2026-11-10 - TRAFFIC ANALYSIS EXERCISE: THE LUCKY TURKEY

NOTE:

• Zip files are password-protected.  Of note, this site has a new password scheme.  For the password, see the "about" page of this website.

ASSOCIATED FILE:

• Zip archive of the pcap:  2026-11-10-traffic-analysis-exercise.pcap.zip   29.2 MB (29,164,065 bytes)

 

BACKGROUND

Working as an analyst at a security operations center (SOC) for a Thanksgiving-themed gambling company, you see alerts for NetSupport RAT on 93.152.209[.]36:443.  Against all odds, you weren't betting on seeing these alerts. But here we are!

You retrieve a packet capture (pcap) of traffic from the associated Windows host to review the activity and verify the alerts.

The characteristics of this environment are:

• LAN segment range:  10.11.10[.]0/24   (10.11.10[.]0 through 10.11.10[.]255)
• Domain:  theluckyturkey[.]com
• AD environment name:  THELUCKYTURKEY
• Active Directory (AD) domain controller:  10.11.10[.]10 - LUCKYTURKEY-DC
• LAN segment gateway:  10.11.10[.]1
• LAN segment broadcast address:  10.11.10[.]255

 

Shown above: That's one lucky turkey (said no one ever).  Source: Weird Christmas.

 

YOUR TASK

For this exercise, answer the following questions for your incident report:

• What is the date and start time of the NetSupport RAT traffic?
• What is the IP address of the infected Windows client?
• What is the MAC address of the infected Windows client?
• What is the host name of the infected Windows client?
• What is the user account name from the infected Windows client?

 

ANSWERS

• Click here for the answers.

 

Click here to return to the main page.