Cyber Threat Intelligence

Discover malicious IPs and domains with Akamai Guardicore Segmentation

IP Address: 165.165.183.234Malicious

IP Address: 165.165.183.234Malicious

This IP address attempted an attack on a machine in our threat sensors network

Threat Information

Role

Attacker, Scanner

Services Targeted

MSSQL SMB

Tags

Port 1433 Scan Successful SMB Login Service Start Execute from Share CMD File Operation By CMD DNS Query Service Creation Port 445 Scan Download and Execute SMB Service Deletion SMB Share Connect Access Share Download File Access Suspicious Domain System File Modification Service Stop

Associated Attack Servers

info.ackng.com info.beahh.com ip.42.pl

192.168.0.1 192.168.0.2 192.168.0.3 192.168.0.5 192.168.0.9 192.168.0.10

Basic Information

IP Address

165.165.183.234

Domain

-

ISP

Telkom SA Limited

Country

South Africa

WHOIS

Created Date

-

Updated Date

-

Organization

-

First seen in Akamai Guardicore Segmentation

2019-12-20

Last seen in Akamai Guardicore Segmentation

2024-01-12

What is Akamai Guardicore Segmentation
Akamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

A user logged in using SMB with the following username: Administrator - Authentication policy: Reached Max Attempts

Successful SMB Login

C:\aAmqfdOf.exe was downloaded

Download File

c:\windows\system32\services.exe installed and started \\server-backup\c$\aamqfdof.exe as a service named deZl under service group None

Service Creation Service Start

aamqfdof.exe was executed from the remote share \\server-backup\c$

Execute from Share

C:\WINDOWS\Temp\svchost.exe was downloaded

Download File

C:\windows\temp\tmp.vbs was downloaded

Download File

A user logged in using SMB with the following username: Administrator - Authentication policy: Previously Approved User 4 times

Successful SMB Login

Service deZl was stopped

Service Stop

C:\MInVhEkD.exe was downloaded

Download File

Process c:\windows\system32\mshta.exe attempted to access suspicious domains: w.beahh.com

DNS Query Access Suspicious Domain

c:\windows\system32\services.exe installed and started \\server-backup\c$\minvhekd.exe as a service named HfnV under service group None

Service Creation Service Start

minvhekd.exe was executed from the remote share \\server-backup\c$

Execute from Share

The file C:\WINDOWS\fUiGaBPf.exe was downloaded and executed 2 times

Download and Execute

The file C:\WINDOWS\Temp\_MEI2842\_hashlib.pyd was downloaded and loaded by c:\windows\temp\_mei2842\_hashlib.pyd

Download and Execute

The file C:\WINDOWS\Temp\_MEI2842\_socket.pyd was downloaded and loaded by c:\windows\temp\_mei2842\_socket.pyd

Download and Execute

The file C:\WINDOWS\Temp\_MEI2842\_ssl.pyd was downloaded and loaded by c:\windows\temp\_mei2842\_ssl.pyd

Download and Execute

The file C:\WINDOWS\Temp\_MEI2842\pywintypes27.dll was downloaded and loaded by c:\windows\fuigabpf.exe

Download and Execute

The file C:\WINDOWS\Temp\_MEI2842\_mssql.pyd was downloaded and loaded by c:\windows\fuigabpf.exe

Download and Execute

The file C:\WINDOWS\Temp\_MEI2842\select.pyd was downloaded and loaded by c:\windows\fuigabpf.exe

Download and Execute

The file C:\WINDOWS\Temp\_MEI2842\Crypto.Cipher._ARC4.pyd was downloaded and loaded by c:\windows\fuigabpf.exe

Download and Execute

The file C:\WINDOWS\Temp\_MEI2842\Crypto.Cipher._DES.pyd was downloaded and loaded by c:\windows\fuigabpf.exe

Download and Execute

The file C:\WINDOWS\Temp\_MEI2842\Crypto.Hash._MD4.pyd was downloaded and loaded by c:\windows\fuigabpf.exe

Download and Execute

The file C:\WINDOWS\Temp\_MEI2842\Crypto.Cipher._DES3.pyd was downloaded and loaded by c:\windows\temp\_mei2842\crypto.cipher._des3.pyd

