← Back 25 July 2026

First PCAP Report

by C. Casquatch

This is just a test. I like analysing PCAPs but have fallen off the wagon for a while. This is the first report I hope to make of many to come. My reports are for educational purposes only. Make your own assumptions and connections and take my information with a grain of salt This is also a safe space for me to practice writing reports after I’ve analysed.

Analyst: Cyber Casquatch Date: 19 July 2026 Capture file: 2026-03-12-SmartApeSG-ClickFix-activity-for-Remcos-RAT.pcap Classification: Educational / Test (public sample, malware-traffic-analysis.net)

1. Executive Summary

During this hunt, host 10.3.12.101 was found communicating with external infrastructure consistent with a SmartApeSG ClickFix infection chain delivering Remcos RAT. Evidence includes a redirect-style HTTP exchange to 159.65.191.64, a large (~96MB) payload transfer from the same IP, and a periodic ~30-second TLS beacon to 193.178.170.155 whose JA3 fingerprint matches known Remcos C2 traffic. Confidence is Medium, primarily because the ~230-second capture window is short and ends while the beacon was still active, leaving the full extent of C2 activity unconfirmed. This is a training exercise against a public sample, not a live incident — the exercise demonstrates a detectable, well-documented C2 pattern.

2. Hypothesis & Scope

Hypothesis: Host 10.3.12.101 is beaconing to an external C2 server following a suspected ClickFix-style infection.
Data source(s) analysed: 2026-03-12-SmartApeSG-ClickFix-activity-for-Remcos-RAT.pcap
Time range covered: 07:28:19 – 07:32:12 (~233 seconds)
In scope: Beaconing behaviour and payload transfer to/from 10.3.12.101.
Out of scope: Host-based forensics (no endpoint artifacts available), full DNS/domain enumeration, any activity outside this capture window.

3. Methodology

Tools used: Wireshark (Statistics > Protocol Hierarchy, Statistics > Conversations, I/O Graph, delta-time display), beacon_finder.py (custom timing-analysis script)
Key Wireshark filters used:
- tcp.stream==31
- tcp.stream==31 && tls.handshake.type==1 (isolate Client Hello)
- tls.stream==28 && frame.len<150 (isolate small heartbeat-sized TLS records — corrected from an earlier attempt using tcp.len, which measures payload size only and doesn’t match the Length column values)
- View > Time Display Format > Seconds Since Previous Displayed Packet (for measuring beacon interval directly in the packet list)
External lookups performed:
- IP/ASN identification: 142.251.x, 142.250.x, 173.194.x, 216.239.x (Google); 157.240.24.13 (Meta); 104.18.94.41, 162.159.138.60 (Cloudflare); 52.123.128.14 (Microsoft); 13.219.197.84 (AWS) — all assessed as background/benign traffic, not investigated further
- JA3/JA4 hash lookup for a85be79f7b569f1df5e6087b69deb493 (see IOC table)
- Public reporting cross-reference: ISC diary “SmartApeSG campaign uses ClickFix page to push Remcos RAT” (isc.sans.edu/diary/32796) — describes a matching lab-generated Remcos infection dated one day before this capture
- Hornetsecurity, ANY.RUN, and CyFirma writeups on Remcos RAT attack chains, for general TTP context

4. Timeline of Events

Reconstructed by converting relative capture time to absolute time using the offset method described above (capture start ≈ 07:28:19.759 UTC).

Time (UTC)	Rel. time (s)	Event	Evidence
07:28:19.76	0.00	Capture starts	—
07:29:53.82	~94.06	`GET /boot HTTP/1.1` to `159.65.191.64:80`, followed by `301 Moved Permanently`	Stream 25, packets 1863–1868
07:29:54.95	~95.19	`GET /proc HTTP/1.1` to `159.65.191.64:80` (same shape, ~1.1s later), followed by `301 Moved Permanently`	Stream 27, packets 1986–1991
07:29:55.10	~95.34	Large TLS transfer begins from `159.65.191.64:443` — 68,116 packets / ~96MB in 5.47s, almost entirely inbound	Stream 28
07:30:00.56	~100.81	Large transfer ends	Stream 28
07:30:58.50	~158.75	TCP + TLS handshake begins to `193.178.170.155:443` (new, persistent connection)	Stream 31, packets 70198–70203
07:30:59.39–.40	~159.6	Initial C2 registration burst (larger Application Data exchange, likely capability/task check-in)	Stream 31, packets 70205–70213
07:31:00.52	~160.76	First periodic heartbeat (96B request / 115B response)	Stream 31, packets 70214–70215
07:31:12.68	~172.92	Second heartbeat (+12.16s from previous)	Packets 70222–70223
07:31:42.71	~202.95	Third heartbeat (+30.03s)	Packets 70225–70226
07:32:12.69	~232.93	Fourth heartbeat (+29.98s) — capture ends shortly after	Packets 70235–70236

