Conduct PCAP analysis via Wireshark and provide a report on attack vectors used and various IOCs associated with malware infection.
- PCAP Analysis
- Detailed understanding of web traffic components as they relate to the OSI model
- Improved overall analytical skills
- Better understanding of encryption protocols and PKI framework
- Wireshark
- NMAP
1. Created custom columns and filters to make data more legible.
2. Tried filtering for DHCP and NetBios frames to find host name. Only the DHCP discover frame contained that info.
- I subsequently enabled name resolution in the view menu to keep the host name visible as I continued looking through the PCAP. filtering for NetBios frames also provides the hostname.
- I was also able to get the device's MAC Address from the Frames (00:60:52:b7:33:0f).
3. First thing to note in the PCAP was that after the user navigated to oceriesfornot.top, a DNS query was made to another domain: antnosience.com at IP 157.245.142.66
4. I needed more information on what exactly between the TCP 3-way handsahke and the DNS query, so I decided to update my filter to capture all HTTP/1.1 traffic.
The screenshot above that the user downloaded a package from 188.166.118.
5. Next step was to export all HTTP objects to take a closer look at them. A total of 2 objects were exported from the object list. In order to learn more about each object, I spun up my Linux VM to check attributes via the CLI.
I checked the SHA256 hash value of the file and uploaded it to TotalVirus.com. It returned the results below:
Checking the various file names for additional info I noticed the following:
I then conducted a search for the IcedID malware in the MITRE database. It returned the following:
Among other things, IceID uses HTTPS to reach out to C2 servers.
6. Another HTTP Get request was made to this potentially malicious domain.
The file downloaded was .der file, indicating it was a certificate. It's possible that this may be some sort of self-signed certificate designed to facilitate a Man-in-the-Middle attack via proxies, which would be consistent with some IcedID attack vectors.
7. Upon further investigation, it looks like the host was redirected to various malicious sites, which ultimately led to the downloading of the certificates.
