Skip to content

2024-11-26-traffic-analysis-exercise-nemotodes.md

Latest commit

 

History

History
45 lines (31 loc) · 2.25 KB

2024-11-26-traffic-analysis-exercise-nemotodes.md

File metadata and controls

45 lines (31 loc) · 2.25 KB
Raw

2024-11-26 - TRAFFIC ANALYSIS EXERCISE - NEMOTODES

Executive Summary

On 2024-11-26, a Windows host was infected with NetSupport RAT, likely delivered from modandcrackedapk.com after viewing a site named classicgrand.com. The infection involved a ZPHP malware campaign, with the host engaging in command and control (C2) communications and geo-location lookups indicative of malicious activity.

Affected Host

  • IP Address: 10.11.26.183
  • MAC Address: d0:57:7b:ce:fc:8b
  • Hostname: DESKTOP-B8TQK49
  • User Account Observed: oboomwald

Evidence and Methods

All findings were derived from the analysis of Suricata alerts and network traffic using Wireshark and tshark filters and aggregation.

1. Infected Host Identification

  • Method: Directly taken from the provided Suricata alerts file.
  • Result: The IP address 10.11.26.183 was identified as the infected host.

2. Host MAC and Hostname Identification (Browser Protocol)

  • Method: Filtered browser protocol packets using the filter browser.
  • Result: The MAC address d0:57:7b:ce:fc:8b and hostname DESKTOP-B8TQK49 were identified for the IP address 10.11.26.183.

3. User Account Identification (Kerberos)

  • Method: Filtered Kerberos traffic using the filter kerberos.CNameString && ip.addr==10.11.26.183.
  • Result: The Kerberos authentication requests revealed the following user account: oboomwald.

Indicators of Compromise (IOCs)

  • ZPHP Malware:
    • Domain: modandcrackedapk.com was queried and accessed.
    • IP Address: 193.42.38.139 was used to host modandcrackedapk.com.
  • NetSupport RAT:
    • Domain: geo.netsupportsoftware.com was queried and accessed for geo-location lookups.
    • IP Address: 104.26.1.231 was used for geo-location lookups.
    • IP Address: 194.180.191.64 was used for C2 communications. Accessed using HTTP POST requests on port 443.
    • Route: fakeurl.htm was used for C2 communications.
    • User Agent: NetSupport Manager/1.3 was used in HTTP requests.
  • Compromised Site:
    • Domain: classicgrand.com was accessed right before ZPHP related DNS query, indicating a likely entry point.