• Query system information
• Run programs
• Interact with files and folders
• Enable remote desktop services
• Configure port forwarding
• Brute-force administrator logins to other Microsoft SQL servers
• It has TCP redirection ability and acts as a network bridge head from the Internet to any IP address which further enables compromised MSSQL server for access.

MITRE ATT&CK Matrix

T1110       Brute Force
T1090       Connection Proxy

******************* Indicators of Compromise ********************

URLs

hxxp://58[.]180[.]56[.]28/sql64[.]dll
hxxp://106[.]251[.]252[.]83/sql64[.]dll
hxxp://183[.]111[.]148[.]147/sql64[.]dll
hxxp://xw[.]xxuz[.]com/VV61599[.]exe
hxxp://58[.]180[.]56[.]28/vv61599[.]exe

******************* Indicators of Compromise ********************

Recommendations

1. Scan the MSSQL server installation with updated Antivirus.
2. Use strong passwords for Microsoft SQL accounts to mitigate Brute Force attempts. Enforce strong password policy and use Multifactor Authentication
3. Ensure Microsoft SQL database port (default: 1433) is not publically exposed to the Internet.
4. It is strongly recommended to apply the latest security updates on MSSQL server to restrict the attack surface and block attacks leveraging exploits that target known vulnerabilities.
5. Enforce application whitelisting on all endpoint workstations. This will prevent droppers or unauthorized software from gaining execution on endpoints. Perform regular backup of all the critical information to minimize the loss.
6. Monitor Connection attempts towards the listed URLs. Blocking the URLs is solely the recipient responsibility after diligently verifying them without impacting the operations.
7. Ensure to scan all software downloaded from the Internet prior to executing.
8. Review the "Extended Stored Procedures" (ESP) installed on the Microsoft SQL servers for identifying any malicious ESPs using methods given in this blog.