Note: the beacon interval settles at ~30 seconds after an initial ~12s gap, and is still active when the capture ends — there’s no evidence the C2 channel was torn down.

5. Key Findings

5.1 Finding: ClickFix-style redirect and payload delivery via 159.65.191.64

What was observed: Two near-identical short HTTP requests (/boot, /proc) to the same IP over port 80, each returning a 301 Moved Permanently, followed ~150ms later by TLS transfers on port 443 from the same IP. The Location: header in the redirect (packet 1991, stream 27) resolves to https://forcebiturg.com/proc.
Supporting evidence: Streams 25, 27 (11 packets / 1083 bytes each, identical shape), stream 26 (112 packets, ~112KB), stream 28 (68,116 packets / ~96,080,330 bytes in 5.47s, 140Mbps peak inbound). Redirect response headers: nginx/1.18.0 (Ubuntu), Location: https://forcebiturg.com/proc.
Interpretation: The short, arbitrary-looking paths straight to an IP address (not a domain), immediate redirect, and short interval between the two requests match the publicly documented SmartApeSG ClickFix pattern (isc.sans.edu/diary/32796). Per that public write-up, https://forcebiturg.com/boot returns an HTA file and https://forcebiturg.com/proc returns a ZIP archive containing Remcos RAT (DLL side-loading) — mapping cleanly onto stream 26 (smaller, HTA-sized) and stream 28 (huge, ZIP-sized) respectively. The published ZIP size (92,273,195 bytes) is close to but not identical to the 96,080,330 bytes measured on the wire in stream 28 — the difference is consistent with TCP/TLS/HTTP framing overhead on top of the raw file, and supports (without independently proving) that stream 28 is this specific file.
Discrepancy to note: the public write-up describes these as 302 redirects; the packets in this capture (1868, 1991) show 301 Moved Permanently. This capture’s packet evidence is the authoritative source for what happened in this specific pcap — the 302 description may reflect a different day’s server config or a paraphrase in the write-up. Flagged rather than silently reconciled.
Confidence: Medium-High (redirect target confirmed directly from packet data and corroborated by file-size proximity to a published sample; payload contents not independently extracted from this pcap — see Section 6 for sourcing of the file hash).

5.2 Finding: Periodic C2 beacon to 193.178.170.155

What was observed: A single, persistent TLS connection held open for the rest of the capture, exchanging small (96–116 byte) Application Data records at a consistent ~30-second interval after an initial larger registration exchange.
Supporting evidence: Stream 31, 10.3.12.101:61698 → 193.178.170.155:443; interval measurements in Section 4.
Corroborating indicators:
- No SNI extension present in the Client Hello — atypical for legitimate HTTPS traffic to a named service, consistent with malware avoiding server-name disclosure.
- JA3 a85be79f7b569f1df5e6087b69deb493 / JA4 t13i010400_0f2cb44170f4_5c4c70b73fa0 — confirmed by analyst as associated with Remcos via public fingerprint references.
Confidence: High for “this is periodic beaconing behavior” (timing evidence is unambiguous); Medium-High for “this is specifically Remcos” pending independent confirmation of the JA3 attribution beyond a single source.

5.3 Finding: Untriaged secondary hosts (not confirmed malicious, not cleared either)

159.65.191.64:443 stream 26 (112 packets, ~112KB) — smaller separate session to the same IP, not examined in detail.
24.199.121.166:443 (192 packets, ~207KB, DigitalOcean-hosted) — single long-lived session, no repeated/identical shape found, but on unbranded hosting infrastructure similar to the confirmed-malicious host.
107.180.27.68 (six near-simultaneous streams, ~138s each) — parallel-connection shape more consistent with a CDN pattern than beaconing, but host identity/reputation not confirmed.
Why included: these don’t meet the bar for “confirmed finding” but shouldn’t be silently dropped — flagging them keeps the report honest about what was and wasn’t fully chased down.

