Cyber Threat Intelligence

Discover malicious IPs and domains with Akamai Guardicore Segmentation

IP Address: 195.26.133.9Malicious

IP Address: 195.26.133.9Malicious

This IP address attempted an attack on a machine in our threat sensors network

Threat Information

Role

Attacker, Scanner

Services Targeted

MSSQL SMB

Tags

SMB Share Connect Scheduled Task Run Access Suspicious Domain Service Stop Download File SMB Access Share SMB Brute Force CMD Service Start DNS Query Successful SMB Login Service Creation Download and Execute Service Deletion Execute from Share File Operation By CMD Scheduled Task Creation

Associated Attack Servers

t.amynx.com w.zz3r0.com

Basic Information

IP Address

195.26.133.9

Domain

-

ISP

-

Country

North Macedonia

WHOIS

Created Date

-

Updated Date

-

Organization

-

First seen in Akamai Guardicore Segmentation

2023-07-11

Last seen in Akamai Guardicore Segmentation

2024-04-02

What is Akamai Guardicore Segmentation
Akamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

A user logged in using SMB with the following username: Administrator - Authentication policy: Reached Max Attempts (Part of a Brute Force Attempt)

SMB Brute Force Successful SMB Login

A user logged in using SMB with the following username: Administrator - Authentication policy: Previously Approved User (Part of a Brute Force Attempt) 4 times

SMB Brute Force Successful SMB Login

C:\EIUGCWrT.exe was downloaded

Download File

The file C:\WINDOWS\JGXjHEBT.exe was downloaded and executed

Download and Execute

c:\windows\system32\services.exe installed and started %systemroot%\jgxjhebt.exe as a service named lpaM under service group None

Service Start Service Creation

A user logged in using SMB from NULL with the following username: Administrator - Authentication policy: Previously Approved User (Part of a Brute Force Attempt) 6 times

SMB Brute Force Successful SMB Login

eiugcwrt.exe was executed from the remote share \\server-backup\c$

Execute from Share

c:\windows\system32\services.exe installed and started \\server-backup\c$\eiugcwrt.exe as a service named UQYV under service group None

Service Start Service Creation

C:\windows\temp\tmp.vbs was downloaded

Download File

Service UQYV was stopped

Service Stop

Process c:\windows\system32\mshta.exe attempted to access suspicious domains: w.zz3r0.com 2 times

DNS Query Access Suspicious Domain

The command line c:\windows\WFQTm.exe was scheduled to run by modifying C:\WINDOWS\Tasks\Autostart.job

rpmyzald.exe was executed from the remote share \\server-backup\c$

Execute from Share

c:\windows\system32\services.exe installed and started \\server-backup\c$\rpmyzald.exe as a service named gisP under service group None

Service Start Service Creation

C:\WINDOWS\Temp\tmp.vbs was downloaded

Download File

Service gisP was stopped

Service Stop

C:\uLtfbAhR.exe was downloaded

Download File

Connection was closed due to timeout

Associated Files

C:\WINDOWS\Temp\svchost.exe

SHA256: 03fa46550a0bb783b0a53b65da511c0b5ae5aae2d0944383accd5e690fc5badd

195000 bytes

C:\WINDOWS\Temp\svchost.exe

SHA256: 079a210f8974feaf5ba190260c781162121dc1f25d15a2c163d8e1a3be5ff8f2

65000 bytes

C:\WINDOWS\Temp\svchost.exe

SHA256: 0a8e6f386a5b036882e87d74cf3082dab5571da222b510c11146aeae61fac71b

260000 bytes

C:\WINDOWS\Temp\svchost.exe

SHA256: 0fb47572e89a69a5a20e0af60abf367ae992d7ec33a98349e00b2ceb928f8d37

390000 bytes

C:\WziSRhib.exe

SHA256: 0fbc405840eb0587e261cd5c9d6ddd1324a8cfecbe2ac16062927ca65eac2981

56320 bytes

C:\WINDOWS\Temp\svchost.exe

SHA256: 19ec15916d504dd9c9a4c2f05dfc0d6bd3d2e72ef8e8234a9deb601598fa15c3

130000 bytes

C:\WINDOWS\Temp\svchost.exe

SHA256: 20d11902f74a5605c0652519ec0e111e5c2481bc796dbac97dfa7bc489a07885

65000 bytes

C:\DHRraOQw.exe

SHA256: 263bdd4e70f1b1c7cfbeb5ca7325a7efcd13d73f47cdbc7e3a9899174e29bb5d

56320 bytes