Under Attack? Contact Us Start a Free Demo

Trickbot Malware Analysis

Introduction

TrickBot is an advanced banking Trojan that was first identified in 2016. Malicious threat actors spread this trojan primarily by spearphishing campaigns using tailored emails that contain malicious attachments or links, which - if enabled – execute the underlying malware. As per the joint advisory released by The Cybersecurity and Infrastructure Security Agency (CISA) and The Federal Bureau of Investigation (FBI), “TrickBot - first identified in 2016 - is a Trojan developed and operated by a sophisticated group of cybercrime actors. Originally designed as a banking Trojan to steal financial data, TrickBot has evolved into a highly modular, multi-stage malware that provides its operators a full suite of tools to conduct various illegal cyber activities.” In 2021, CISA and FBI observed continued targeting through spearphishing campaigns using TrickBot malware in North America. A sophisticated group of cybercrime actors luring victims via phishing emails with a traffic infringement phishing scheme to download TrickBot.

Evolution of Trickbot

Trickbot is computer malware, a trojan for the Microsoft Windows and other operating systems that was first reported in October 2016. Since its origin, Trickbot has been in the headlines for performing and contributing to the most notorious cyber attacks across globe.

  • 2016 – Origin of Trickbot
  • 2017 – WannaCry
  • 2018 – Trickbot continued exploiting SMB vulnerability and overtook emotet
  • 2019 – Enhanced capabilities like webinject and attempted to exploit the US-based mobile carriers, Sprint, Verizon Wireless, and T-Mobile
  • 2020 – Trickbot used to distribute Ryuk
  • 2021 – Trickbot used to distribute Conti ransomware

Technical Analysis

Document Analysis using ThreatResponder FORENSICS

NetSecurity has captured a suspicious executable file during one of its investigations. Following are the details of the captured executable file:

Name

Sample2.exe

SHA256

236f4e149402cba69141e6055a113a68f2bd86539365210afb9861f4e2d3ad5f

Type

WIN32 EXE

Figure 1: Suspicious Windows executable file

NetSecurity’s ThreatResponder FORENSICS is a versatile tool for understanding the file attributes in detail. Upon importing the suspicious file in the ThreatResponder FORENSICS tool, we identified several critical findings regarding the executable file.

The ThreatResponder FORENSICS machine learning engine detected the suspicious executable file as malicious.

Figure 2: ThreatResponder FORENSICS’ ML based detection

Upon analyzing further, we captured the randomly encrypted strings, indicating the obfuscation performed by the attackers to hide the actual code.

Figure 3: Obfuscated strings

In addition, we have also identified several strings like SizeofResource, VirtualFree, HeapAlloc, GetCurrentProcess, CreateProcessW, LoadResourceW, etc., which indicate some suspicious behavior.

Figure 4: Malicious strings

In addition, upon analyzing the SHA256 in VirusTotal, we found that the suspicious file is indeed malicious and belongs to the TrickBot malware family.

Figure 5: VirusTotal Intelligence

Behavior Analysis using ThreatResponder EDR

When the malicious .exe file is detonated in an isolated machine, the ThreatResponder EDR agent immediately detects the new threat and alerts the user through the Windows notification, as shown below.

Figure 6: Windows Notification

The malicious execution alert has been recorded in the EDR console. The alert in ThreatResponder provided a detailed understanding of the chain of events related to the malicious execution.

As you can see in the below screenshot, the alert was triggered with the name sample2.exe (suspicious executable).

Figure 7: Alert in the ThreatResponder EDR console

Upon analyzing further, it is understood that the malicious executable is spawning svchost.exe and other malicious sample2.exe, as shown in the below figure. In addition, ThreatResponder also provides the details of each process and the executed corresponding commands.

Figure 8: Chain of events
Figure 9: Chain of events – explorer.exe
Figure 10: Chain of events – sample2.exe
Figure 11: Chain of events – svchost.exe
Figure 12: Chain of events – sample2.exe
Figure 13: Chain of events – VirusTotal Intelligence

ThreatResponder EDR also enriches the alert by incorporating the Virus Total information regarding the identified threat, which helps analysts get deeper insights into the threat.

Figure 14: VirusTotal Intelligence

ThreatResponder EDR also provides a detailed timeline of the events that triggered the alert. We can understand that the malicious executable has invoked other applications like 72g.exe, chrome.exe, etc., and performing some other activities that include file modification and registry key creation.

Figure 15: Timeline of events – Child processes
Figure 16: Timeline of events – Files
Figure 17: Timeline of events – Registries

Mitre ATT&CK Mapping – TrickBot Malware

Figure 18: Techniques used by TrickBot according to MITRE ATT&CK

Initial Access [TA0001]

Technique Title

ID

Use

Phishing: Spearphishing Attachment

T1566.001

TrickBot has used an email with an Excel sheet containing a malicious macro to deploy the malware.

