Network Analysis- HELPING OUT AN INEXPERIENCED ANALYST
I am doing this network analysis on this sample from MalwareTrafficAnalysis.
Without further ado, Let’s get in!
First of all we need to extract the zipped folder as shown below
Now, that we got it. let’s open it
You would need to enter the password to analyse the file using wireshark, It’s password is: 20150224, Well, It’s straight forward you get it from it’s name as it is without spaces! Also, infected_ before that…Thank me later :)
We open our desired file in wireshark and get into it.
password for this sample was infected_20150224
Anyways, let’s start
Here are the questions for the sample:
Q1: Date and time of the activity
Q2: IP address of the associated desktop (or laptop) computer
Q3: Host name of the associated desktop (or laptop) computer
Q4: MAC address of the associated desktop (or laptop) computer
Q5: Brief summary of the activity
Ans1:
In the frame packet we see the date and time, It’s asking about when the activity started. We applied dns filter to get the very first address the PC asked for .
Ans2: Most packets sent by the domain is the Victim IP, We go to:
Statistics > Endpoints > IPv4
Ans3: If the infected machine is Windows, it often broadcasts its hostname via NetBIOS. So, Let’s check for nbns traffic .
Ans4: Same IP victims MAC can be found by just switching the tab to ethernet as we did in Q2
Ans5 Summary:
Get Pretty_Knight’s stories in your inbox
Join Medium for free to get updates from this writer.
We apply the http and ip.addr filter, as from now we know it has got http traffic the most from protocol hierarchy: Statistics > Protocol Hierarchy
Lets’ analyze the packets…
Starting from the first packet we see the legit website of microsoft.
Then we have google.com and so on…
On the 665th packet we see legacylifespaces.com addressed. Nothing sus!
Carry on our investigation
On following tcp stream, We find this strange domain that the website redirects to maybe
Later on we see, indeed it was something sus, referer is legacylifespaces
So, here’s what makes sense, the victim stephanie visited legacylifespaces[.]com and got redirected to this malicious domain mpzfprxfdn[.]com
Now, we see if there were any downloads from the domain.
File > Export Objects > Http
Multiple files downloaded!
I hope you enjoyed diving in the networks :)
