Cybersecurity Project · Network Forensics

Network Forensics & Malware Traffic Analysis

Malware-traffic investigation using Wireshark, NetworkMiner, and Python to reconstruct suspicious host behaviour and command-and-control activity.

Academic / technical project

Context & Scope

This project analysed a malware-traffic PCAP in a controlled academic and technical-investigation context. It is project-based cybersecurity experience and is not presented as professional SOC or incident-response employment.

Objective

Identify the principal suspicious host, understand its network behaviour, reconstruct command-and-control activity, and document the evidence without overstating what the packet capture could prove.

Approach

Reviewed the PCAP at protocol and endpoint level to identify anomalous hosts, traffic volume, and suspicious external communication.
Used Wireshark and NetworkMiner to inspect conversations, HTTP behaviour, DNS activity, endpoints, and transferred artefacts.
Used a custom Python PCAP-analysis script to support repeatable traffic analysis and host-level investigation.
Reconstructed command-and-control behaviour including HTTP beaconing, proxy registration, backconnect infrastructure, and later encrypted communication.

Key Findings

The analysed malware capture exceeded 600 MB.
The primary suspicious host was associated with approximately 2.47 million packets and around 1.64 GB of traffic.
Observed behaviour included HTTP command-and-control activity and backconnect infrastructure.
The traffic later migrated toward encrypted TLS communication.
The evidence was consistent with potential data exfiltration, but the available capture did not support claiming confirmed exfiltration.

Technical Evidence

Selected original investigation evidence from the project. Open an image to inspect it at full size.

PCAP analysis summary showing the primary suspicious host and associated traffic statistics — Host-level PCAP analysis used to identify the primary suspicious system and quantify its network activity.

Network traffic evidence showing suspicious command-and-control configuration activity — HTTP traffic evidence supporting reconstruction of command-and-control configuration and update behaviour.

Packet capture showing later encrypted TLS communication associated with suspicious activity — Later-stage traffic showing the transition toward encrypted TLS communication during the investigation.

Evidence Boundary

The investigation identified behaviour consistent with potential data exfiltration. The available PCAP did not provide sufficient evidence to claim that successful data exfiltration was definitively confirmed.

Security Relevance

The project demonstrates packet-level investigation, traffic baselining, endpoint correlation, C2 reconstruction, evidence handling, analytical scripting, and disciplined reporting of technical findings and limitations.