0

So I've already disabled SSDP Discovery in Windows Services.

I'm also not conducting any searches. I also have file indexing disabled on my system.

I noticed a number of outbound connections coming from explorer.exe, felt there was no reason for that, so I blocked all outbound connections using Comodo firewall.

Now, after a couple of hours, I did a quick check on Comodo's log and was surprised to see the effects of that block:

  1. ~10 attempted outbound connections are getting blocked every hour.
  2. These attempts happen in "blocks" (3-4 at a time)
  3. The attempts happen like clockwork in intervals divisible by 5 (x:46, x:16, x:31, x:46, x:51)
  4. EVERY outbound connection is to a unique remote IP address.
  5. EVERY outbound connection was through a unique source port on my system.
  6. The destination port for every attempt was port 80 (with one exception that was to port 443)

So maybe I'm paranoid, but this seems very, very suspicious.

I've done scans with Windows Defender+, Spybot S&D, and ClamAV and all returned a clean system.

That said, what I don't understand, can definitely hurt me.

Any thoughts on what's trying to start this connection?

Thanks.

  • I would scan your system with HitmanPro's early detection scan and see what comes up. – Marc Woodyard Mar 15 '15 at 21:36
  • #5 is probably meaningless; outgoing TCP connections nearly always use a "transient" source port, which is usually a counter running through a large range like 32768 to 65535 (on Windows exact range depends on version and patches and perhaps registry). SSDP is local only not internet and UDP not TCP. Do the dest addresses, or a sample of them, reverse-resolve (most easily with nslookup) to anything reasonable? – dave_thompson_085 Mar 16 '15 at 12:10
  • There are chances somekind of software, possibly malware was injected into your explorer.exe and it is communicating using the Internet. – ChrisK Nov 7 '17 at 20:59
1

It is not normal for explorer.exe to reach out to the web. You should lookup the ips and see who owns them , what country they are located in, etc on arin.net for example

If they are not owned by Microsoft then start digging more using Virus Total, Alien Vault, etc to see if the ips are known command and control for any particular malware

Lots of malware will inject into and take over explorer.exe because if it's long running persistence (it stays running until the pc shuts off ). Attackers with a reverse shell using something like metasploit meterpreter will also migrate into the explorer.exe process for the same reason.

If your good at network forensics you could also sniff with wireshark and review to the capture to see if you can tell what data it's sending or if it matches any patterns or known malware families.

But otherwise the information you've provided is unfortunately too vague and matches many malware families and so it can prove to be difficult to determine what it is.

If it's illegitimate traffic and it's coming from explorer.exe it's probably time for a re-image and rebuilding that pc

-1

run a netstat -a -b -n on the local machine and analyse the report for the IPs and corresponding process Ids

  • 1
    This answer lacks reasoning and should rather be a comment. – Tobi Nary Nov 7 '17 at 16:54
-1

You need to identify the C2 (Command and Control) server and find out what kind of malware it is. To do that, disable the Comodo firewall block, and open a admin powershell session and type

netstat -anb

After that you should see the C2 server that explorer.exe is trying to contact. A lot of the time you can tell what malware it is by just examining the traffic with Wireshark or something.

After you have determined the malware and C2, you can launch a counterattack. You can report abuse, but many C2 servers are hosted on "bulletproof" hosts, so you may have to take matters into your own hands. Many botnets contain vulnerabilities that can be exploited to gain control of the C2 server.

  • I don't think that launching a DoS is a good advice... Not even if it really is a C2 – Mr. E Nov 7 '17 at 17:17
  • There is a lot wrong here. Besides advising people to launch DDoS attacks (the types of which harm innocent parties), you also suggest that it is possible to determine the C2 server from a collection of unique IPs. You also gloss over the whole malware forensics portion that even experts struggle with. – schroeder Nov 7 '17 at 20:28
  • I would also suggest that taking over a C2 server means that you are liable for whatever that C2 server does after that point. This step is not to be taken lightly or blindly. – schroeder Nov 7 '17 at 20:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.