2026-01-31: Traffic analysis exercise: Lumma in the room-ah!
好的，我现在需要帮助用户总结一篇文章的内容，控制在100个字以内。用户已经提供了文章的详细内容，看起来这是一个关于网络流量分析的练习，涉及Lumma Stealer恶意软件的检测和响应。 首先，我需要理解文章的主要内容。文章描述了一个安全分析师在SOC中发现一个警报，触发原因是Lumma Stealer的受害者指纹活动。警报来自IP地址153.92.1[.]49，使用TCP 80端口。分析师获取了相关的pcap文件，并根据这些数据撰写了一份事件报告，以便响应团队追踪受感染的计算机和相关用户。 接下来，我需要提取关键信息：涉及Lumma Stealer、恶意软件检测、网络流量分析、pcap文件分析、事件报告撰写以及追踪受感染设备和用户。 现在，我要将这些信息浓缩成100个字以内的总结。需要注意的是，不需要使用“文章内容总结”或“这篇文章”这样的开头，直接描述即可。 可能的结构是：描述事件（检测到恶意软件）、行动（获取pcap并分析）、目标（撰写报告以追踪设备和用户）。确保涵盖主要元素：恶意软件名称、检测过程、分析工具（pcap）、撰写报告的目的。 最后，检查字数是否在限制内，并确保语言简洁明了。 </think> 文章描述了一次针对Lumma Stealer恶意软件的网络流量分析练习。通过检测到的警报信息和pcap文件分析，识别出受感染设备的IP地址、MAC地址、主机名、用户账户名及域名等关键信息，并撰写事件报告以便追踪受感染设备和用户。 2026-1-31 05:50:0 Author: www.malware-traffic-analysis.net(查看原文) 阅读量:1 收藏

2026-01-31 - TRAFFIC ANALYSIS EXERCISE: LUMMA IN THE ROOM-AH

NOTE:

  • Zip files are password-protected.  Of note, this site has a new password scheme.  For the password, see the "about" page of this website.

ASSOCIATED FILE:

BACKGROUND

As an analyst at a Security Operations Center (SOC), you check alerts for the past week and find a signature hit for ET MALWARE Lumma Stealer Victim Fingerprinting Activity that triggered on traffic from 153.92.1[.]49 over TCP port 80. The alert triggered on 2026-01-27 at 23:05 UTC.

Using the information, you retrieve a packet capture (pcap) of the traffic from the internal IP address that triggered the alert. Based on the pcap, you write up an incident report, so the incident responders can track down the computer and associated user.

The characteristics of your environment are:

  • LAN segment range:  10.1.21[.]0/24   (10.1.21[.]0 through 10.1.21[.]255)
  • Domain:  win11office[.]com
  • AD environment name:  WIN11OFFICE
  • Active Directory (AD) domain controller:  10.1.21[.]2 - WIN-LU4L24X3UB7
  • LAN segment gateway:  10.1.21[.]1
  • LAN segment broadcast address:  10.1.21[.]255

Having found a pcap with traffic from the infected host, you are happy to begin reviewing it!


Shown above: Someone before reviewing a pcap with Lumma Stealer traffic.

YOUR TASK

For this exercise, answer the following questions for your incident report:

  • What is the IP address of the infected Windows client?
  • What is the MAC address of the infected Windows client?
  • What is the host name of the infected Windows client?
  • What is the user account name from the infected Windows client?
  • What is the full name of the user from the user account?
  • What is the domain from 153.92.1[.]49 that triggered the alert for Lumma Stealer?

ANSWERS

  • Click here for the answers.

Click here to return to the main page.


文章来源: https://www.malware-traffic-analysis.net/2026/01/31/index.html
如有侵权请联系:admin#unsafe.sh