THREAT ANALYSIS EXERCISE
CYB102 — GROUP CAPSTONE
MALWARE TRAFFIC ANALYSIS DATASET // PCAP INVESTIGATION
YOU DIRTY RAT.
Incident Analysis · STRRAT Remote Access Trojan Dataset: 2024-07-30 · malware-traffic-analysis.net
Binary Bandits
// SESSION ACTIVE
BRIEFING OUTLINE
Investigation Roadmap
01
Dataset & Playbook
PCAP · GuardSight Battle Cards
02
Asset Identification
Compromised host · Patient zero
03
Threat Intelligence
STRRAT · C2 beaconing · VirusTotal
04
Impact & Triage
Scope · Severity · Lateral movement
05
Monitoring & Case Mgmt
Wireshark · Splunk · Catalyst
06
Remediation
Eradication · Hardening · MFA
YOU DIRTY RAT! // CYB102
SECTION 01
Dataset & Playbook
THE DATASET
Malware Traffic Analysis Dataset
malware-traffic-analysis.net — Authored by: Brad Duncan
PCAP format — raw network traffic capture
Targets Windows environments
Contains a live malware infection sequence
Exercise date: 2024-07-30
THE PLAYBOOK
GuardSight Playbook Battle Cards
github.com/guardsight/gsvsoc_cirt-playbook-battle-cards
Written by GuardSight — cyber operations provider
Audience: CSIRT & SOC analysts
Quick-reference guide, not step-by-step manual
Adapted to PCAP-only / network-centric phases
TOOLS DEPLOYED
Wireshark
Splunk
VirusTotal
NetworkMiner
Catalyst
YOU DIRTY RAT! // CYB102
PRE-ANALYSIS
Initial Hypotheses
HYPOTHESIS 01 — INITIAL INFECTION VECTOR
We expect to find the initial infection vector, such as an HTTP GET request which downloads the malicious payload.
HYPOTHESIS 02 — C2 BEACONING
We expect to see Command & Control beaconing traffic from the compromised host to an external IP address or domain.
HYPOTHESIS 03 — LATERAL MOVEMENT
We expect indications of the RAT attempting lateral movement to infect connected devices, potentially through port usage or unencrypted data exfiltration.
YOU DIRTY RAT! // CYB102
02
SECTION 02
Asset Identification
Defining the victim machine · Mapping the breach
IDENTIFIED ASSETS
Compromised Host Profile
network_recon.log
HOST DESKTOP-SKBR25F
INTERNAL_IP 172.16.1.66
OS Windows 10 x64
USER coiler
DOMAIN wiresharkshop.online
C2_SERVER 141.98.10.79
C2_LOCATION Lithuania — UAB Host Baltic
STATUS COMPROMISED
SCOPE ASSESSMENT
Single workstation compromised
No SMB or RDP lateral movement detected
Infection isolated to 172.16.1.66
PATIENT ZERO EVENT
Malicious payload delivered via phishing email
HTTP GET request initiated the infection
Post-infection: geolocation request to ip-api.com
YOU DIRTY RAT! // CYB102
INITIAL ACCESS
Attack Chain Reconstruction
STEP 01
Phishing Email
Delivery vector
→
STEP 02
HTTP GET Request
Payload download
→
STEP 03
STRRAT Executes
Java-based RAT
→
STEP 04
Geolocation Probe
ip-api.com beacon
→
STEP 05
C2 Established
141.98.10.79 / TCP
→
STEP 06
Keylog + Creds
%AppData%\strlogs
✓ No lateral movement observed — infection contained to single workstation
YOU DIRTY RAT! // CYB102
03
SECTION 03
Threat Intelligence
STRRAT profile · C2 analysis · IOC enrichment
MALWARE FAMILY
STRRAT — Remote Access Trojan
HIGH SEVERITY
JAVA-BASED
CREDENTIAL STEALER
CAPABILITIES
Keylogging
Browser credential theft
Email credential theft
Remote shell access
Ransomware module drop
PERSISTENCE
Registry Run Keys
Startup Folder shortcuts
Logs stored in %AppData%\strlogs
Survives user logoff
IOCS OBSERVED
C2 IP: 141.98.10.79
Geolocation probe: ip-api.com
Cleartext C2 via TCP
Java runtime dependency
Confirmed by VirusTotal: 2/94 flagged
YOU DIRTY RAT! // CYB102
COMMAND & CONTROL
Beaconing & C2 Infrastructure
c2_traffic_extract.log
// TCP Stream Analysis — Wireshark
SRC 172.16.1.66:49823
DST 141.98.10.79:1122
PROTOCOL TCP (UNENCRYPTED)
PAYLOAD STRRAT beacon detected
// Threat Intel Enrichment
ASN UAB Host Baltic
COUNTRY Lithuania 🇱🇹
VT_SCORE 2/94 vendors flagged
SURICATA ALERT — STRRAT confirmed
INTELLIGENCE SOURCES CONSULTED
VirusTotal
2 / 94 vendors flagged C2 IP
Suricata IDS
Alert confirmed STRRAT signature
TCP Stream
Cleartext malware family string extracted
MITRE ATT&CK
Historical TTPs consulted for STRRAT
GuardSight
Playbook Battle Card applied
KEY FINDING
Cleartext TCP beaconing identified malware family as STRRAT — confirmed via VirusTotal and Suricata IDS.
