0

I'm routinely going through our firewall logs, and recently I noticed that a lot of our Windows 10 clients are trying to open file shares (or otherwise connect to tcp/445) on the IP 10.10.10.1. Since this IP does not exist in our network (we use the 172.16.0.0/12 range exclusively), this struck me as odd. Unfortunately, the web isn't much help in this regard, since that IP is used for thousands of router configuration guides and examples.

The PCs doing this are spread through all departments, I couldn't determine any software common to these machines, except the usual stuff like MSOffice, Skype, Firefox.. I've gone through config files and the registry, that IP turns up nowhere.. so it's most likely hardcoded in whatever program this comes from.

As the IP does not exist, all I see are the SYNs on the firewall, I don't know yet what these connections are trying to reach.. perhaps a share name would give the solution. But this would mean setting up a honeypot or similar, which takes significant time, and so I pushed that idea back behind "ask SE" ;-)

We are using four different AV solutions on our PCs, so if it was something malicious, it would have been able to stay hidden from all of them. Also, it would have to be a rather dumb virus/worm to try spreading to IPs outside the PCs local network.

I tried running ProcExp one one of the machines that I see these connections coming from, but a day of monitoring did not turn anything up. This makes me a bit uneasy, because it would point into the "malicious" direction if it ceases the connection attempts as soon as some well-known monitoring software is running. On the other hand, it might also just be pure chance, or originating somewhere that ProcExp can't inspect (where could that be?). I'm a Unix/Network guy, my knowledge of Win10 internals is kinda limited.

Is someone else seeing this, and can probably point at a culprit?

0
  1. You should filter these requests on your firewall. Private source or destination IPs should not leak out, whether you use them or not.
  2. Check the Win PCs in question with netstat -aon - the SYNs should be visible there. If the requests are rare you can use netstat -aon 5 >netstat.log to 'monitor' the connections for a period of time. (When the log grows too large you might want to filter the output as in netstat -aon 5|find "10.10.10.1" >netstat.log.)
  3. Once a SYN shows up in netstat output you have the process IP and can check which .exe this originates from.

Malware is rather unlikely, it would more likely try to contact a (cloud) C&C server with a public IP.

Additionally, you can use `ipconfig /displaydns´ when a connection has just been attempted to show which DNS cache entry refers to 10.10.10.1.

EDIT:

Capturing the PID at the same time is more complicated. Sysinternal's procmon can log process creation ("Operation is Process Create/Start") and TCP connections ("Operation is TCP connect") - this should provide everything you need.

  • The netstat log is something that I'll be trying.. it's much less intrusive on the user than keeping procexp open. Though, this means that I will catch only processes that still exist when I'm noticing the log entry. – WooShell Mar 2 '18 at 12:55
  • @WooShell I've added a suggestion to the answer. – Zac67 Mar 2 '18 at 18:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.