Welcome back. In the previous session,
we have already done the ProcDOT analysis, and now in this video we are going to do the network analysis.
So the network analysis, as you know, the file is saved in FakeNet logs,
and here we see FakeNet has already shown that it is trying to download something from bravesentry.com.
So we can probably create a snapshot of this if we wanted to, and we can use a Snipping Tool for that
over here, and
create a snapshot
of FakeNet output.
All right, so now we can kill FakeNet since we already got a snapshot.
Close here and go to the FakeNet—
FakeNet logs and look for the PCAP file.
So this is a PCAP file.
We double-click, and it will automatically open in Wireshark.
And as you've seen before, Wireshark is used for analyzing PCAP files.
So Wireshark has loaded and is now initializing itself, and it is done.
So from here we can now see all the traffic that has been captured by FakeNet.
And we are now going to filter out the HTTP, because from FakeNet we saw that it is reaching out
to an HTTP server, web server.
So we filter out HTTP here, hit Enter, and now we can see here the GET request, and we can right-click
and select Follow and select TCP Stream.
And there you go.
And you can see here it is—a GET request to the server, to this server called download
bravesentry.com, and FakeNet has intercepted it and given its own reply.
HTTP
OK.
And this is the FakeNet reply.
And we can come down here and look at the entire conversation, which is all this, or we can close—
we can click on the drop-down list and select the outgoing, the incoming traffic and the outgoing traffic.
So this is outgoing traffic, and it shows that it is going out to bravesentry.com, and then you can go
down to see the incoming traffic,
which FakeNet has intercepted and replied to the malware.
All right.
So this is our network analysis, and this is clearly a sign of an indicator of compromise.
So this is how we do our analysis.
So to wrap things up, we can write a report to show all this.
So this is an example of a report in which you could write to list down the indicators of compromise.
For example, under File System, we saw that it has created a new file called xpupdate.exe and dropped
it in this location, C:\Windows.
And we also saw that this file was set to persist—to launch by creating two persistence keys in the
HKCU registry.
And it also created another registry setting for keeping track of the version,
and it also dropped a file called install.dat, and this install.dat, if you want, you can go ahead
and perform further analysis.
So I'll leave that to you.
And then on the network side, we also saw the attempt to download something from bravesentry.com.
So this is a sample analysis report for your malware sample two.
So that concludes our session on the practical for malware analysis, sample two.
Thank you for watching.