all right packet people so let's get some hands on with some more malware with Wireshark so in
this example we're going to be taking a look at some agent Tesla traffic that was executed
in a controlled environment so thanks to Brad Duncan and the team at Palo Alto who are giving
us these kinds of examples that we can Tinker with so let's go ahead and head out to malware
trafficanalysis.net if you hit the click here on traffic analysis exercises this was an exercise
that was posted not long ago we can come up here and we can actually download this pcap now one
reason why I really like these examples is that first of all real world this is actual malware
that is out there running around gives us an idea of what to look for in the wire and this is also
a fun way to sharpen our Wireshark skills so on one screen I have the pcapp open and on another
I have the questions for the exercise that walks us through now I've also included the questions
in the description down below so you can go ahead and take a look below this video to follow along
now if you go to that link there's also an answer key now I don't want you to be tempted to click
that too soon really try to walk through this exercise on your own then compare your answers
later it's getting that mental exercise is what's going to help you be a better analyst so the first
question when did the malicious traffic start in UTC so in order to do this with Wireshark first
I have to make sure that my time column is set up according to UTC if it's not if it's set up
just running total of time or second since start of capture which is the default setting what I'm
going to do is I'm going to come up here I'm going to go to view I'm going to come down
to time display format and I'm going to hit UTC time of day so I could also if I want to
add date time of day year day of year and so on let's just go time of day and I can see that the
beginning DNS conversation and then this ensuing TCP conversation begins at 2251.00 so that's the
UTC time that this all started the next question what's the victim's IP address not just glancing
at this I can see that I have a private address space over here one 92 168 1.27 something I'll do
though is I come up here to statistics and I come down here to conversations and let me go and bring
this in if I come over here to ipv4 I can see that this 1.27 is involved in all the conversations
so it's very likely that that is my client side the one that actually is infected in generating
this traffic next what's the MAC address well same thing could just come over here to ethernet and I
can see here the one that is the top talker this is this bceafa 2274 FB address if I close that
down or actually I can do it from right here I can just go to name resolution I can see that that is
a Hewlett Packard Mac address that's I just found that by clicking name resolution next what's the
Windows host name so I'm going to say close now a common filter that I can use to do this if I just
say frame matches now a lot of Windows machines by default will have the word desktop in them
so that's unless they've been changed to something else so this is kind of a low hanging fruit thing
that I'll do to see if I have that default Windows name there so I'm just going to hit enter nice
thing about using frame matches instead of frame contains matches makes it case irrelevant so it's
not case sensitive it could be uppercase desktop lowercase desktop and I can see right here this
got a couple matches down here on the lower right in my ASCII view let me get my head out of the way
I can see that I got desktop Dash win11 PC so if I come in here to the details I can see that this
machine is checking into an SMP TP server and it's doing basically that hello command or that hello
Hi how are you my name is desktop 111 PC so that's the actual name of the machine that was doing this
next what's the user account name so this is where I can just do a right click I'm interested in a
bit more of this SMTP let me bring myself back in here and I'm going to go to follow TCP stream and
and this will show me this stream data so there's some interesting stuff in here that we're going to
go ahead and pick apart here first of all I have an answer for one of the questions that comes down
later on and this is my external IP so this is the actual public IP address that we are netted
into from this client right so we go out with his private address space and then we're translated
into that that's later on it's a question down the road if we come down here to what's actually
being exfiltrated what this client is actually sending out you see here that says username and
then Windows 11 user so it looks like that answers that question Windows 11 user and then I see the
other answers that I need to find how much RAM CPU if I come down here it's giving a full name
it gives us the name of the desktop machine also here's my CPU Intel Core i5 13600 and if
I come over here to Ram now this is in K so 32 000 so that's going to be 32 gigabytes of RAM
now my external IP I find that here and also I can see that there's a bunch of usernames
and passwords that are being sent out and they're for email clients so here Thunderbird also I have
if I keep going down login us Coca-Cola someone likes some soda and if that's actually legitimate
Coca-Cola New York Times Amazon so I can see that usernames and passwords are being sent
out for clients and web traffic okay so I was able to find all that on LinkedIn as well I was able to
find all of that from the SMTP traffic which was sent open now that answers the questions that the
exercise had us go through and if you hit the answer you can see that those are the answers
and this is how I would have arrived at them but there's also a couple little small things that I'd
like to show you while we're here and in this pcap all right so when I have you notice that
we're actually authenticating to this SM TP server we're sending a username we're sending
a password but if you come down here to packet number let me make sure you're on the same page
as me packet 650. if we come down into the detail View SMTP you see it says login so authentication
login request parameter and then username okay so this username is sent encoded this isn't just
the actual username that was typed out so what I'm going to do is I'm just going to right click
this and I'd like you to join me here let's go ahead and take a look at show packet bytes
now from here on that top left you can see that that same string is there but what we're going to
do is come down here to the bottom where it says decode As and we're going to decode it as base64.
so this is the actual login so we were just able to do that right in Wireshark I wanted to make
sure that you all knew how to do that so there's our login okay so I'm just going to say close now
let's come back out now a couple packets later we have password okay so if we come down here to
password again that's going to be encoded let's right click we're going to do show packet bytes
and there's our encoded string let's actually decode it as base64 and there is our password
for authenticating to that SMTP server so that's that's not going to work with everything because
not all usernames and passwords are base64 encoded but when we're dealing with a protocol like SMTP
that's exchanging that with base64 we can use that little show packet bytes feature to be able to
decode it to base64 to ASCII right there in water shark so I hope you like this exercise taking a
look at some agent Tesla malware and I will see all of you on another video [Music] thank you