Cyber Threat Intelligence

Discover malicious IPs and domains with Akamai Guardicore Segmentation

IP Address: 103.230.107.236Malicious

IP Address: 103.230.107.236Malicious

This IP address attempted an attack on a machine in our threat sensors network

Threat Information

Role

Attacker, Scanner

Services Targeted

MSSQL SMB

Tags

DNS Query SMB Download File SMB Share Connect Access Suspicious Domain Scheduled Task Creation Download and Execute Service Stop PowerShell System File Modification SMB Null Session Login Service Deletion Listening Service Start Service Creation

Associated Attack Servers

t.amynx.com w.zz3r0.com

43.252.145.145 76.254.128.137

Basic Information

IP Address

103.230.107.236

Domain

-

ISP

Teletalk Bangladesh

Country

Bangladesh

WHOIS

Created Date

-

Updated Date

-

Organization

-

First seen in Akamai Guardicore Segmentation

2019-08-04

Last seen in Akamai Guardicore Segmentation

2024-04-24

What is Akamai Guardicore Segmentation
Akamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

c:\windows\system32\services.exe installed and started %systemroot%\pzvawiwl.exe as a service named fnwx under service group None

Service Start Service Creation

The file C:\Windows\pZVawIWL.exe was downloaded and executed

Download and Execute

c:\windows\system32\services.exe installed and started %systemroot%\gdqxxvlk.exe as a service named nnVE under service group None

Service Start Service Creation

C:\Windows\temp\tmp.vbs was downloaded

Download File

The file C:\Windows\gdQXXVLk.exe was downloaded and executed

Download and Execute

Service nnVE was stopped

Service Stop

c:\windows\system32\services.exe installed and started %systemroot%\cswikcwu.exe as a service named VBjN under service group None

Service Start Service Creation

System file C:\Windows\AppCompat\Programs\Amcache.hve was modified 4 times

System File Modification

The file C:\Windows\cSwIKcWU.exe was downloaded and executed

Download and Execute

c:\windows\system32\services.exe installed and started %systemroot%\ugxjlrmj.exe as a service named HuTH under service group None

Service Start Service Creation

The file C:\Windows\ugXjlRmJ.exe was downloaded and executed

Download and Execute

C:\Windows\hoRhhcQI.exe was downloaded

Download File

The command line C:\Windows\dgQMHcyx.exe was scheduled to run by modifying C:\Windows\System32\Tasks\dgQMHcyx

Process netsvcs Service Group started listening on ports: 65529

Listening

The command line c:\windows\VCJBwv.exe was scheduled to run by modifying C:\Windows\System32\Tasks\wzEqjNZD

c:\windows\system32\services.exe installed and started %systemroot%\horhhcqi.exe as a service named AstC under service group None

Service Start Service Creation

Process c:\windows\syswow64\windowspowershell\v1.0\powershell.exe attempted to access suspicious domains: t.amynx.com

DNS Query Access Suspicious Domain

C:\Windows\faehiTHS.exe was downloaded

Download File

c:\windows\system32\services.exe installed and started %systemroot%\faehiths.exe as a service named uoOT under service group None

Service Start Service Creation

c:\windows\system32\services.exe installed and started %systemroot%\gzcazawf.exe as a service named sdLC under service group None

Service Start Service Creation

The file C:\Windows\GzCaZAwF.exe was downloaded and executed

Download and Execute

c:\windows\system32\services.exe installed and started %systemroot%\nglqzvvc.exe as a service named LfDQ under service group None

Service Start Service Creation

The file C:\Windows\nglQzvvC.exe was downloaded and executed

Download and Execute

Connection was closed due to timeout

Associated Files

C:\windows\temp\svchost.exe

SHA256: 0374561999c94d58d9acbacaf1886278dfd1dc8d6f8fd7e386fa6be215b532a4

780000 bytes

C:\windows\temp\svchost.exe

SHA256: 04ff0231d6090beee3ed822d8c9be1c6cdda4ae85165335f048804d69563c0e8

1040000 bytes

C:\windows\temp\svchost.exe

SHA256: 092b36eb60e571e0ad1ec7bc89537b1dadac6c3584952d46560e5176453497ab

260000 bytes

C:\WINDOWS\Temp\svchost.exe

SHA256: 09491955bdb7a73c938338551b2c290a159180fc4c99db7d99c7b498f3284bc4

455000 bytes

C:\windows\temp\svchost.exe

SHA256: 0bbe35f1a11917d299ebd0f1703728d2d7595d96bc0ddbb6973f92b766522d2e

1495000 bytes

C:\Windows\temp\svchost.exe

SHA256: 13a7ae58a7f9d62ed254aae05db9bc4b0ddb2b7ad451eb1ef1a1eb3403b89276

1950000 bytes

C:\WINDOWS\Temp\svchost.exe

SHA256: 156daa245b3474c84617166505b0ec4d7f268c51dc5596bed4098426e296312e

65000 bytes

C:\WINDOWS\Temp\svchost.exe

SHA256: 17045250466644d109294ed00f7bc66925f36405cd709f11a752328341356ea8

195000 bytes

C:\WINDOWS\Temp\svchost.exe

SHA256: 17ace0385e331e3c8cd62203a97c29f63ded9cf9d12e28facc34affdcd93fe35

910000 bytes

C:\WINDOWS\Temp\svchost.exe

SHA256: 180b1bb45e74607a8f6d2f8611805b6228bccee8dcbedbde0b13fbca92093256

195000 bytes

C:\WINDOWS\Temp\svchost.exe

SHA256: 182084f52124e36eaccc1f914be8cee276e4065219bca5083240af24ffc4ff47

650000 bytes

C:\windows\temp\svchost.exe

SHA256: 18ec8b143e8ae3a9c2551ec2ad3caf8fc472237d674882fc602dc916adc2d110

455000 bytes

C:\WINDOWS\Temp\svchost.exe

SHA256: 19ec15916d504dd9c9a4c2f05dfc0d6bd3d2e72ef8e8234a9deb601598fa15c3

130000 bytes