IP Address: 38.25.149.120Malicious
IP Address: 38.25.149.120Malicious
This IP address attempted an attack on a machine in our threat sensors network
Role |
Attacker, Scanner |
Services Targeted |
MSSQL MYSQL |
Tags |
Outgoing Connection Executable File Modification PowerShell CMD File Operation By CMD Download File Service Configuration Execute MsSql Shell Command Persistency - Print Monitors MSSQL Access Suspicious Domain HTTP Port 445 Scan SMB Download and Execute System File Modification IDS - Attempted User Privilege Gain DNS Query Successful MSSQL Login |
Associated Attack Servers |
down.ftp21.cc members.3322.org opendata.baidu.com wmi.362-com.com |
IP Address |
38.25.149.120 |
|
Domain |
- |
|
ISP |
- |
|
Country |
Venezuela, Bolivarian Republic of |
|
WHOIS |
Created Date |
- |
Updated Date |
- |
|
Organization |
- |
First seen in Akamai Guardicore Segmentation |
2023-06-06 |
Last seen in Akamai Guardicore Segmentation |
2023-06-17 |
What is Akamai Guardicore SegmentationAkamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More
A user logged in using MSSQL with the following credentials: sa / ***** - Authentication policy: Reached Max Attempts |
Successful MSSQL Login |
MSSQL executed 1 shell commands |
Execute MsSql Shell Command |
IDS detected Attempted User Privilege Gain : SQL sp_configure - configuration change |
IDS - Attempted User Privilege Gain |
IDS detected Attempted User Privilege Gain : xp_reg* - registry access |
IDS - Attempted User Privilege Gain |
IDS detected Attempted User Privilege Gain : xp_cmdshell - program execution |
IDS - Attempted User Privilege Gain |
System file C:\Windows\AppCompat\Programs\Amcache.hve was modified |
System File Modification |
Process c:\windows\system32\wscript.exe attempted to access suspicious domains: down.ftp21.cc |
DNS Query Access Suspicious Domain |
c:\windows\temp\mssqlh.exe set the command line C:\Windows\Logs\RunDllExe.dll to run using Persistency - Print Monitors |
Persistency - Print Monitors |
The file C:\Windows\Temp\MSSQLH.exe was downloaded and executed |
Download and Execute |
Process c:\windows\syswow64\svchost.exe attempted to access suspicious domains: down.ftp21.cc and wmi.362-com.com |
DNS Query Outgoing Connection Access Suspicious Domain |
Process c:\windows\syswow64\svchost.exe generated outgoing network traffic to: 211.57.200.17:53 |
Outgoing Connection |
Executable file C:\Program Files\Microsoft SQL Server\MSSQL11.SQLEXPRESS\MSSQL\Binn\ODSOLE70.dll was modified |
Executable File Modification |
System file C:\WINDOWS\Temp\MpMgSvc.dll was modified 4 times |
System File Modification |
C:\WINDOWS\Temp\MpMgSvc.dll was downloaded |
Download File |
The file C:\Windows\Temp\MpMgSvc.exe was downloaded and executed |
Download and Execute |
Process c:\windows\temp\mpmgsvc.exe attempted to access suspicious domains: members.3322.org |
DNS Query Access Suspicious Domain |
Process c:\windows\temp\mpmgsvc.exe attempted to access domains: opendata.baidu.com |
DNS Query |
Process c:\windows\temp\mpmgsvc.exe generated outgoing network traffic to: 35.189.0.10:445, 35.189.0.11:445, 35.189.0.12:445, 35.189.0.13:445, 35.189.0.14:445, 35.189.0.15:445, 35.189.0.16:445, 35.189.0.17:445, 35.189.0.18:445, 35.189.0.19:445, 35.189.0.20:445, 35.189.0.21:445, 35.189.0.22:445, 35.189.0.23:445, 35.189.0.24:445, 35.189.0.25:445, 35.189.0.26:445, 35.189.0.27:445, 35.189.0.28:445, 35.189.0.29:445, 35.189.0.2:445, 35.189.0.30:445, 35.189.0.31:445, 35.189.0.32:445, 35.189.0.33:445, 35.189.0.34:445, 35.189.0.35:445, 35.189.0.36:445, 35.189.0.37:445, 35.189.0.3:445, 35.189.0.4:445, 35.189.0.5:445, 35.189.0.6:445, 35.189.0.7:445, 35.189.0.8:445 and 35.189.0.9:445 |
|
Process c:\windows\temp\mpmgsvc.exe scanned port 445 on 36 IP Addresses |
Port 445 Scan |
Connection was closed due to user inactivity |
|
/usr/local/mysql/lib/plugin/pedols32.so |
SHA256: 681c6aa7782eb7780ea4d0745ba9dfd0c20cd363e3f2976f7e76fe13984d364d |
8128 bytes |
/usr/local/mysql/lib/plugin/LinuxUDF32.SO |
SHA256: 2789f4dbbcdeb8ebff855829c734fad4e466fdd736d441e62888b8de5bc31826 |
5696 bytes |