Akamai Guardicore Segmentation CTI

Threat Information

Role	Attacker, Connect-Back, Scanner
Services Targeted	MSSQL SMB
Tags	Drop MsSql Table Execute MsSql Shell Command MSSQL Brute Force MSSQL Download and Execute File Operation By CMD Access Suspicious Domain IDS - Attempted User Privilege Gain Create MsSql Procedure Successful MSSQL Login Create MsSql Table DNS Query CMD MSSQL Null Session Login
Associated Attack Servers	121.201.65.116 acelerate.net adsl-pool.sx.cn airtel.in byzantium.com.es dozor.mobi elcat.kg jlccptt.net.cn lstn.net quadranet.com tedata.net tm.net.my ttnet.com.tr vivozap.com.br 27.6.236.98 27.191.193.165 27.223.1.22 39.77.236.66 41.32.227.82 46.109.152.175 58.22.218.108 61.5.27.106 61.147.124.69 62.215.189.167 63.143.45.235 72.11.128.214 78.187.138.37 80.85.84.75 83.239.69.74 91.135.200.114 105.96.57.50 106.228.3.80 113.163.215.206 118.71.105.27 119.12.209.75 120.194.130.66 121.31.110.41 121.201.65.116 122.185.100.38 122.185.161.13 123.27.171.42 124.163.218.8 125.32.54.194 159.203.38.75

Basic Information

IP Address	212.42.104.101
Domain	-
ISP	ElCat Ltd.
Country	Kyrgyzstan
WHOIS	Created Date	-
	Updated Date	-
	Organization	-

First seen in Akamai Guardicore Segmentation	2021-05-11
Last seen in Akamai Guardicore Segmentation	2024-05-10

What is Akamai Guardicore Segmentation
Akamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

The file c:\windows\system32\spool\drivers\x64\3\tsprint.dll was downloaded and loaded by c:\windows\system32\spool\drivers\x64\3\tsprint.dll	Download and Execute
A user logged in using MSSQL with the following credentials: sa / ****** - Authentication policy: White List (Part of a Brute Force Attempt)	Successful MSSQL Login MSSQL Brute Force
MSSQL procedures were created: sp_addextendedproc , sp_addlogin , sp_addsrvrolemember , sp_droplogin and sp_password	Create MsSql Procedure
IDS detected Attempted User Privilege Gain : sp_password - password change	IDS - Attempted User Privilege Gain
IDS detected Attempted User Privilege Gain : xp_reg* - registry access	IDS - Attempted User Privilege Gain
IDS detected Attempted User Privilege Gain : xp_cmdshell - program execution	IDS - Attempted User Privilege Gain
IDS detected Attempted User Privilege Gain : SQL sp_configure - configuration change	IDS - Attempted User Privilege Gain
MSSQL tables were dropped: #A1E8A56F and #A3D0EDE1	Drop MsSql Table
MSSQL tables were created: #temp_jobs_to_delete________________________________________________________________________________________________000000000002	Create MsSql Table
IDS detected Attempted User Privilege Gain : sp_start_job - program execution	IDS - Attempted User Privilege Gain
Process c:\program files\microsoft sql server\mssql11.sqlexpress\mssql\binn\sqlservr.exe attempted to access suspicious domains: load.wpd0126.info and load2.wpd0126.info	Access Suspicious Domain DNS Query
Process NetworkService Service Group attempted to access suspicious domains: load.wpd0126.info	Access Suspicious Domain DNS Query
MSSQL executed 2 shell commands	Execute MsSql Shell Command
Connection was closed due to timeout

Cyber Threat Intelligence

Discover malicious IPs and domains with Akamai Guardicore Segmentation

Threat Information

Basic Information

Attack Flow