Phishing: Spearphishing Link

T1566.002

TrickBot has been delivered via malicious links in phishing emails.

Execution [TA0002]

Technique Title

ID

Use

Scheduled Task/Job: Scheduled Task

T1053.005

TrickBot creates a scheduled task on the system that provides persistence.

Command and Scripting Interpreter: Windows Command Shell

T1059.003

TrickBot has used macros in Excel documents to download and deploy the malware on the user’s machine.

Command and Scripting Interpreter: JavaScript/JScript

T1059.007

TrickBot victims unknowingly download a malicious JavaScript file that, when opened, automatically communicates with the malicious actor’s C2 server to download TrickBot to the victim’s system.

Native API

T1106

TrickBot uses the Windows Application Programming Interface (API) call, CreateProcessW(), to manage execution flow.

User Execution: Malicious Link

T1204.001

TrickBot has sent spearphishing emails in an attempt to lure users to click on a malicious link.

User Execution: Malicious File

T1204.002

TrickBot has attempted to get users to launch malicious documents to deliver its payload.

Persistence [TA0003]

Technique Title

ID

Use

Scheduled Task/Job: Scheduled Task

T1053.005

TrickBot creates a scheduled task on the system that provides persistence.

Create or Modify System Process: Windows Service

T1543.003

TrickBot establishes persistence by creating an autostart service that allows it to run whenever the machine boots.

Privilege Escalation [TA0004]

Technique Title

ID

Use

Scheduled Task/Job: Scheduled Task

T1053.005

TrickBot creates a scheduled task on the system that provides persistence.

Process Injection: Process Hollowing

T1055.012

TrickBot injects into the svchost.exe process.

Create or Modify System Process: Windows Service

T1543.003

TrickBot establishes persistence by creating an autostart service that allows it to run whenever the machine boots.

Defense Evasion [TA0005]

Technique Title

ID

Use

Obfuscated Files or Information

T1027

TrickBot uses non-descriptive names to hide functionality and uses an AES CBC (256 bits) encryption algorithm for its loader and configuration files.

Obfuscated Files or Information: Software Packing

T1027.002

TrickBot leverages a custom packer to obfuscate its functionality.

Masquerading

T1036

The TrickBot downloader has used an icon to appear as a Microsoft Word document.

Process Injection: Process Hollowing

T1055.012

TrickBot injects into the svchost.exe process.

Modify Registry

T1112

TrickBot can modify registry entries.

Deobfuscate/Decode Files or Information

T1140

TrickBot decodes the configuration data and modules.

Subvert Trust Controls: Code Signing

T1553.002

TrickBot has come with a signed downloader component.

Impair Defenses: Disable or Modify Tools

T1562.001

TrickBot can disable Windows Defender.

Credential Access [TA0006]

Technique Title

ID

Use

Input Capture: Credential API Hooking

T1056.004

TrickBot has the ability to capture Remote Desktop Protocol credentials by capturing the CredEnumerateA API.

Unsecured Credentials: Credentials in Files

T1552.001

TrickBot can obtain passwords stored in files from several applications such as Outlook, Filezilla, OpenSSH, OpenVPN and WinSCP. Additionally, it searches for the .vnc.lnk affix to steal VNC credentials.

Unsecured Credentials: Credentials in Registry

T1552.002

TrickBot has retrieved PuTTY credentials by querying the Software\SimonTatham\Putty\Sessions registry key.

Credentials from Password Stores

T1555

TrickBot can steal passwords from the KeePass open-source password manager.

Credentials from Password Stores: Credentials from Web Browsers

T1555.003

TrickBot can obtain passwords stored in files from web browsers such as Chrome, Firefox, Internet Explorer, and Microsoft Edge, sometimes using esentutl.

Discovery [TA0007]

Technique Tactic

ID

Use

System Service Discovery

T1007

TrickBot collects a list of install programs and services on the system’s machine.

System Network Configuration Discovery

T1016

TrickBot obtains the IP address, location, and other relevant network information from the victim’s machine.

Remote System Discovery

T1018

TrickBot can enumerate computers and network devices.

System Owner/User Discovery

T1033

TrickBot can identify the user and groups the user belongs to on a compromised host.

Permission Groups Discovery

T1069

TrickBot can identify the groups the user on a compromised host belongs to.

System Information Discovery

T1082

TrickBot gathers the OS version, machine name, CPU type, amount of RAM available from the victim’s machine.

File and Directory Discovery

T1083

TrickBot searches the system for all of the following file extensions: .avi, .mov, .mkv, .mpeg, .mpeg4, .mp4, .mp3, .wav, .ogg, .jpeg, .jpg, .png, .bmp, .gif, .tiff, .ico, .xlsx, and .zip. It can also obtain browsing history, cookies, and plug-in information.