6. Indicators of Compromise (IOCs)

Type	Value	Context	Confidence
IP	159.65.191.64	ClickFix redirect (port 80) + payload delivery (port 443)	Medium
IP	193.178.170.155	Remcos C2 beacon	High
Port	80, 443	Used by both hosts above	High
JA3	a85be79f7b569f1df5e6087b69deb493	Associated with Remcos TLS client — verify against a second independent source before citing in a final report	Medium-High
JA4	t13i010400_0f2cb44170f4_5c4c70b73fa0	Same connection as JA3 above	Medium-High
Domain	forcebiturg[.]com	Redirect target from 159.65.191.64 301 response (packet 1991, stream 27); likely staging/payload host — do not visit directly	High
Domain	None Observed (C2 Channel)	No SNI present in Client Hello on the 193.178.170.155 beacon connection	—
File hash	Not recoverable	TLS payload is encrypted; no file was carved from cleartext HTTP traffic in this capture	—
Hosting/ASN	DigitalOcean (159.65.x.x, 24.199.x.x ranges)	Infrastructure context, not an IOC itself	Info only

Note: “DigitalOcean” was moved out of the Domain field into its own row — a hosting provider/ASN isn’t a domain, and no domain was actually confirmed in this capture.

7. MITRE ATT&CK Mapping

Tactic	Technique (ID)	Evidence
Initial Access	T1204.001 – User Execution: Malicious Link	ClickFix relies on tricking the user into executing a pasted/clicked command from a fake CAPTCHA page (per public reporting on this campaign; not directly observable in network traffic alone)
Execution	T1218.005 – System Binary Proxy Execution: Mshta	Documented delivery mechanism for this campaign (per ISC diary and analyst’s own Sigma rule draft); not directly confirmed from PCAP alone since it’s a host-level artifact
Command and Control	T1071.001 – Application Layer Protocol: Web Protocols	HTTP redirect chain and HTTPS C2 channel
Command and Control	T1573 – Encrypted Channel	Beacon traffic wrapped in TLS
Command and Control	T1105 – Ingress Tool Transfer	~96MB payload transfer from 159.65.191.64
Exfiltration	Not observed in this capture	No outbound bulk transfer pattern (A→B bytes) was seen; flagged as a gap rather than assumed absent

8. Gaps & Limitations

The capture is only ~230 seconds long (not “230ms” — worth double-checking units when writing this up formally) and ends while the beacon to 193.178.170.155 was still ticking — the full lifetime and any change in behavior over time is unknown.
Only one source was found confirming the JA3-to-Remcos association; treat this as needing corroboration rather than settled fact.
Three secondary hosts (159.65.191.64 stream 26, 24.199.121.166, 107.180.27.68) were noted as suspicious-adjacent but not fully triaged.
No host-based artifacts (process trees, file hashes, registry changes) were available — this is a network-only hunt, so any technique mapped above without direct packet evidence is inferred from public reporting, not confirmed independently.

9. Recommendations

Immediate actions: N/A for this exercise (test/public sample). In a real incident: isolate the host, capture memory/disk before remediation, and confirm whether the beacon is still active.
Detection opportunities:
- JA3-based Suricata rule as a supporting signal only, paired with the HTTP-stage rule (JA3 alone is prone to false positives from shared TLS stacks).
- Sigma rule targeting the explorer.exe → mshta/powershell/forfiles execution chain.
- A generic “long-lived TLS connection with fixed-size, ~30s-interval Application Data records and no SNI” heuristic would be a durable detection independent of this specific campaign’s infrastructure.
Follow-up hunting suggested:
- Triage the three untriaged secondary hosts.
- If a longer capture is available, confirm the beacon interval holds (or drifts/jitters) over a longer window.

10. Conclusion

The evidence supports the hypothesis: 10.3.12.101 shows a clear, periodic C2 beacon to 193.178.170.155 on a ~30-second interval, corroborated by a JA3/JA4 fingerprint associated with Remcos RAT, alongside a preceding redirect-and-payload-delivery sequence via 159.65.191.64 consistent with the known SmartApeSG ClickFix infection chain. Confidence is Medium-High overall, limited mainly by the short capture window and single-source JA3 attribution rather than any weakness in the timing evidence itself.

tags: PCAP - wireshark