The Let’s Encrypt certificate related to the one of the IP addresses making a TLS connection. Lots of malware that I have looked at is using this certificate, so I started to worry a little.įigure 5. To gather more information on this I opened one of the “Certificate” events for the “34.234.1759” IP address to see which certificate is being used. This means that an encrypted connection is being set up. The result I got were TCP and TLSv1.2 protocol events. It wasn’t long before I got more hits, so adding more IP addresses didn’t seem necessary at the moment. I’m sure this could be a more optimized list, but you get my drift. The list I ended up looking for converted into a search filter for Wireshark.

I ended up just picking a few of them randomly, but for future research I would suggest just taking all of them to fully find all information possible. I decided to create another Wireshark filter with some of the IP addresses that were being mentioned on the Robtex result page of which some were also in the DNS results in Wireshark. So there seems to be some DNS request present and some reply being sent. Wireshark results showing DNS requests for the suspicious domain.

Download Process Monitor 3.94