YOU DIRTY RAT! // CYB102
MITRE ATT&CK FRAMEWORK
TTP Mapping — STRRAT
INITIAL ACCESS
Phishing
T1566
EXECUTION
User Execution
T1204
PERSISTENCE
Registry Run Keys
T1547.001
CREDENTIAL ACCESS
Credential Dumping
T1003
COLLECTION
Input Capture / Keylogging
T1056.001
COMMAND & CONTROL
Encrypted / Cleartext C2
T1071
YOU DIRTY RAT! // CYB102
04
SECTION 04
Impact & Triage
Scope · Severity · Lateral movement
IMPACT ANALYSIS & TRIAGE
Severity Assessment
SEVERITY: HIGH
CONFIRMED IMPACT
Credential theft: browsers & email clients
Active keylogging during session
Encrypted C2 session active via TCP
Logs persisted in %AppData%\strlogs
Attacker has full remote access capability
CONTAINMENT CONFIRMED
No SMB lateral movement detected
No RDP sessions to other hosts
Single workstation: 172.16.1.66
TIMELINE OF EVENTS
T+0:00
Phishing email delivered → payload HTTP GET
T+0:xx
STRRAT executes — geolocation probe to ip-api.com
T+0:xx
C2 connection established — 141.98.10.79
ONGOING
Active keylogging · credential exfiltration
YOU DIRTY RAT! // CYB102
05
SECTION 05
Case Management System
Wireshark · Splunk · Catalyst
SECTION 05 — MONITORING
Detection & Visibility Sources
Wireshark
Deep Packet Inspection
TCP stream analysis for C2 payload
HTTP GET request capture (patient zero)
Geolocation beacon identified
SMB/RDP traffic reviewed — clear
Splunk
Log Aggregation & Alerting
Aggregates logs across monitoring tools
Triggers alerts based on GuardSight Battle Card criteria
Correlates events across timeline
Snort / Suricata
Signature-Based IDS
Flags STRRAT-specific signatures in PCAP
Confirmed C2 beacon pattern
Would provide real-time alerting in production
YOU DIRTY RAT! // CYB102
YOU DIRTY RAT! // CYB102
CASE MANAGEMENT
Catalyst — Incident Tracking
INCIDENT TICKET — STRRAT INFECTION
Severity
HIGH
Affected Host
172.16.1.66 (DESKTOP-SKBR25F)
User Account
coiler
Malware Family
STRRAT (Java RAT)
C2 Server
141.98.10.79
Status
Active Investigation
CATALYST CAPABILITIES USED
Incident ticket created with severity assignment
Evidence attached from Wireshark / PCAP
Observables logged: infected host IP, C2 IP, user account
Investigation timeline maintained
Containment actions documented
Accountability chain preserved from detection → resolution
// Case management converts raw PCAP findings // into structured, actionable security cases // with full audit trail.
YOU DIRTY RAT! // CYB102
06
SECTION 06
Remediation Response
GuardSight Battle Cards · Tactical eradication · Strategic hardening
TACTICAL ERADICATION
Immediate Response Steps
GUARDSIGHT PLAYBOOK
SHORT-TERM CONTAINMENT
Firewall block: outbound to 141.98.10.79
Network isolate host 172.16.1.66
Disable user account coiler
Block Java egress at perimeter
ERADICATION
Remove %AppData%\strlogs directory
Delete malicious JAR / STRRAT payload
Remove Registry Run Keys (GuardSight Persistence card)
Remove Startup Folder shortcuts
Reimage workstation DESKTOP-SKBR25F
guardsight_battle_card.sh
// CONTAINMENT
firewall --block-outbound 141.98.10.79
net isolate 172.16.1.66
// ERADICATION
rm -rf %AppData%\strlogs\
reg delete HKCU\...\Run /v STRRAT
del %APPDATA%\Microsoft\Windows\
Start Menu\Programs\Startup\*.lnk
// RECOVERY
reimage DESKTOP-SKBR25F
restore --from-clean-backup
YOU DIRTY RAT! // CYB102
STRATEGIC REMEDIATION
Long-Term Hardening Measures
Java Restriction
Software Restriction Policy
Block Java execution in user-writable paths
Deny Java from %Temp% and %Downloads%
Prevents entire class of Java-based RATs
Enforce MFA
Multi-Factor Authentication
STRRAT's primary impact is credential theft
MFA neutralizes stolen credential value
Enforce across email, VPN, and internal apps
Detection Rules
Ongoing Monitoring
Create Suricata / Snort rules for STRRAT C2 pattern
Alert on ip-api.com geolocation probes
Monitor %AppData%\strlogs creation events
Splunk SIEM correlation rules deployed
YOU DIRTY RAT! // CYB102
INVESTIGATION SUMMARY
Key Findings
HYPOTHESES VALIDATED
H1 — Infection Vector
✓ HTTP GET / phishing confirmed
H2 — C2 Beaconing
✓ 141.98.10.79 / TCP confirmed
H3 — Lateral Movement
✗ Not observed — isolated
THREAT CONFIRMED
STRRAT
Java-based RAT with credential stealing & keylogging. Single workstation compromised. High severity — MFA would have blunted primary impact.
CONCLUSIONS
All 5 key aspects of incident response demonstrated
GuardSight playbook successfully adapted for PCAP-only analysis
Infection scope: single workstation only
Credential exposure remains the highest risk post-compromise
Java execution policy + MFA are highest-value mitigations
// FINAL STATUS
Infection contained to one host · C2 identified and blockable · Eradication path clear via GuardSight playbook
YOU DIRTY RAT! // CYB102