014 Mallox ransomware affiliate leverages PureCrypter in MSSQL\
    \ exploitation"
  url: https://blog.sekoia.io/mallox-ransomware-affiliate-leverages-purecrypter-in-microsoft-sql-exploitation-campaigns/
related:
- hunt: purecrypter-loader-evasion
  reason: The next phase of this attack involves PureCrypter's anti-analysis and loader
    behavior.
  relation: follows
- hunt: mallox-impact-and-encryption
  reason: A sibling hunt focusing on the final encryption and shadow copy deletion
    phases.
  relation: sibling
scenario:
  stages:
  - name: MS-SQL Brute Force
    observables:
    - Brute-force attempts against 'sa' account
    - Source IP address in AS208091 (XHost Internet Solution)
    - Approximately 320 authentication attempts per minute
    - Targeting MS-SQL port (1433)
    slug: sql-brute-force-access
    tactic: initial-access
    techniques:
    - T1110
    - T1190
  - name: MS-SQL Feature Exploitation
    observables:
    - Enabling 'TRUSTWORTHY' database parameter
    - Enabling 'clr enabled' parameter
    - Creating assembly named 'shell' (SqlShell DLL)
    - Creating stored procedure 'cmd_exec'
    - Enabling 'xp_cmdshell' configuration
    - Enabling 'Ole Automation Procedures'
    - Use of 'sp_oacreate' to create 'wscript.shell' OLE object
    - Application name 'vYMiFrYR' in SQL connection logs
    slug: sql-server-exploitation
    tactic: execution
    techniques:
    - T1059.003
  - name: PowerShell Downloader and WMIC Execution
    observables:
    - echo and redirect used to create PowerShell script
    - PowerShell script saved to C:\ProgramData
    - WMIC used to execute downloaded binary
    - Downloading multimedia-themed files (e.g., .mp4, .wav, .pdf) containing encrypted
      payloads
    slug: initial-payload-delivery
    tactic: execution
    techniques:
    - T1059.001
    - T1047
  - name: PureCrypter Anti-Analysis and Evasion
    observables:
    - WMI query 'select * from Win32_BIOS' to check for VMWare, Virtual, AMI, or Xen
    - WMI query 'select * from Win32_ComputerSystem' to check for Microsoft or VMWare
    - Process search for 'SbieDll.dll'
    - Monitor size check for 1440x900
    - Username check for 'john', 'anna', or 'xxxxxxxx'
    - Execution of 'ipconfig /renew' and 'ipconfig /release' for network testing
    - Patching 'EtwEventWrite' and 'AmsiScanBuffer' in memory
    - Adding Windows Defender exclusions via 'MpPreference -Exclusion'
    slug: loader-evasion-and-anti-analysis
    tactic: defense-evasion
    techniques:
    - T1497.001
    - T1562.001
    - T1129
  - name: Registry Run Key Persistence
    observables:
    - Registry key addition in 'Software\Microsoft\Windows\CurrentVersion\Run\'
    slug: persistence-run-key
    tactic: persistence
    techniques:
    - T1547.001
  - name: Mallox Ransomware Execution
    observables:
    - Ransomware executable named 'Ydxhjxwf.exe' in %appdata%
    - Reflective code loading of stage 2 DLL
    - Elevation of process privileges with 'SeDebugPrivilege'
    slug: mallox-ransomware-execution
    tactic: impact
    techniques:
    - T1486
  summary: An affiliate of Mallox ransomware targets internet-facing MS-SQL servers
    using brute-force attacks against the 'sa' account. Upon gaining access, the attacker
    exploits SQL features such as CLR assemblies and xp_cmdshell to deliver PureCrypter,
    a .NET loader that employs extensive anti-analysis and evasion techniques before
    executing the final Mallox ransomware payload.
series:
  index: 1
  slug: mallox-ransomware-affiliate-leverages-purecrypter-in-mssql-exploitation
  title: Mallox ransomware affiliate leverages PureCrypter in MSSQL exploitation
  total: 2
severity: high
targets:
  analyst:
    name: Tier-2 analyst
    role: analyst
  endpoint:
    category: endpoint
    name: Endpoint telemetry (hb_ surfaces)
    telemetry:
    - endpoint
  hunter:
    agent: true
    name: Hunt agent
  identity:
    category: identity
    name: Identity / sign-in telemetry
    telemetry:
    - identity
tlp: clear
type: investigation
---


# Mallox MS-SQL Exploitation and Initial Delivery

This hunt identifies the early stages of a Mallox ransomware intrusion by monitoring the intersection of authentication failure volume, database engine process anomalies, and shell-based payload staging. It specifically targets the exploitation of MS-SQL features like xp_cmdshell or OLE automation used to drop and execute PureCrypter or Mallox loaders.

