Analyzes network traffic generated by malware during sandbox execution or live incident response to identify C2 protocols, data exfiltration channels, payload downloads, and lateral movement patterns using Wireshark, Zeek, and Suricata. Activates for requests involving malware network analysis, C2 t

Analyzing Network Traffic of Malware When to Use Sandbox execution has captured a PCAP file and the network behavior needs detailed analysis Identifying the C2 protocol structure for writing network detection signatures Determining what data the malware exfiltrates and to which external infrastructure Analyzing DNS tunneling, domain generation algorithms (DGA), or fast flux behavior Creating Suricata/Snort signatures based on observed malware network patterns Do not use for host based analysis of malware behavior; use Cuckoo sandbox reports or Volatility memory analysis for process level activity. Prerequisites Wireshark 4.x installed for interactive PCAP analysis tshark (Wireshark CLI) for scripted packet extraction Zeek installed for automated metadata generation from PCAPs Suricata with ET Open/ET Pro rulesets for signature matching NetworkMiner for file extraction and credential detection from PCAPs Python 3.8+ with scapy and dpkt for programmatic packet analysis Workflow Step 1: Initial PCAP Overview Get a high level understanding of the network traffic: Step 2: Analyze DNS Activity Examine DNS queries for DGA, tunneling, or C2 domain resolution: Step 3: Analyze HTTP/HTTPS C2 Communication Examine web based command and control traffic: Step 4: Detect Beaconing Patterns Identify regular periodic communication indicating C2 beaconing: Step 5: Generate Network Detection Signatures Create Suricata/Snort rules from observed traffic patterns: Step 6: Extract Files and Artifacts from Traffic Recover transferred files and embedded data: Key Concepts Term Definition Beaconing Regular periodic connections from malware to C2 server, identifiable by consistent time intervals and packet sizes JA3/JA3S TLS fingerprinting method creating a hash from ClientHello/ServerHello parameters to uniquely identify malware TLS implementations DGA (Domain Generation Algorithm) Algorithm generating pseudo random domain names that malware queries to locate C2 servers, evading static domain blocklists DNS Tunneling Encoding data in DNS queries and responses to establish a C2 channel or exfiltrate data through DNS infrastructure Fast Flux DNS technique rapidly rotating IP addresses for a domain to avoid takedown and distribute C2 across many compromised hosts SNI (Server Name Indication) TLS extension revealing the hostname the client is connecting to; visible even in encrypted HTTPS connections Network Signature Suricata/Snort rule matching specific patterns in network traffic (headers, payloads, timing) to detect malicious communications Tools & Systems Wireshark : Open source packet analyzer for deep interactive inspection of network traffic at the protocol level Zeek : Network analysis framework generating structured metadata logs (conn, dns, http, ssl) from live or captured traffic Suricata : High performance network IDS/IPS for signature based detection with Lua scripting for custom detection logic NetworkMiner : Network forensic analysis tool for extracting files, images, and credentials from PCAP files Scapy : Python packet manipulation library for programmatic packet analysis, beacon detection, and protocol decoding Common Scenarios Scenario: Decoding a Custom Binary C2 Protocol Context : Malware communicates with its C2 server using a custom binary protocol over TCP port 8443. Standard HTTP analysis yields no results. The protocol structure needs to be reverse engineered from the PCAP. Approach : 1. Filter the PCAP for TCP port 8443 conversations and follow the TCP stream 2. Identify the message framing (length prefix, delimiter, fixed size headers) 3. Compare multiple messages to identify static header fields vs variable data fields 4. Cross reference with reverse engineering findings from Ghidra (if the binary was analyzed) 5. Write a Wireshark dissector or Scapy parser for the custom protocol 6. Create Suricata rules matching the static header bytes for network detection 7. Document the full protocol specification for threat intelligence sharing Pitfalls : Analyzing only the first few packets; some C2 protocols change behavior after initial handshake Not decrypting TLS traffic when the sandbox has MITM capabilities Confusing legitimate CDN or cloud traffic with C2 (validate destination IPs) Missing C2 traffic that uses DNS or ICMP instead of TCP/UDP Output Format

analyzing-network-traffic-of-malware