Back in the previous session, we've already done the proper analysis and now in this video, we are
going to do the network analysis.
So, you know, analysis, as you know, the Filey safety net locks.
And here we see if it's already shown that he's trying to download something from Breus Century.
So we can probably put a snapshot on this if you wanted to, and you can use it to find that here and.
This notion of it.
All right, so now we can give it to our organization.
Clues here and go to the blogs and look for the Bikfaya, so this if you get far with double click and
it will automatically open in Wireshark.
And as you are seeing before, Weishaupt used for analyzing piguet files.
So I suggest that he's not initializing himself and it is done so from here, you can now see all the
traffic that he has been captured by Fenet.
And we are now going to filter EDP because we saw that the heat is reaching out to a hasty dip, so
so so we put our EPA
into and now we can see here they get recurrence and you can regulate and select follo and select DCB
Stream.
And there you go, and you can see here it is getting a get request to the server from to this so-called
download that recently dot com and thing that has intercepted it and given its own reply.
But his TDP, OK, and this is her final reply, and we can come down here and look at the entire conversation,
which is how this all we can close.
You can click on this and select the outgoing the incoming traffic and the outgoing traffic.
So these are going traffic and he shows he's going out to race and try to come and then he can go down
to see the incoming traffic.
Which Venette has intercepted and reply to the Navy.
All right, so this is our analysis and this is clearly a sign of an indicator of compromise.
So this is how we do know analysis.
So to wrap things up, we can write a report to show all this.
So it is the example of a report in which you go right to the list on the indicators of compromise.
For example, the system.
We saw that has created a new file called XP did not see and dropped it in this location, C Windows.
And we also saw that this file was set to persist to launch by creating two persistance key in a hasty
Seiyu registry.
And he also created another registry setting for keeping track of the version and also drummer Philco
installed that and this installed on that.
If you want, you can go ahead and perform for the analysis.
So I'll leave that to you.
And then on a Navy site, we also saw attempted to download something from the previous century dot
com.
So this is a sample analysis report for have a sample, too.
So that concludes our session on the Protocol for malware analysis to thank you for watching.