Cyber Threat Intelligence

Discover malicious IPs and domains with Akamai Guardicore Segmentation

IP Address: 188.18.55.48Previously Malicious

IP Address: 188.18.55.48Previously Malicious

This IP address attempted an attack on a machine in our threat sensors network

Threat Information

Role

Attacker, Scanner

Services Targeted

MSSQL SMB

Tags

Service Creation Access Suspicious Domain IDS - A Network Trojan was detected Outgoing Connection CMD Service Configuration SMB Null Session Login User Created SMB Service Start User Added to Group

Associated Attack Servers

-

Basic Information

IP Address

188.18.55.48

Domain

-

ISP

Rostelecom

Country

Russian Federation

WHOIS

Created Date

-

Updated Date

-

Organization

-

First seen in Akamai Guardicore Segmentation

2020-05-08

Last seen in Akamai Guardicore Segmentation

2020-05-21

What is Akamai Guardicore Segmentation
Akamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

IDS detected A Network Trojan was detected : ETERNALBLUE Probe Vulnerable System Response MS17-010

IDS - A Network Trojan was detected

Service lFgC was created and started

Service Start Service Creation

User admin$ was created with the password ************* and added to groups: Administrators

User Added to Group User Created

Process c:\windows\system32\regsvr32.exe generated outgoing network traffic to: 139.5.177.19:8019 and 173.208.153.130:8130

Outgoing Connection

Process c:\windows\system32\s.exe generated outgoing network traffic to: 23.236.69.114:8114, 66.117.6.174:80 and 66.117.6.174:8114

Outgoing Connection

Process c:\windows\system32\s.exe attempted to access suspicious domains: gamesoxalic.com

Access Suspicious Domain Outgoing Connection

Process c:\windows\system32\regsvr32.exe generated outgoing network traffic to: 172.83.155.170:280 and 173.208.153.130:8130

Outgoing Connection

Process c:\windows\system32\winu.exe generated outgoing network traffic to: 23.236.69.114:8114 and 66.117.6.174:8114

Outgoing Connection

Process c:\windows\system32\winu.exe attempted to access suspicious domains: gamesoxalic.com

Access Suspicious Domain Outgoing Connection

Connection was closed due to user inactivity