Skip to content

2017-07-22-traffic-analysis-exercise-where-dreams-are-made.md

Latest commit

 

History

History
47 lines (39 loc) · 2.98 KB

2017-07-22-traffic-analysis-exercise-where-dreams-are-made.md

File metadata and controls

47 lines (39 loc) · 2.98 KB
Raw

2017-07-22 - TRAFFIC ANALYSIS EXERCISE - WHERE DREAMS ARE MADE

Executive Summary

On 2017-07-22, an infected host (172.16.45.98/Mean-Gene-PC) was observed communicating with malicious infrastructure, likely due to a Trojan infection.

Affected Host

  • IP Address: 172.16.45.98
  • MAC Address: 00:18:f3:0e:f3:3a
  • Hostname: Mean-Gene-PC

Evidence and Methods

All findings were derived from the analysis of 2017-07-22-traffic-analysis-exercise.pcap using Wireshark and tshark filters, and the Suricata IDS using the ET OPEN Ruleset.

1. Possible Infected Hosts Identification

  • Method: Analyzed packet counts in the Conversations statistics tab to identify the top destinations by packet count.
  • Result: The following top conversations by packet count were observed:
    • 172.16.45.52:49164 -> 72.21.81.200:80 - 5166 packets
    • 172.16.45.98:49160 -> 104.18.40.172:80 - 1940 packets
    • 172.16.45.52:49198 -> 184.25.56.229:80 - 1652 packets
    • 172.16.45.52:49192 -> 63.217.21.41:80 - 1225 packets
    • 172.16.45.52:49194 -> 63.217.21.41:80 - 1164 packets
  • Analysis: 4 out of the top 5 conversations were initiated by a single host, 2 of them to the same server.
    • #1 immediately looks abnormal, as it contains significantly more packets than any other conversation in the pcap. A quick look however reveals that it's merely an mp4 stream.
    • #3, #4 and #5 all look like a legitimate user browsing to a news website.
    • #2 is a long conversation between our host and a site named service.tellepizza.com, flagged by VirusTotal as malicious (only by a single engine). The conversation includes the download of several .dat files (browser.dat, email.dat, software.dat, etc.).

2. Host MAC and Hostname Identification (DHCP)

  • Method: Filtered DHCP traffic for the IP address 172.16.45.98 using dhcp.option.requested_ip_address==172.16.45.98.
  • Result: The MAC address 00:18:f3:0e:f3:3a and hostname Mean-Gene-PC were identified for the IP address 172.16.45.98.
  • Alternative Method: Using NBNS by filtering nbns.addr == 172.16.45.98 returns a similar result.

3. Infection Characterization

  • Method: Applied the ET OPEN Suricata Ruleset to the pcap and compared resulting alerts to current findings.
  • Result: 172.16.45.98 accessed myexternalip.com, and several POST requests to gate.php without accept headers or referer were flagged as generic Trojan techniques.

Timeline (derived from pcap aggregation)

  • Host (172.16.45.98/Mean-Gene-PC) was priorly infected.
  • Host communicated with likely Trojan C2 server 104.18.40.172 for about 2 minutes.

Notes and Limitations

  • All findings are strictly from analysis of the provided pcap, the tshark-derived outputs included in the investigation notes, and suricata-derived alerts not included.
  • The ET PRO ruleset was not utilized in any way during this investigation.