IP Address: 61.163.104.156Previously Malicious
IP Address: 61.163.104.156Previously Malicious
This IP address attempted an attack on a machine in our threat sensors network
|
Role |
Attacker, Scanner |
|
Services Targeted |
MSSQL |
|
Tags |
Create MsSql Procedure DNS Query Execute MsSql Shell Command Create MsSql Table MSSQL Successful MSSQL Login MSSQL Brute Force Service Stop File Operation By CMD Drop MsSql Table Outgoing Connection Access Suspicious Domain Download and Execute Persistency - Mime Filter CMD |
|
Associated Attack Servers |
|
IP Address |
61.163.104.156 |
|
|
Domain |
- |
|
|
ISP |
China Telecom |
|
|
Country |
China |
|
|
WHOIS |
Created Date |
- |
|
Updated Date |
- |
|
|
Organization |
- |
|
|
First seen in Akamai Guardicore Segmentation |
2018-09-30 |
|
Last seen in Akamai Guardicore Segmentation |
2021-03-23 |
What is Akamai Guardicore SegmentationAkamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More
|
A user logged in using MSSQL with the following username: sa - Authentication policy: Reached Max Attempts (Part of a Brute Force Attempt) |
MSSQL Brute Force Successful MSSQL Login |
|
A user logged in using MSSQL with the following credentials: sa / *********** - Authentication policy: Previously Approved User (Part of a Brute Force Attempt) 2 times |
MSSQL Brute Force Successful MSSQL Login |
|
A user logged in using MSSQL with the following username: sa - Authentication policy: Previously Approved User (Part of a Brute Force Attempt) |
MSSQL Brute Force Successful MSSQL Login |
|
MSSQL procedures were created: sp_addextendedproc and sp_dropextendedproc |
Create MsSql Procedure |
|
Process c:\windows\system32\ftp.exe attempted to access suspicious domains: cct119.com |
DNS Query Access Suspicious Domain |
|
Process c:\windows\system32\ftp.exe generated outgoing network traffic to: 124.166.251.20:21 2 times |
Outgoing Connection |
|
Process c:\windows\system32\ftp.exe attempted to access suspicious domains: adsl-pool.sx.cn 3 times |
Access Suspicious Domain Outgoing Connection |
|
MSSQL tables were dropped: #A2DCB9B1 and #A4C50223 |
Drop MsSql Table |
|
MSSQL tables were created: #temp_jobs_to_delete________________________________________________________________________________________________000000000002 |
Create MsSql Table |
|
Service CryptSvc was stopped |
Service Stop |
|
c:\windows\system32\conhost.exe installed a Persistency - Mime Filter backdoor by modifying Windows Registry 21 times |
Persistency - Mime Filter |
|
c:\windows\system32\regsvr32.exe installed a Persistency - Mime Filter backdoor by modifying Windows Registry 10 times |
Persistency - Mime Filter |
|
Process c:\windows\system32\ftp.exe generated outgoing network traffic to: 124.166.251.20:21 |
Outgoing Connection |
|
Process c:\windows\system32\ftp.exe attempted to access suspicious domains: adsl-pool.sx.cn |
Access Suspicious Domain Outgoing Connection |
|
The file C:\Windows\System32\p.exe was downloaded and executed 5 times |
Download and Execute |
|
Process c:\windows\system32\p.exe generated outgoing network traffic to: 124.166.251.20:21 |
Outgoing Connection |
|
Process c:\windows\system32\p.exe attempted to access suspicious domains: adsl-pool.sx.cn |
Access Suspicious Domain Outgoing Connection |
|
Process c:\windows\syswow64\ftp.exe generated outgoing network traffic to: 124.166.251.20:21 |
Outgoing Connection |
|
Process c:\windows\syswow64\ftp.exe attempted to access suspicious domains: adsl-pool.sx.cn |
Access Suspicious Domain Outgoing Connection |
|
Process c:\windows\system32\p.exe generated outgoing network traffic to: 124.166.251.20:21 |
Outgoing Connection |
|
Process c:\windows\system32\p.exe attempted to access suspicious domains: adsl-pool.sx.cn |
Access Suspicious Domain Outgoing Connection |
|
Process c:\windows\system32\ftp.exe generated outgoing network traffic to: 124.166.251.20:21 |
Outgoing Connection |
|
Process c:\windows\system32\ftp.exe attempted to access suspicious domains: adsl-pool.sx.cn |
Access Suspicious Domain Outgoing Connection |
|
MSSQL executed 2 shell commands |
Execute MsSql Shell Command |
|
Process c:\windows\system32\ftp.exe generated outgoing network traffic to: 124.166.251.20:21 |
Outgoing Connection |
|
Process c:\windows\system32\ftp.exe attempted to access suspicious domains: adsl-pool.sx.cn |
Access Suspicious Domain Outgoing Connection |
|
Process c:\windows\system32\p.exe generated outgoing network traffic to: 124.166.251.20:21 |
Outgoing Connection |
|
Process c:\windows\system32\p.exe attempted to access suspicious domains: adsl-pool.sx.cn |
Access Suspicious Domain Outgoing Connection |
|
Process c:\windows\system32\cmd.exe generated outgoing network traffic to: 124.166.251.20:21 |
|
|
Process c:\windows\system32\ftp.exe attempted to access suspicious domains: adsl-pool.sx.cn |
Access Suspicious Domain Outgoing Connection |
|
Process c:\windows\system32\conhost.exe generated outgoing network traffic to: 124.166.251.20:21 |
|
|
Process c:\windows\syswow64\ftp.exe attempted to access suspicious domains: adsl-pool.sx.cn |
Access Suspicious Domain Outgoing Connection |
|
The file C:\ProgramData\foahpwo.dll was downloaded and executed 3 times |
Download and Execute |
|
Process c:\windows\system32\p.exe generated outgoing network traffic to: 124.166.251.20:21 2 times |
Outgoing Connection |
|
Process c:\windows\system32\p.exe attempted to access suspicious domains: adsl-pool.sx.cn 2 times |
Access Suspicious Domain Outgoing Connection |
|
Process c:\windows\system32\ftp.exe generated outgoing network traffic to: 124.166.251.20:21 |
Outgoing Connection |
|
Process c:\windows\system32\ftp.exe attempted to access suspicious domains: adsl-pool.sx.cn |
Access Suspicious Domain Outgoing Connection |
|
Connection was closed due to timeout |
|
|
Process c:\windows\system32\taskhost.exe generated outgoing network traffic to: 124.166.251.20:21 |
|
© 2023 Akamai Technologies