Cyber Threat Intelligence

Discover malicious IPs and domains with Akamai Guardicore Segmentation

IP Address: 14.176.231.155Malicious

IP Address: 14.176.231.155Malicious

This IP address attempted an attack on a machine in our threat sensors network

Threat Information

Role

Attacker, Scanner

Services Targeted

MSSQL SMB

Tags

Service Start File Operation By CMD Successful SMB Login Service Deletion SMB Null Session Login Listening CMD System File Modification Service Creation Scheduled Task Creation SMB Share Connect Download and Execute SMB Access Suspicious Domain Service Stop DNS Query PowerShell Download File

Associated Attack Servers

t.amynx.com w.zz3r0.com

117.196.50.50 211.181.237.46

Basic Information

IP Address

14.176.231.155

Domain

-

ISP

Vietnam Posts And Telecommunications Group

Country

Viet Nam

WHOIS

Created Date

-

Updated Date

-

Organization

-

First seen in Akamai Guardicore Segmentation

2020-07-25

Last seen in Akamai Guardicore Segmentation

2024-03-26

What is Akamai Guardicore Segmentation
Akamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

A user logged in using SMB with the following username: Administrator - Authentication policy: Reached Max Attempts

Successful SMB Login

c:\windows\system32\services.exe installed and started %systemroot%\pezgvapj.exe as a service named luAT under service group None

Service Start Service Creation

The file C:\Windows\PeZgvapj.exe was downloaded and executed

Download and Execute

A user logged in using SMB from NULL with the following username: Administrator - Authentication policy: Previously Approved User 5 times

Successful SMB Login

c:\windows\system32\services.exe installed and started %systemroot%\xqvrouni.exe as a service named hjfp under service group None

Service Start Service Creation

The file C:\Windows\XqVrOuni.exe was downloaded and executed

Download and Execute

C:\Windows\Temp\tmp.vbs was downloaded 2 times

Download File

A user logged in using SMB with the following username: Administrator - Authentication policy: Previously Approved User 3 times

Successful SMB Login

Service hjfp was stopped

Service Stop

The command line C:\Windows\UxVhxE.exe was scheduled to run by modifying C:\Windows\System32\Tasks\UxVhxE

The command line c:\windows\KhQhmGy.exe was scheduled to run by modifying C:\Windows\System32\Tasks\NpLMpkDE

Process netsvcs Service Group started listening on ports: 65529

Listening

c:\windows\system32\services.exe installed and started %systemroot%\bibcreab.exe as a service named OFyO under service group None

Service Start Service Creation

System file C:\Windows\AppCompat\Programs\Amcache.hve was modified

System File Modification

Process c:\windows\syswow64\windowspowershell\v1.0\powershell.exe attempted to access suspicious domains: t.amynx.com

DNS Query Access Suspicious Domain

The file C:\Windows\biBCREAb.exe was downloaded and executed

Download and Execute

c:\windows\system32\services.exe installed and started %systemroot%\qngboqca.exe as a service named zzkv under service group None

Service Start Service Creation

The file C:\Windows\QngBoQCa.exe was downloaded and executed

Download and Execute

Service zzkv was stopped

Service Stop

c:\windows\system32\services.exe installed and started %systemroot%\nztztaay.exe as a service named YnRs under service group None

Service Start Service Creation

The file C:\Windows\NZTztAaY.exe was downloaded and executed

Download and Execute

Connection was closed due to timeout

Associated Files

C:\WINDOWS\Temp\svchost.exe

SHA256: 006b53b3d73cbf94ccd00311934cbfe601565d5d08f48e7f1cf71073200a2238

195000 bytes

C:\WINDOWS\Temp\svchost.exe

SHA256: 013ec11716122bf749c7fdcd0dcf904e2dfe72b3c50f5cb4e66105493d15620b

195000 bytes

C:\WINDOWS\Temp\svchost.exe

SHA256: 0752309d581b9eb202385244c7a8748af6d7349e5f416f971ea1c147adef293d

130000 bytes

C:\WINDOWS\Temp\svchost.exe

SHA256: 079a210f8974feaf5ba190260c781162121dc1f25d15a2c163d8e1a3be5ff8f2

65000 bytes

C:\WINDOWS\Temp\svchost.exe

SHA256: 08afa43b7998712e4080e073209bb5129c4672c60f40d36809ed92a6db35c2b0

130000 bytes

C:\WINDOWS\Temp\svchost.exe

SHA256: 0a29b7180274ef0b2df3001163e8c4e6f081e822843a0d70602f04f3fc8080bc

260000 bytes

C:\WINDOWS\Temp\svchost.exe

SHA256: 0c12253e92b5c0daa1ea0f9527272552b56b3d3dfc5e4e57cbf80a0c68593fb9

65000 bytes

C:\WINDOWS\Temp\svchost.exe

SHA256: 10ae47a74d244d005459865ca6874200c16070099473c0ea40aec843e9dc7951

65000 bytes

C:\WINDOWS\Temp\svchost.exe

SHA256: 11ff79de0a6cb0bd4f666fc5e9e240fcb78333bfde81038ff1402917e7ef9394

65000 bytes

C:\WINDOWS\Temp\svchost.exe

SHA256: 12876e23cd4e162367429c16ec1798cc8609313bdf86d1ec4caf53711af49ddb

65000 bytes

C:\WINDOWS\temp\svchost.exe

SHA256: 131f9bb9a4f81ca862f39283045cb962371f2d8a30f9592cb908738e6ac6b2ee

130000 bytes