I'm trying to get a particular piece of malware to beacon, and I have my box connected to remnux, with inetsim and fakedns running. Using this setup I have been able to acquire good pcap from most samples, but this one is a bit vexing.
I can see that my sample is reaching out over TCP to the correct C2 server, but ICMP returns "destination unreachable (network unreachable)". I went ahead and used route/iptables as described in this post: https://techanarchy.net/blog/installing-and-configuring-inetsim but now I'm finding it difficult to find the traffic since it's all to my IP in wireshark, and it seems to be ssl encrypted.
Where do I go from here?