Cyber Threat Intelligence

Discover malicious IPs and domains with Akamai Guardicore Segmentation

IP Address: 122.129.126.226Malicious

IP Address: 122.129.126.226Malicious

This IP address attempted an attack on a machine in our threat sensors network

Threat Information

Role

Attacker, Scanner

Services Targeted

RDP

Tags

System Shutdown Access Suspicious Domain RDP Service Stop Post Reboot Rename Successful RDP Login Access Share Execute from Share Service Start Download and Execute Service Configuration Known Malware Service Deletion Morto System File Modification Service Creation DNS Query

Associated Attack Servers

flt1.jifr.net ms.jifr.co.be ms.jifr.co.cc ms.jifr.info ms.jifr.net

1.10.141.6

Basic Information

IP Address

122.129.126.226

Domain

-

ISP

Multimedia Development Corporation

Country

Malaysia

WHOIS

Created Date

-

Updated Date

-

Organization

-

First seen in Akamai Guardicore Segmentation

2018-10-07

Last seen in Akamai Guardicore Segmentation

2024-03-02

What is Akamai Guardicore Segmentation
Akamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

A user logged in using RDP with the following credentials: administrator / **** - Authentication policy: White List

Successful RDP Login

a.dll was loaded from the remote share \\tsclient\a by c:\windows\system32\rundll32.exe

Execute from Share

c:\windows\system32\services.exe installed and started c:\windows\temp\ntshrui.dll as a service named Ias under service group netsvcs

Service Start Service Creation

The file C:\WINDOWS\Temp\ntshrui.dll was downloaded and loaded by c:\windows\system32\svchost.exe

Download and Execute

c:\windows\regedit.exe installed c:\windows\system32\sens32.dll as a service named SENS under service group netsvcs

Service Creation

Process netsvcs Service Group attempted to access suspicious domains: flt1.jifr.net, ms.jifr.co.be, ms.jifr.info and ms.jifr.net

DNS Query Access Suspicious Domain

Service Ias was stopped

Service Stop

System file c:\windows\clb.dllbak was modified

System File Modification

c:\windows\offline web pages\cache.txt was renamed to c:\windows\system32\sens32.dll by c:\windows\system32\svchost.exe ( pending reboot )

Post Reboot Rename

Process netsvcs Service Group attempted to access domains: ms.jifr.co.cc

DNS Query

Process netsvcs Service Group generated outgoing network traffic to: 74.125.71.104:80

c:\windows\system32\rundll32.exe attempted shutdown of type Shut down all processes running in the logon session of the process with reason: Unspecified

System Shutdown

c:\windows\system32\winlogon.exe attempted shutdown of type Shut down all processes running in the logon session of the process with reason: Unspecified

System Shutdown

Connection was closed due to timeout

Associated Files

C:\WINDOWS\Temp\ntshrui.dll

SHA256: 0aa00d7942a69ea8fbea51a10dcd7cfb23d870cf1f7d5858fdd68048f53df8a3

6672 bytes

C:\WINDOWS\Temp\ntshrui.dll

SHA256: 1f49f69f323fe23c24e03647f6e071e07a7c0136ef528016dbc1c9c3b9dd999e

6672 bytes

C:\WINDOWS\Temp\ntshrui.dll

SHA256: 1f5c535f789aef8000543a8301fee092570dfd31eff98cedc5e8bf916bc5f036

6672 bytes

C:\WINDOWS\Temp\ntshrui.dll

SHA256: 3cf19b4e3dee6ab619d312eadcf41bf99b43f23871255bdedda0f224e1934fca

6672 bytes

C:\WINDOWS\Temp\ntshrui.dll

SHA256: 4f56d0912dcbd35836dae124cb6d31e620d1e2d54b9151f90c964a7fd0e5a277

6672 bytes

C:\WINDOWS\clb.dll

SHA256: e4318e49c86fe2b0ef6adea90daebd39e26193d697ec671e1e18c90db8846be5

6672 bytes