Cobalt Strike Being Distributed to Unsecured MS-SQL Servers – ASEC BLOG

MITRE Techniques

• [T1046] Network Service Scanning – The attacker or malware usually scans port 1433 to check for MS-SQL servers open to the public. ‘The attacker or the malware usually scans port 1433 to check for MS-SQL servers open to the public.’
• [T1110] Brute Force – Attacks include brute forcing or dictionary attacks against the admin account (‘sa’) to attempt logging in. ‘brute forcing, and dictionary attack against poorly managed servers.’
• [T1021] Lateral Movement – Lemon Duck scans port 1433 and spreads for the purpose of lateral movement in the internal network. ‘Lemon Duck malware that scans port 1433 and spreads for the purpose of lateral movement in the internal network.’
• [T1059] Command and Scripting Interpreter – Cobalt Strike was downloaded through cmd.exe and powershell.exe via the MS-SQL process. ‘downloaded through cmd.exe and powershell.exe via the MS-SQL process as shown below.’
• [T1055] Process Injection – The injector decodes and injects Cobalt Strike into MSBuild.exe, loading wwanmm.dll and writing/executing a beacon in DLL memory. ‘injector that decodes the encoded Cobalt Strike inside, and executes and injects the normal program MSBuild.exe.’
• [T1027] Obfuscated/Compressed Files and Information – The loader decodes the encoded Cobalt Strike inside to execute it. ‘injector that decodes the encoded Cobalt Strike inside, and executes and injects the normal program MSBuild.exe.’
• [T1562] Impair Defenses – The Cobalt Strike settings data show a method to bypass detection of security products. ‘bypass detection of security products, where it loads the normal dll wwanmm.dll, then writes and executes a beacon in the memory area of the dll.’
• [T1071] Application Layer Protocol – The C2 infrastructure uses HTTP-based URLs for command and control and beacon communications. ‘C&C
  – hxxp://92.255.85[.]83:7905/push … hxxp://92.255.85[.]94:83/ga.js’