October 31, 2026
HawkEye Lab Walkthrough: Network Forensics and Data Exfiltration Analysis
A 24-question investigation using Wireshark and CyberChef | CyberDefenders Blue Team Lab
By Abd el rhman
4 min read
Network forensics is a core skill for Blue Team analysts and SOC teams. By examining captured traffic, you can identify suspicious communications, trace malware activity, and recover the indicators of compromise needed to reconstruct an incident.
In this walkthrough, I solve the HawkEye lab on CyberDefenders, a medium-difficulty challenge built around a suspected keylogger infection and data exfiltration.
The scenario: an accountant receives an email containing an invoice-related download link. Shortly afterward, suspicious network activity appears. The goal is to identify the affected machine, analyze its DNS and HTTP traffic, examine the SMTP communications, and recover evidence of the stolen information.
The only evidence file is stealer.pcap, and the investigation follows a simple flow: start with the capture's basic properties, narrow down to the suspicious host, then follow it through DNS, HTTP, and finally SMTP.
Tools Used
- Wireshark — packet analysis, display filters, Follow TCP Stream, Export Objects
- CyberChef — Base64 decoding
- VirusTotal — checking the file hash
- IP geolocation and OUI lookup sites — country and NIC vendor lookups
- md5sum / certutil — hashing the extracted file
Q1 — Number of packets
Answer: 4003 Open the PCAP in Wireshark and read the packet count in the status bar, or use Statistics → Capture File Properties
Q2 — First packet time (UTC)
Answer: 2019–04–10 20:37 Set View → Time Display Format → UTC Date and Time of Day and read the first packet. Q3 — Capture duration
Answer: 01:03:41 Shown in Statistics → Capture File Properties. Q4 — Most active computer at link level
Answer: 00:08:02:1c:47:ae Statistics → Conversations → Ethernet, sorted by packets. Q5 — NIC manufacturer
Answer: Hewlett-Packard Wireshark's MAC vendor resolution, or an OUI lookup site. Q6 — Manufacturer headquarters
Answer: Palo Alto Public lookup of the vendor from Q5. Q7 — Computers in the organization (/24)
Answer: 3 Statistics → Conversations → IPv4. Count only the internal hosts in the private subnet. Q8 — Most active computer name
Answer: BEIJING-5CD1-PC The most active internal IP is 10.4.10.132 . Filter its DHCP traffic and read Option (12) Host Name. dhcp && ip.src == 10.4.10.132 Q9 — DNS server IP
Answer: 10.4.10.4 Check the destination of the victim's DNS queries. ip.src == 10.4.10.132 && dns && dns.flags.response == 0 Q10 — Domain queried in packet 204
Answer: proforma-invoices.com Go to packet 204 and expand the DNS section. frame.number == 204 Q11 — IP of the domain
Answer: 217.182.138.150 Open the DNS response (packet 206) and read the A record. Q12 — Country of that IP
Answer: France IP geolocation lookup. Q13 — Victim operating system
Answer: Windows NT 6.1 Read the User-Agent header of the victim's GET requests (Windows 7). ip.src == 10.4.10.132 && http.request.method == "GET" Q14 — Malicious file
Answer: tkraw_Protected99.exe Found in the GET request URI, and listed in File → Export Objects → HTTP. Q15 — MD5 of the file
Answer: 71826ba081e303866ce2a2534491a2f7 Export the file from Wireshark, then hash it with md5sum tkraw_Protected99.exe (Linux) or certutil -hashfile tkraw_Protected99.exe MD5 (Windows). Q16 — Web server software
Answer: LiteSpeed Read the Server header in the responses from the malware host. http && ip.src == 217.182.138.150 Q17 — Victim's public IP
Answer: 173.66.146.112 Find the request to bot.whatismyipaddress.com , then Follow → TCP Stream and read the response. Q18 — Country of the email server
Answer: United States The SMTP destination is 23.229.162.69 , geolocated to the US. ip.src == 10.4.10.132 && smtp Q19 — Email server software
Answer: Exim 4.91 Follow → TCP Stream on the SMTP traffic and read the server banner. Q20 — Account receiving the stolen data
Answer: sales.del@macwinlogistics.in Found in the RCPT TO command of the same stream. Q21 — Password used by the malware
Answer: Sales@23 The SMTP AUTH exchange contains the Base64 string U2FsZXNAMjM= . Decode it in CyberChef with From Base64. Q22 — Malware variant
Answer: Reborn v9 The email body is Base64-encoded. Decode it in CyberChef (From Base64) and read the report header. Q23 — Bank of America credentials
Answer: roman.mcguire:P@ssw0rd$ Found in the same decoded email body, under the Bank of America entry. Q24 — Exfiltration interval
Answer: 10 minutes Compare the timestamps of the victim's successive SMTP sessions. ip.src == 10.4.10.132 && smtp