You can also use whois in terminal as follows: whois url.org PCAP Analysis: Option 3ĭomains and endpoints that the device connected to can be also checked using the ‘Feeds’ field of Wireshark. In order to find who the IP belongs to, you should check WHOIS records using a tool like who.is or ICANN Lookup. An IP that does not belong to a mainstream social media or service provider and that generates a considerable amount of traffic should be investigated using the resources in Article #140: Online Tools to Check a Websites’ Reputation. You can sort the endpoints by the volume of traffic. On the Menu Bar: Statistics > Conversations > IP4(in rare cases IP6) This will show the different endpoints in the captured traffic and the stats of exchanged traffic without needing to read the capture line by line: Check for a direct IP address connection by following the instructions below and listing the IPs implicated. This is also usually considered a malicious sign. Some malware connects directly to an IP without address resolution. Or, you may suspect a domain may be newly registered, which could be an indicator that it was created to carry out a new attack. You may notice a domain is unusual if it was implicated in a previous incident or used to distribute previous malware and recorded in a MISP event, or if it is detected by VirusTotal. On the Menu Bar: Statistics > Resolved AddressesĬheck any domain that seems unusual using the resources in Article #140: Online Tools to Check a Websites’ Reputation. Investigate this using the instructions below and note the domains and the resolved IPs. Most of the time one or more name resolutions take place. PCAP Analysis: Option 1įollowing its executions, a malware usually attempts to connect to its command and control (C2) server. Please escalate the case if you run into any issues when following these steps, or if none of these reveal any results. These steps can be performed in any order. In our analysis of the PCAP file, we will try three analysis techniques to find any indicators of malicious activity. To load a PCAP file in Wireshark, open Wireshark and in the menu bar, click ‘File’, then click ‘Open’ and navigate to the file’s location, then click ‘Open.’ It will also change the time display to a readable version. This configuration will make the requested domains and connected hosts clearer to you. In order to make the analysis easier, make sure Wireshark is configured following this tutorial. Other options can be found in Article #282: Recommendations on Secure File Sharing and File Storage. If not we can use a peer-to-peer file sharing channel such as Onionshare.
#HOW TO ANALYZE WIRESHARK PCAP HOW TO#
For more help, you can follow this guide on how to verify the hash. This step is needed in order to verify the integrity of the file. Then when the PCAP file is received, check that the hash is the same. Record the hash of the PCAP file on the beneficiary machine that was used to capture the traffic.Follow this guide to capture a phone’s traffic.Follow this guide on using tcpdump in command line if Wireshark is not an option.Follow this guide for analysis on laptops.Capture the traffic for at least 2 hours and ideally for 24 hours as malware beacons can be done once daily. Assist the beneficiary in creating and exporting a PCAP file capturing the traffic of the device that shows suspicious behavior.
#HOW TO ANALYZE WIRESHARK PCAP WINDOWS#
Host-based investigation ( Article #367: Live Forensics for Windows and Article #368: Live Forensics for Linux) has led to no result or it is not an option. ProblemĪ system is behaving strangely and you need to conduct a network perimeter analysis to check if it is compromised. Edit me PCAP File Analysis with Wireshark to investigate Malware infection How to analyze a PCAP file using Wireshark.
0 kommentar(er)