Download and Execute

The file C:\WINDOWS\Temp\_MEI2842\bz2.pyd was downloaded and loaded by c:\windows\fuigabpf.exe

Download and Execute

System file C:\WINDOWS\system32\wbem\AutoRecover\88744D2A29102FC88ECF505DD2E984FC.mof was modified

System File Modification

Process c:\windows\fuigabpf.exe attempted to access suspicious domains: info.ackng.com, info.beahh.com and ip.42.pl

DNS Query Access Suspicious Domain

Process c:\windows\fuigabpf.exe generated outgoing network traffic to: 192.168.0.10:1433, 192.168.0.10:445, 192.168.0.11:1433, 192.168.0.11:445, 192.168.0.12:1433, 192.168.0.12:445, 192.168.0.13:1433, 192.168.0.13:445, 192.168.0.14:1433, 192.168.0.14:445, 192.168.0.15:1433, 192.168.0.15:445, 192.168.0.16:1433, 192.168.0.16:445, 192.168.0.17:1433, 192.168.0.17:445, 192.168.0.18:1433, 192.168.0.18:445, 192.168.0.19:1433, 192.168.0.19:445, 192.168.0.1:445, 192.168.0.20:1433, 192.168.0.20:445, 192.168.0.21:1433, 192.168.0.21:445, 192.168.0.22:445, 192.168.0.23:445, 192.168.0.24:445, 192.168.0.25:445, 192.168.0.26:445, 192.168.0.2:1433, 192.168.0.2:445, 192.168.0.3:1433, 192.168.0.3:445, 192.168.0.4:1433, 192.168.0.4:445, 192.168.0.5:1433, 192.168.0.5:445, 192.168.0.6:1433, 192.168.0.6:445, 192.168.0.7:445, 192.168.0.8:1433, 192.168.0.8:445, 192.168.0.9:1433 and 192.168.0.9:445

Process c:\windows\fuigabpf.exe scanned port 445 on 26 IP Addresses

Port 445 Scan Port 1433 Scan

Process c:\windows\fuigabpf.exe scanned port 1433 on 26 IP Addresses

Port 445 Scan Port 1433 Scan

Process c:\windows\fuigabpf.exe scanned port 445 on 19 IP Addresses

Port 445 Scan Port 1433 Scan

Process c:\windows\fuigabpf.exe scanned port 1433 on 19 IP Addresses

Port 445 Scan Port 1433 Scan

Connection was closed due to timeout

Associated Files

C:\Windows\temp\svchost.exe

SHA256: 0b88f2b6a66a2844eb5cf1a9eebc60a3008400e90865448cf499381c74dd8c0a

1365000 bytes

C:\Windows\temp\svchost.exe

SHA256: 0f8908cbad89f7f386fbc6a97c3cc994e756c440f5cab578e322ab9ed329d5f4

3510000 bytes

C:\windows\temp\svchost.exe

SHA256: 104782cf9cc5d9aa52ba5f65ee80b9ee6916634da957e81738397234dfc03841

1950000 bytes

C:\windows\temp\svchost.exe

SHA256: 186f34c822170d62a9c8560bb5f22d95ce1ce04d525ca0894a4d5a308251f118

1625000 bytes

C:\windows\temp\svchost.exe

SHA256: 23cd78928dbf9e1ba60ac5e83592c9d124080717302d5e9e564381de495ae729

910000 bytes

C:\windows\temp\svchost.exe

SHA256: 2f56371e958f13da85ed52af54e8eeb7fa5e0d443b5da70434fe48cb30cb576b

1430000 bytes

C:\WINDOWS\Temp\svchost.exe

SHA256: 31394f8680816ce98b889d1ea7157bb8f68ec39413bd69af70dd39d3843548d0

845000 bytes

C:\Windows\temp\svchost.exe

SHA256: 322780fe8ae41ab5d0ca71a465f9d519d4ba27417d259c2b26ce24849de9f720

4875000 bytes

C:\AANvVMWb.exe

SHA256: 3c2fe308c0a563e06263bbacf793bbe9b2259d795fcc36b953793a7e499e7f71

56320 bytes