Cyber Threat Intelligence

Discover malicious IPs and domains with Akamai Guardicore Segmentation

IP Address: 182.23.20.131Previously Malicious

IP Address: 182.23.20.131Previously Malicious

This IP address attempted an attack on a machine in our threat sensors network

Threat Information

Role

Attacker, Scanner

Services Targeted

SMB

Tags

Outgoing Connection Service Creation Service Start Access Suspicious Domain CMD DNS Query Service Configuration IDS - A Network Trojan was detected SMB Null Session Login SMB User Added to Group User Created

Associated Attack Servers

185.26.112.217

Basic Information

IP Address

182.23.20.131

Domain

-

ISP

Indonesia Online Access

Country

Indonesia

WHOIS

Created Date

-

Updated Date

-

Organization

-

First seen in Akamai Guardicore Segmentation

2018-08-12

Last seen in Akamai Guardicore Segmentation

2020-04-21

What is Akamai Guardicore Segmentation
Akamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

IDS detected A Network Trojan was detected : ETERNALBLUE Probe Vulnerable System Response MS17-010

IDS - A Network Trojan was detected

Service YeJy was created and started

Service Start Service Creation

User admin$ was created with the password ************* and added to groups: Administrators

User Created User Added to Group

Process c:\windows\system32\regsvr32.exe generated outgoing network traffic to: 139.5.177.19:8019 and 173.208.153.130:8130

Outgoing Connection

Process c:\windows\system32\s.exe generated outgoing network traffic to: 23.236.69.114:8114, 66.117.6.174:80 and 66.117.6.174:8114

Outgoing Connection

Process c:\windows\system32\s.exe attempted to access suspicious domains: gamesoxalic.com

Access Suspicious Domain Outgoing Connection

Process c:\windows\system32\regsvr32.exe attempted to access suspicious domains: js.1226bye.xyz

Access Suspicious Domain Outgoing Connection DNS Query

Process c:\windows\system32\regsvr32.exe generated outgoing network traffic to: 185.26.112.217:280

Outgoing Connection

Connection was closed due to user inactivity