BTLO | Network Analysis — Malware Compromise
As I opened the pcap, I saw the first HTTP GET request to klychenogg[.]com which is possibly a sign of php execution.
The source port comes from 10.11.27.101 and this is most likely the IP address of the infected host, this frame also give us the answer to the second question.
At first, I thought that the attacker’s address would be 10.11.27.101, but I got the Source and Destination mixed up.
Next, I looked more into the packets and found this, a query to cochrimato[.]com
At this point, I remembered about filters and did a simple query ip.addr == 10.11.27.101.
Get Syd’s stories in your inbox
Join Medium for free to get updates from this writer.
This query still showed me some similar requests so I added http.request to my query. It would now look like this. ip.addr == 10.11.27.101 && http.request
And voila! It showed me every HTTP request to tell me a story. It also gave me the answers to the next few questions.
For the last question, I didn’t know what a post-infection IP address was, so I did some research on what it is and also did a quick research on Dridex.
After a quick search from MITRE and Wikipedia, I learned that this is a trojan malware that specializes in stealing bank credentials. (yikes)
After a while, I still hadn’t figured out how to find post-infected IPs so I just took all available IPs with 185. and eventually found the IP.
Anyway, after finishing the lab, I went ahead and looked at some writeups to see what I could improve on, though I think I did a pretty good job on this lab! I learned that filters can be a really big help in these types of analyses. I still want to figure out the post-infection traffic IP addresses, or it’s right in front of me, but I still lack the knowledge. :P
