Cyber Threat Intelligence

Discover malicious IPs and domains with Akamai Guardicore Segmentation

IP Address: 38.52.137.183Malicious

IP Address: 38.52.137.183Malicious

This IP address attempted an attack on a machine in our threat sensors network

Threat Information

Role

Attacker, Scanner

Services Targeted

MSSQL

Tags

Service Configuration IDS - Attempted User Privilege Gain MSSQL Successful MSSQL Login Post Reboot Rename Access Suspicious Domain Persistency - Print Monitors Download and Execute PowerShell System File Modification File Operation By CMD CMD Outgoing Connection Bulk Files Tampering Execute MsSql Shell Command DNS Query

Associated Attack Servers

down.ftp21.cc wmi.362-com.com

115.23.223.72 211.57.200.17

Basic Information

IP Address

38.52.137.183

Domain

-

ISP

-

Country

United States

WHOIS

Created Date

-

Updated Date

-

Organization

-

First seen in Akamai Guardicore Segmentation

2023-04-01

Last seen in Akamai Guardicore Segmentation

2024-06-12

What is Akamai Guardicore Segmentation
Akamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

A user logged in using MSSQL with the following credentials: sa / ******** - Authentication policy: Reached Max Attempts

Successful MSSQL Login

MSSQL executed 1 shell commands

Execute MsSql Shell Command

IDS detected Attempted User Privilege Gain : SQL sp_configure - configuration change

IDS - Attempted User Privilege Gain

IDS detected Attempted User Privilege Gain : xp_reg* - registry access

IDS - Attempted User Privilege Gain

IDS detected Attempted User Privilege Gain : xp_cmdshell - program execution

IDS - Attempted User Privilege Gain

Process c:\windows\system32\wscript.exe attempted to access suspicious domains: down.ftp21.cc

DNS Query Access Suspicious Domain

System file C:\Windows\AppCompat\Programs\Amcache.hve was modified 9 times

System File Modification

c:\windows\temp\mssqlh.exe set the command line C:\Windows\Logs\RunDllExe.dll to run using Persistency - Print Monitors

Persistency - Print Monitors

The file C:\Windows\Temp\MSSQLH.exe was downloaded and executed

Download and Execute

Process c:\windows\syswow64\svchost.exe attempted to access suspicious domains: wmi.362-com.com

DNS Query Outgoing Connection Access Suspicious Domain

c:\windows\temp\httpa.exe set the command line C:\Windows\Logs\RunDllExe.dll to run using Persistency - Print Monitors

Persistency - Print Monitors

Process c:\windows\syswow64\svchost.exe generated outgoing network traffic to: 211.57.200.17:53

Outgoing Connection

c:\programdata\httpa.exe set the command line C:\Windows\Logs\RunDllExe.dll to run using Persistency - Print Monitors

Persistency - Print Monitors

The file C:\Windows\Logs\RunDllExe.dll was downloaded and loaded by c:\windows\system32\spoolsv.exe 2 times

Download and Execute

The file C:\ProgramData\HttpA.exe was downloaded and executed

Download and Execute

The file C:\Windows\Temp\Win8.exe was downloaded and executed

Download and Execute

The file C:\ProgramData\Win8.exe was downloaded and executed

Download and Execute

c:\program files\microsoft sql server\mssql11.sqlexpress\mssql\binn\odsole70.dll was deleted by c:\programdata\httpa.exe ( pending reboot )

Post Reboot Rename

c:\program files\microsoft sql server\mssql11.sqlexpress\mssql\binn\odsole70.dll was deleted by c:\windows\temp\httpa.exe ( pending reboot ) 2 times

Post Reboot Rename

c:\program files\microsoft sql server\mssql11.sqlexpress\mssql\binn\odsole70.dll was deleted by c:\windows\temp\mssqlh.exe ( pending reboot ) 3 times

Post Reboot Rename

PowerShell session started by c:\windows\system32\windowspowershell\v1.0\powershell.exe

PowerShell session started by c:\windows\system32\conhost.exe

Process c:\windows\system32\windowspowershell\v1.0\powershell.exe attempted to access suspicious domains: down.ftp21.cc

DNS Query Outgoing Connection Access Suspicious Domain

Process c:\windows\system32\windowspowershell\v1.0\powershell.exe generated outgoing network traffic to: 115.23.223.72:80

Outgoing Connection

Connection was closed due to user inactivity

Process c:\windows\system32\windowspowershell\v1.0\powershell.exe performed bulk changes in {c:\users\administrator\appdata\local\microsoft\windows\powershell\commandanalysis} on 69 files

Bulk Files Tampering

Associated Files

C:\Windows\Logs\RunDllExe.dll

SHA256: 799901df9b86f3404c4c8d51d25bd08e29637a5aabe62c58a48d3d27a6a572e7

168615 bytes

C:\Windows\Temp\Win8.exe

SHA256: d129a40ca83001b603740e64251ec79023e2c1ea89757ada6e9bbeb5f8596ecc

82432 bytes

C:\Windows\Temp\MSSQLH.exe

SHA256: fffb018cd8e3c48fe0e343c5763dad32a5ada28129ba14db3f656361d5e44c20

409600 bytes