I have some weird traffic heading outbound from my network. It is being blocked by the firewall from exiting and I'm not sure what the source is. I've looked at the machine and don't see anything blatant compromise-wise.
What I've done on the machine: The box is Win7 Enterprise x64. I used Redline to capture a memory image and other data from a collector. I used the memory image and volatility to look at network connections, pstree etc. I used Redline for prefetch, URL history and other metadata.
I see no history in volatility's netscan plugin regarding any of the IP's. I'm guessing this is because the firewall blocked it from making a full connection. I checked a large sample of the destination IP's on a few IP reputation sites and they're clean.
I currently have three boxes with very similar but not identical activity. A new one pops up every week. None of them have happened twice. None of the boxes have P2P software on them.
- The traffic is UDP, mostly with a sourceport of 39156,
- Destination ports are high and vary.
- The traffic lasts different amounts of time per box..sometimes an hour and a half, other times 20 minutes.
- Destination IP's are all over the world - hundreds of them.
- Most of the packets contain 66 or 72 bytes of random characters - sometimes two, three or four of these UDP packets to each IP address...then it would move on to the next IP address...
Any ideas? Thanks!