Incident Report: PCAP Network Intrusion Analysis

A user Eric was subjected to a phishing email leading to a compromised workstation. The multi-stage intrusion began with the download of a malicious ZIP archive from an external server (attirenepal.com), followed by a burst of TLS connections to three additional external domains (finejewels.com.au, thietbiagt.com, new.americold.com) used to stage further malicious files, then check-in traffic to a first-stage command-and-control (C2) domain, and culminating in the deployment of two Cobalt Strike C2 request. These Cobalt Strike IP addresses used during this session were independently confirmed as known C2 infrastructure via VirusTotal community intelligence. This workstation represents a full macro-to-C2 compromise chain and, if left unmitigated, would have given the attacker persistent remote access to the host.

• Data source analyzed: carnage.pcap
• Tools used: Wireshark (Follow TCP Stream, Conversations, TLS/HTTP filters), VirusTotal Community
• Objective: Identify the delivery mechanism, first-stage C2 channel, and Cobalt Strike infrastructure used in the intrusion, extract IOCs, map behavior to MITRE ATT&CK.

1. Initial Access / Delivery: The victim host retrieved a ZIP archive from an external server containing a malicious document (chart-1530076591.xls).
2. First-Stage C2 Channel: Shortly after, the host began issuing regular HTTP POST requests to maldivehost.net, consistent with a shell script used for periodic C2 check-ins.
3. Cobalt Strike Deployment: Traffic pivoted to two additional external hosts, confirmed as active Cobalt Strike C2 servers (survmeter.live, securitybusinpuff.com).
4. Secondary Malicious File Downloads: The host established TLS connections to three additional external domains confirmed as involved in malicious file download activity.
5. Workstation I.P Scanning: The malware identified the compromised machine via api.ipify.org and attempted to spread spam using an SMTP connection to 185.125.204.174:8080.

The identification of live, confirmed Cobalt Strike traffic indicates that the attacker had created an active command channel to the host. Cobalt Strike is often employed for post-exploitation activities, including credential harvesting, lateral movement, and the staging of ransomware or additional payloads. The 12-minute delay between the initial execution of the document and the full Cobalt Strike suggests a swift, likely automated staging chain instead of manual hands-on-keyboard actions at this point in the capture.

1. Immediate: Immediately block all identified C2 IPs/domains at the perimeter firewall and DNS resolver.
2. Short-term: Alert on HTTP requests where the Host header does not match the IP's identity.
3. Long-term: Restrict execution of macros in Office documents originating from the internet, and sandbox all attachments containing Macro Office files before delivery to end users. Mandatory training on unsolicited document downloads from unknown sources.