Incident Response Mini Report – NetSupport RAT (PCAP Analysis)

1. Executive Summary

On 26 November 2024, internal host 10.11.26.183 was observed initiating suspicious outbound communications consistent with malware command-and-control (C2) activity.

Network analysis identified:

TCP stream inspection confirmed active command polling behavior (CMD=POLL) and structured server responses (NetSupport Gateway/1.8), validating the presence of NetSupport RAT communication.

Based on traffic patterns, protocol analysis, and IDS alert correlation, host 10.11.26.183 is assessed as compromised and actively beaconing to external command infrastructure at the time of capture.

No additional internal hosts were observed communicating with the identified infrastructure within the scope of this dataset.

Immediate containment and forensic triage are recommended.

2. Incident Overview

Date Observed: 26 November 2024
Data Source: 2024-11-26-traffic-analysis-exercise.pcap
Detection Method: Network traffic analysis with IDS alert correlation
Affected Host: 10.11.26.183
Suspected Malware: NetSupport RAT

The investigation began by pivoting on the suspected internal host to scope all related network activity.

3. Technical Analysis

3.1 Host Pivot – Traffic Overview

Initial scoping was performed using the filter:

ip.addr == 10.11.26.183

This provided a consolidated view of all DNS, TLS, and HTTP communications initiated by the host.

Host Traffic Overview

This pivot identified suspicious external communications requiring deeper inspection.

3.2 DNS Resolution

The host queried and resolved the domain:

The DNS response returned:

This was the first observable indicator of potentially malicious infrastructure.

Filter Used:

dns contains "modandcrackedapk"

DNS Resolution Screenshot

3.3 TLS Handshake & SNI Validation

TLS Client Hello packets revealed the Server Name Indication (SNI):

Although TLS payload contents are encrypted, the SNI field remains visible in plaintext and confirms that the host intentionally initiated encrypted sessions to the suspicious domain.

Filter Used:

tls.handshake.extensions_server_name contains "modandcrackedapk"

TLS SNI Screenshot

3.4 HTTP POST Beaconing to 194.180.191.64

Further inspection revealed repeated HTTP POST requests over TCP/443 to:

All requests targeted:

Filter Used:

http.request.method == "POST" && ip.addr == 194.180.191.64

C2 POST Traffic Screenshot

The repeated outbound POST requests indicate automated polling behavior consistent with command-and-control (C2) beaconing.

Notably, HTTP traffic was observed over port 443 (typically reserved for HTTPS), suggesting an attempt to blend malicious traffic with legitimate encrypted web activity.

3.5 TCP Stream Validation (Application-Layer Evidence)

Following the TCP stream between:

revealed explicit NetSupport RAT communication.

Key observations:

TCP Stream Analysis

The presence of the NetSupport-specific user-agent string and command polling parameters confirms active malware command-and-control behavior.

3.6 IPv4 Conversation Analysis

Conversation statistics were reviewed using:

Wireshark → Statistics → Conversations → IPv4

Host 10.11.26.183 showed sustained traffic volume with 194.180.191.64, significantly higher than other external communications within the capture.

IPv4 Conversations Screenshot

This reinforces the persistent C2 communication pattern observed in earlier analysis.

3.7 IDS Alert Correlation (Provided Dataset)

An IDS alert file was included with the traffic analysis dataset and used for correlation purposes.

Notable alerts included:

IDS Alert Screenshot

Manual packet inspection validated these detections by confirming:

This demonstrates alignment between signature-based detection and packet-level validation.

4. Impact Assessment

If uncontained, the infected host could allow an attacker to execute remote commands, exfiltrate data, or establish persistent access.

5. Containment & Recommendations

  1. Immediately isolate host 10.11.26.183 from the network.
  2. Block outbound communication to:
    • 193.42.38.139
    • 194.180.191.64
    • modandcrackedapk.com
  3. Perform full forensic acquisition and malware eradication.
  4. Review DNS, proxy, and firewall logs for additional systems resolving or communicating with the identified infrastructure.
  5. Reset credentials associated with the affected host.

6. Indicators of Compromise (IOCs)

Internal Host

Domain

External IP Addresses

Behavioral Indicators

Key Takeaway

This investigation demonstrates the importance of correlating DNS activity, encrypted session metadata, application-layer inspection, and IDS alerts to confidently identify command-and-control behavior.

Manual packet validation remains critical in confirming malware activity and accurately assessing organizational impact.