## sql-server-inventory
<!-- Identify SQL Server Hosts -->
Scope the hunt to hosts known to run MS-SQL packages.

```sqlite target=endpoint role=scoping
~~~yaml
expected: A list of hostnames. Silence indicates no SQL servers are inventoried.
reads:
- device_hostname
- package_name
- vendor_name
silence: not_evidence_of_absence
source: hb_software_inventory
verified: dry-run
verified_at: '2026-09-17'
~~~
SELECT DISTINCT device_hostname FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%sql server%' OR LOWER(vendor_name) LIKE '%microsoft%sql%')
```

## parallel-triage
<!-- Parallel Triage -->
parallel:
- → mssql-brute-force
- → sqlservr-child-processes
- → scripted-payload-staging
join: → triage-exploitation

## mssql-brute-force
<!-- MS-SQL sa Account Brute-Force -->
Detect high-frequency login failures on the SQL admin account.

```sqlite target=identity role=baseline params=(lookback_days=lookback_days, sa_account=sa_account, scope_hosts=scope_hosts)
~~~yaml
baseline:
  compare: new_this_window
  window: '{{lookback_days}}d'
expected: One or more source IPs with hundreds of failures. Silence means no sa-targeted
  brute-force detected.
prevalence:
  by: dst_endpoint_name
  key:
  - src_endpoint_ip
  rare_below: 5
reads:
- src_endpoint_ip
- dst_endpoint_name
- actor_user_name
- activity_id
- time
silence: not_evidence_of_absence
source: hb_auth_signin
verified: dry-run
verified_at: '2026-09-17'
~~~
SELECT src_endpoint_ip, dst_endpoint_name, COUNT(*) as attempt_count, MIN(time) as first_seen, MAX(time) as last_seen FROM hb_auth_signin WHERE LOWER(actor_user_name) = '{{sa_account}}' AND activity_id = 5 AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || dst_endpoint_name || ',') > 0) GROUP BY src_endpoint_ip, dst_endpoint_name HAVING attempt_count > 100 ORDER BY attempt_count DESC
```

## sqlservr-child-processes
<!-- Anomalous SQL Engine Child Processes -->
Detect instances of sqlservr.exe spawning shells or WMIC, indicative of xp_cmdshell abuse.

```sqlite target=endpoint role=detection-candidate params=(lookback_days=lookback_days, scope_hosts=scope_hosts, suspicious_sql_child_procs=suspicious_sql_child_procs)
~~~yaml
expected: Rows showing the SQL engine spawning cmd.exe or powershell.exe. Silence
  proves no such shells were captured by process logging.
reads:
- device_hostname
- process_name
- process_cmd_line
- parent_process_name
- time
silence: evidence_of_absence
source: hb_process_activity
verified: dry-run
verified_at: '2026-09-17'
~~~
SELECT device_hostname, process_name, process_cmd_line, parent_process_name, time FROM hb_process_activity WHERE LOWER(parent_process_name) LIKE '%sqlservr.exe' AND instr(',' || '{{suspicious_sql_child_procs}}' || ',', ',' || LOWER(process_name) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)
```

## scripted-payload-staging
<!-- Payload Staging via Echo Redirection -->
Find script blocks writing to ProgramData using shell redirection, as seen in Mallox affiliate scripts.

```sqlite target=endpoint role=triage params=(lookback_days=lookback_days, scope_hosts=scope_hosts)
~~~yaml
expected: Script content showing binary creation or downloader staging. Silence suggests
  this specific affiliate tradecraft is absent.
reads:
- device_hostname
- script_path
- script_content
- time
silence: not_evidence_of_absence
source: hb_script_activity
verified: dry-run
verified_at: '2026-09-17'
~~~
SELECT device_hostname, script_path, script_content, time FROM hb_script_activity WHERE (LOWER(script_content) LIKE '%echo%' AND (LOWER(script_content) LIKE '%>%' OR LOWER(script_content) LIKE '%>>%') AND LOWER(script_content) LIKE '%\programdata\%') AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)
```

## triage-exploitation
<!-- Evaluate Intrusion Evidence -->
```agent target=hunter
cite: required
context:
- mssql-brute-force
- sqlservr-child-processes
- scripted-payload-staging
max_iterations: 4
objective: Decide if the brute-force and subsequent SQL processes indicate a successful
  MS-SQL compromise.
success_criteria: A verdict of malicious | suspicious for any host with brute-force
  followed by shell execution.
tools:
- endpoint
- identity
```

## route-verdict
<!-- Route on Verdict -->
if~: "the triage verdict is malicious for at least one host, specifically showing shell execution originating from sqlservr.exe" (confidence: high, judge=hunter)
then: → isolate-host
indeterminate: → analyst-review
unavailable: → analyst-review (blind_spot: no-sql-audit-logs)
else: → close-out

## isolate-host
<!-- Isolate Database Server -->
```action target=endpoint
~~~yaml
approval: required
~~~
Isolate the compromised host and rotate the 'sa' account password.
```
→ analyst-review

## analyst-review
<!-- Analyst Review and Triage -->
```manual target=analyst
Review internal SQL tables for 'shell' assembly and 'cmd_exec' stored procedure. Check C:\ProgramData for scripts or multimedia-extension files (.mp4, .wav).
```
→ end

## close-out
<!-- Close Out -->
```manual target=analyst
Document absence of SQL exploitation and recommend implementing account lockout policies for the sa account.
```
→ end