How to analyze PCAP file? Part 5
By Owais Ali Khan
PCAP FIle Link
- Domain controller (DC): 10.9.11.2
WIN-GTWXC9UYSE4
Host 10.9.11.135 sends DNS Query to DC for quadcinema.com domain.
DC replied with IP 104.196.13.170
Host 10.9.11.135 Makes connection with quadcinema.com 104.196.13.170 using TCP 3-way handshake
Then TLS Handshake.
Then Normal web browsing packets.
Host send DNS Query to DC for aatthews.cfd
which is sus….
DC replies with 2 IP addresses 172.67.205.86 and 104.21.22.148.
Get Owais Ali Khan’s stories in your inbox
Join Medium for free to get updates from this writer.
Domain itself is flagged malicious but not the IPs.
That’s because aatthews.cfd is using Cloudflare so those 2 IPs are proxies of cloudflare.
After that host send QUIC Connection requests to aatthews.cfd. Which means it makes all TLS and TCP connections using QUIC.
The QUIC protocol is very fast and secure. However, it is so secure that analysts cannot easily inspect packet headers. Because it encrypts most information, including headers, it can create visibility and monitoring challenges for organizations.
Now, we know the victim i.e the host 10.9.11.135 and the malicious server it is connected to i.e aatthews.cfd.
To answer the following questions:
I know IP, MAC
10.9.11.135 and 08:d4:0c:7a:29:1e
There is legacy protocol “BROWSER” I found.
Host is requesting Announcement as DESKTOP-6T17ZFM
To find user account name and full name I will search SAMR
ACCOUNT NAME: gmcdowell
FULL NAME: McDowell
