Cyber Threat Intelligence

Discover malicious IPs and domains with Akamai Guardicore Segmentation

IP Address: 163.47.33.66Malicious

IP Address: 163.47.33.66Malicious

This IP address attempted an attack on a machine in our threat sensors network

Threat Information

Role

Attacker, Scanner

Services Targeted

MSSQL SMB

Tags

Service Stop MSSQL SMB Null Session Login File Operation By CMD Service Deletion SMB User Created SMB Share Connect System File Modification Successful SMB Login Service Creation Successful MSSQL Login Download File Service Start User Added to Group IDS - Attempted User Privilege Gain Download and Execute CMD Execute MsSql Shell Command SMB Brute Force

Associated Attack Servers

v.beahh.com w.beahh.com

139.162.110.42

Basic Information

IP Address

163.47.33.66

Domain

-

ISP

Link3 Technologies Limited

Country

Bangladesh

WHOIS

Created Date

-

Updated Date

-

Organization

-

First seen in Akamai Guardicore Segmentation

2020-11-14

Last seen in Akamai Guardicore Segmentation

2023-11-14

What is Akamai Guardicore Segmentation
Akamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

IDS detected Attempted User Privilege Gain : SQL sp_configure - configuration change

IDS - Attempted User Privilege Gain

IDS detected Attempted User Privilege Gain : sp_password - password change

IDS - Attempted User Privilege Gain

IDS detected Attempted User Privilege Gain : xp_cmdshell - program execution

IDS - Attempted User Privilege Gain

A user logged in using MSSQL with the following credentials: sa / ******** - Authentication policy: White List

Successful MSSQL Login

A user logged in using MSSQL with the following credentials: sa / ******** - Authentication policy: Previously Approved User

Successful MSSQL Login

MSSQL executed 2 shell commands

Execute MsSql Shell Command

User k8h3d was created with the password *********** added to groups: Administrators and logged in using SMB 2 times

User Created Successful SMB Login User Added to Group

A user logged in using SMB with the following username: k8h3d - Authentication policy: Correct Password (Part of a Brute Force Attempt)

SMB Brute Force Successful SMB Login

c:\windows\system32\services.exe installed and started %systemroot%\atmrnwhd.exe as a service named TDwf under service group None

Service Creation Service Start

C:\Windows\temp\svchost.exe was downloaded

Download File

The file C:\Windows\AtMrNwhD.exe was downloaded and executed

Download and Execute

A user logged in using SMB with the following username: Administrator - Authentication policy: Reached Max Attempts (Part of a Brute Force Attempt)

SMB Brute Force Successful SMB Login

c:\windows\system32\services.exe installed and started %systemroot%\fnsyalsa.exe as a service named hWRH under service group None

Service Creation Service Start

C:\Windows\temp\tmp.vbs was downloaded

Download File

A user logged in using MSSQL with the following username: sa - Authentication policy: Previously Approved User 2 times

Successful MSSQL Login

The file C:\Windows\fNsyaLSA.exe was downloaded and executed

Download and Execute

Service hWRH was stopped

Service Stop

c:\windows\system32\services.exe installed and started %systemroot%\zuwslpyh.exe as a service named zUEX under service group None

Service Creation Service Start

System file C:\Windows\AppCompat\Programs\Amcache.hve was modified

System File Modification

A user logged in using SMB with the following username: k8h3d - Authentication policy: Correct Password (Part of a Brute Force Attempt)

SMB Brute Force Successful SMB Login

Connection was closed due to timeout

The file C:\Windows\ZUWslPyh.exe was downloaded and executed

Download and Execute

Associated Files

C:\windows\temp\svchost.exe

SHA256: 1136c124b4b1082971ac83f18c053a3b2c830624946294b910e67228f13a95c6

455000 bytes

C:\WINDOWS\Temp\svchost.exe

SHA256: 245855cd9c89326b531c7ce02aa313320a2a61b26771c389b6e0f997cf248e58

130000 bytes

C:\WINDOWS\Temp\svchost.exe

SHA256: 33653e42949f068590eb2cde28cb78070ea35bd1757d71c67846183a6564fb0f

195000 bytes

C:\AaXvdPmM.exe

SHA256: 3c2fe308c0a563e06263bbacf793bbe9b2259d795fcc36b953793a7e499e7f71

56320 bytes