2

I have some weird traffic heading outbound from my network. It is being blocked by the firewall from exiting and I'm not sure what the source is. I've looked at the machine and don't see anything blatant compromise-wise.

What I've done on the machine: The box is Win7 Enterprise x64. I used Redline to capture a memory image and other data from a collector. I used the memory image and volatility to look at network connections, pstree etc. I used Redline for prefetch, URL history and other metadata.

I see no history in volatility's netscan plugin regarding any of the IP's. I'm guessing this is because the firewall blocked it from making a full connection. I checked a large sample of the destination IP's on a few IP reputation sites and they're clean.

I currently have three boxes with very similar but not identical activity. A new one pops up every week. None of them have happened twice. None of the boxes have P2P software on them.

  • The traffic is UDP, mostly with a sourceport of 39156,
  • Destination ports are high and vary.
  • The traffic lasts different amounts of time per box..sometimes an hour and a half, other times 20 minutes.
  • Destination IP's are all over the world - hundreds of them.
  • Most of the packets contain 66 or 72 bytes of random characters - sometimes two, three or four of these UDP packets to each IP address...then it would move on to the next IP address...

Firewall DeniesPCAPPCAP details

Any ideas? Thanks!

  • Are you expecting the ESP? Or is that part of the odd traffic? – RoraΖ Aug 12 '14 at 14:14
  • many of the IP's in the firewall list are of Amazon AWS instances. If you browse to some of them you just get a 1x1 pixel gif image – aviv Aug 12 '14 at 14:33
  • Netmon should be able to tell you which process sent the packet if you run it on the box in question. – James Snell Aug 12 '14 at 14:58
4

Run the following command on the box to find the PID of any UDP traffic on the machine.

> netstat -a -p udp -o

You can use findstr to filter the results by looking for specific port numbers (remember, it appears to be shifting, so play with your filter)

> netstat -a -p udp -o | findstr 51400

Once you have the PID, use taskman to find the executable. Once you have it running and you're on the Processes tab, click "Show processes from all users" and then select View -> Select Columns... and make sure Image Path Name and Command Line are checked.

Once you have identified the program, you can do some malware analysis on it with Cuckoo.

  • sometimes the PID is 0(zero) in netstat results. how can we proceed from here ? – Adib N Sep 7 '17 at 20:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.