[alphv_blackcat] Issues in step 2

[arty-hlr]

Hi,

When going through step 2 of AlphvBlackcat, I noticed these issues:

Wrong InfoStealer command

During step 2 execution, the following is executed on the SQL server:

%TEMP%\netbnmp.exe dpapi localhost zorimoto tzTVgs44isT4YxWU!

This gives the following error:

which is actually not surprising given that the dpapi option is not implemented in https://github.com/attackevals/ael/blob/main/ManagedServices/alphv_blackcat/Resources/infostealer/infostealer/sqlsharp/Program.cs

Did you maybe mean to use base64 instead?

SQL server not listening on TCP 1433 by default

I could not make the first InfoStealer command with just localhost and had to specify localhost\SQLEXPRESS, I think by default the SQL server doesn't listen on port 1433 but only through its service.

List of tasks and services to kill is missing

Back on the bastion, the attacker should close tasks and services, but they are not provided:

Within Task Manager, navigate to the "Details" tab and, using the provided list of processes, end any matching process names

Within Task Manager, navigate to the "Services" tab and, using the provided list of services, end any matching service names

I'm guessing it's probably AV/EDR tasks, but it would be nice to have the list as you intended.