Skip to content

2025-01-22-traffic-analysis-exercise-download-from-fake-software-site.md

Latest commit

 

History

History
61 lines (51 loc) · 4.42 KB

2025-01-22-traffic-analysis-exercise-download-from-fake-software-site.md

File metadata and controls

61 lines (51 loc) · 4.42 KB
Raw

2025-01-22 - TRAFFIC ANALYSIS EXERCISE: DOWNLOAD FROM FAKE SOFTWARE SITE

Executive Summary

On 2025-01-22, an infected Windows host (10.1.17.215 / DESKTOP-L8C5GSJ) was observed communicating with malicious infrastructure. The activity is consistent with the execution of application_setup.js, which downloaded and executed malicious files. Primary Command and Control (C2) candidates identified include 45.125.66.32 and 5.252.153.241. The fake authenticator domain observed in TLS SNI values was google-authenticator.burleson-appliance.net (with authenticatoor.org also present). Published IOCs from Unit42 were used to guide the identification process.

Affected Host

  • IP Address: 10.1.17.215
  • MAC Address: 00:d0:b7:26:4a:74
  • Hostname: DESKTOP-L8C5GSJ
  • User Account Observed: shutchenson

Evidence and Methods

All findings were derived from the analysis of 2025-01-22-traffic-analysis-exercise.pcap using Wireshark and tshark filters and aggregation.

1. Infected Host Identification

  • Method: Filtered HTTP traffic to known malicious C2 server 5.252.153.241 using ip.dst==5.252.153.241.
  • Result: Multiple HTTP requests from 10.1.17.215 to http://5.252.153.241/... including:
    • /api/file/get-file/pas.ps1 (1 request)
    • /api/file/get-file/Teamviewer_Resource_fr (1 request)
    • /api/file/get-file/TeamViewer (1 request)
    • /api/file/get-file/TV (1 request)
    • /api/file/get-file/29842.ps1 (1 request)
    • /api/file/get-file/264872 (1 request)
    • /1517096937?k=script:%20RunRH,%20status:%20OK,%20message:%20PS%20process%20started (3 requests)
    • /1517096937?k=message%20=%20startup%20shortcut%20created;%20%20status%20=%20success; (1 request)
    • /1517096937 (584 requests)
  • Aggregate Count: 594 requests to 5.252.153.241 from 10.1.17.215.

2. Host MAC and Hostname Identification (DHCP)

  • Method: Filtered DHCP traffic for the IP address 10.1.17.215 using dhcp.option.requested_ip_address==10.1.17.215.
  • Result: The MAC address 00:d0:b7:26:4a:74 and hostname DESKTOP-L8C5GSJ were identified for the IP address 10.1.17.215.

3. User Account Identification (Kerberos)

  • Method: Filtered Kerberos traffic from the IP address 10.1.17.215 using ip.src==10.1.17.215 && kerberos.
  • Result: The Kerberos authentication requests revealed the following accounts:
    • Computer account: desktop-l8c5gsj$
    • User account: shutchenson

4. Lure / Fake Domain Identification (TLS SNI)

  • Method: Filtered TLS Client Hello messages from the IP address 10.1.17.215 using ip.src==10.1.17.215 && tls.handshake.type == 1.
  • Result: The following unique SNI values were observed:
    • google-authenticator.burleson-appliance.net
    • authenticatoor.org

5. C2 and Prominent Destinations Identification

  • Method: Filtered traffic from the IP address 10.1.17.215 using ip.src==10.1.17.215 and analyzed packet counts in the Conversations statistics tab to identify the top destinations by packet count.
  • Result: The following top destinations by packet count were observed:
    • 45.125.66.32 — 3,737 packets
    • 5.252.153.241 — 3,475 packets
    • 10.1.17.2 — 2,327 packets
    • 82.221.136.26 — 834 packets
    • 45.125.66.252 — 466 packets
  • Analysis: The IP addresses 45.125.66.32, 5.252.153.241, and 45.125.66.252 are the most likely C2 candidates due to their high packet counts and the nature of the traffic observed. These IP addresses were involved in multiple HTTP requests and file retrievals, which are consistent with C2 communication patterns. Additionally, 5.252.153.241 was identified as a known malicious C2 server based on published IOCs from Unit42.

Timeline (derived from pcap aggregation)

  • Initial HTTP requests from 10.1.17.215 to 5.252.153.241 (multiple /1517096937 requests and file retrieval endpoints) consistent with file retrieval/activity from application_setup.js.
  • Repeated and sustained connections from 10.1.17.215 to 45.125.66.32 and other external IPs.

Notes and Limitations

  • Published IOC list from Unit42 (linked in the investigation notes) guided the analysis; I did not independently confirm external IOCs beyond the network artifacts visible in the pcap.
  • All findings are strictly from analysis of the provided PCAP and the tshark-derived outputs included in the investigation notes. No host filesystem or endpoint artifacts were examined beyond network-observed filenames/paths.