Malware Traffic Analysis
Wireshark exercise One Hot Mess
Exercises link:
Malware-Traffic-Analysis.net — 2020–02–21 — Traffic analysis exercise — One-Hot-Mess
Executive Report
Environment:
- LAN Segment Range: 172.17.8.0/24 (172.17.8.0 through 172.17.8.255)
- Domain: one-hot-mess.com
- Domain Controller: 172.17.8.8 — One-Hot-Mess-DC
- LAN Segment Gateway: 172.17.8.1
- LAN Segment Broadcast Address: 172.17.8.255
Task: Write an incident report based on the pcap, associated alerts, and malware/artifacts from the infected Windows host.
Analysis and Findings
DNS Filtering
A key step in the analysis was filtering for DNS traffic to identify suspicious domains. Sorting through the DNS queries highlighted several domains and IP addresses that were not typical for the network traffic patterns.
Macro with DLL Reference
During the analysis, a macro with a DLL reference was detected. This macro exhibited logic designed to load additional functionality from Dynamically Linked Libraries (DLLs). While not explicitly malicious, this tactic is a common method used by malware to access APIs not exposed via Visual Basic for Applications (VBA).
Victim Profile
- IP Address: 172.17.8.174
- User: Gabriella Ventura
Dns lookup
Virus Total
Virus total
Bad IPV4 in the enviroment
Executive Report
Environment:
- LAN Segment Range: 172.17.8.0/24 (172.17.8.0 through 172.17.8.255)
- Domain: one-hot-mess.com
- Domain Controller: 172.17.8.8 — One-Hot-Mess-DC
- LAN Segment Gateway: 172.17.8.1
- LAN Segment Broadcast Address: 172.17.8.255
Task: Write an incident report based on the pcap, associated alerts, and malware/artifacts from the infected Windows host.
Get "CyberGuard: Malware and Vulnerabilities Analysis"’s stories in your inbox
Join Medium for free to get updates from this writer.
Answer:
Executive Summary
On Thursday, February 21, 2020, at 00:55 UTC, a Windows 10 client used by Gabriella Ventura was infected with Dridex malware. This incident was detected through network traffic analysis and confirmed by examining the associated alerts and malware artifacts found on the host.
Details of Our Infected Host
- Host Name: DESKTOP-TZMKHKC
- Host MAC Address: 00:11:75:8c:fd:47 (Intel_8c:fd:47)
- Host IP Address: 172.17.8.174
- User Account Name: gabriella.ventura
Incident Overview
Upon analyzing the pcap file and associated alerts, it was determined that the host DESKTOP-TZMKHKC was communicating with several suspicious domains and IP addresses. The network traffic revealed indicators of compromise (IOC) that are typically associated with Dridex malware infections.
Indicators of Compromise (IOC)
The following IOCs were identified in the network traffic associated with the infected host:
- Suspicious Domain: blueflag[.]xyz
- Suspicious IP Addresses:
- 49.51.172.56
- 13.107.4.50
- 13.107.3.128
- 204.79.197.200
- 91.211.88.122
- Suspicious File Path: /nCvQOQHCBjZFfiJvyVGA/yrkbdmt.bin
- File Hashes:
- b78bf56da2a0d5343bc8021a42b657b43c490456b8cc75035f267411d2dd1603
- 01ea3845eac489a2518962e6a9f968cde0811e1531f5a58718fb02cf62541edc
- 03c962ebb541a709b92957e301ea03f1790b6a57d4d0605f618fb0be392c8066
Conclusion
The incident involved the infection of a Windows 10 host within the one-hot-mess.com domain. The infection was traced back to Dridex malware, which was confirmed through network traffic analysis and identified IOCs. It is crucial to continue monitoring the network for any further suspicious activities and ensure all infected systems are cleaned and secured to prevent future incidents.
Recommendations
- Immediate Isolation: Isolate the infected host to prevent further spread of the malware.
- Malware Removal: Perform a thorough malware removal process on the infected host.
- Network Monitoring: Enhance network monitoring to detect any unusual activities promptly.
- User Training: Conduct cybersecurity awareness training for users to prevent phishing and malware infections.
- Security Policies: Review and update security policies to include stricter controls on macros and