Account Discovery: Local Account

T1087.001

TrickBot collects the users of the system.

Account Discovery: Email Account

T1087.003

TrickBot collects email addresses from Outlook.

Domain Trust Discovery

T1482

TrickBot can gather information about domain trusts by utilizing Nltest.

Lateral Movement [TA0008]

Technique Tactic

ID

Use

Lateral Tool Transfer

T1570

Some TrickBot modules spread the malware laterally across a network by abusing the SMB Protocol.

Collection [TA0009]

Technique Tactic

ID

Use

Data from Local System

T1005

TrickBot collects local files and information from the victim’s local machine.

Input Capture:Credential API Hooking

T1056.004

TrickBot has the ability to capture Remote Desktop Protocol credentials by capturing the CredEnumerateA API.

Person in the Browser

T1185

TrickBot uses web injects and browser redirection to trick the user into providing their login credentials on a fake or modified webpage.

Command and Control [TA0011]

Technique Tactic

ID

Use

Fallback Channels

T1008

TrickBot can use secondary command and control (C2) servers for communication after establishing connectivity and relaying victim information to primary C2 servers.

Application Layer Protocol: Web Protocols

T1071.001

TrickBot uses HTTPS to communicate with its C2 servers, to get malware updates, modules that perform most of the malware logic and various configuration files.

Ingress Tool Transfer

T1105

TrickBot downloads several additional files and saves them to the victim's machine.

Data Encoding: Standard Encoding

T1132.001

TrickBot can Base64-encode C2 commands.

Non-Standard Port

T1571

Some TrickBot samples have used HTTP over ports 447 and 8082 for C2.

Encrypted Channel: Symmetric Cryptography

T1573.001

TrickBot uses a custom crypter leveraging Microsoft’s CryptoAPI to encrypt C2 traffic.

Exfiltration [TA0010]

Technique Tactic

ID

Use

Exfiltration Over C2 Channel

T1041

TrickBot can send information about the compromised host to a hardcoded C2 server.

Impact [TA0040]

Technique Tactic

ID

Use

Resource Hijacking

T1496

TrickBot actors can leverage the resources of co-opted systems for cryptomining to validate transactions of cryptocurrency networks and earn virtual currency.

Table 1: TrickBot ATT&CK techniques for enterprise - CISA

Indicators of Compromise (IoCs)

Signatures

  • alert tcp any [443,447] -> any any (msg:"TRICKBOT:SSL/TLS Server X.509 Cert Field contains 'example.com' (Hex)"; sid:1; rev:1; flow:established,from_server; ssl_state:server_hello; content:"|0b|example.com"; fast_pattern:only; content:"Global Security"; content:"IT Department"; pcre:"/(?:\x09\x00\xc0\xb9\x3b\x93\x72\xa3\xf6\xd2|\x00\xe2\x08\xff\xfb\x7b\x53\x76\x3d)/"; classtype:bad-unknown; metadata:service ssl,service and-ports;)
  • alert tcp any any -> any $HTTP_PORTS (msg:"TRICKBOT_ANCHOR:HTTP URI GET contains '/anchor'"; sid:1; rev:1; flow:established,to_server; content:"/anchor"; http_uri; fast_pattern:only; content:"GET"; nocase; http_method; pcre:"/^\/anchor_?.{3}\/[\w_-]+\.[A-F0-9]+\/?$/U"; classtype:bad-unknown; priority:1; metadata:service http;)
  • alert tcp any $SSL_PORTS -> any any (msg:"TRICKBOT:SSL/TLS Server X.509 Cert Field contains 'C=XX, L=Default City, O=Default Company Ltd'"; sid:1; rev:1; flow:established,from_server; ssl_state:server_hello; content:"|31 0b 30 09 06 03 55 04 06 13 02|XX"; nocase; content:"|31 15 30 13 06 03 55 04 07 13 0c|Default City"; nocase; content:"|31 1c 30 1a 06 03 55 04 0a 13 13|Default Company Ltd"; nocase; content:!"|31 0c 30 0a 06 03 55 04 03|"; classtype:bad-unknown; reference:url,www.virustotal.com/gui/file/e9600404ecc42cf86d38deedef94068db39b7a0fd06b3b8fb2d8a3c7002b650e/detection; metadata:service ssl;)
  • alert tcp any any -> any $HTTP_PORTS (msg:"TRICKBOT:HTTP Client Header contains 'boundary=Arasfjasu7'"; sid:1; rev:1; flow:established,to_server; content:"boundary=Arasfjasu7|0d 0a|"; http_header; content:"name=|22|proclist|22|"; http_header; content:!"Referer"; content:!"Accept"; content:"POST"; http_method; classtype:bad-unknown; metadata:service http;)
  • alert tcp any any -> any $HTTP_PORTS (msg:"TRICKBOT:HTTP Client Header contains 'User-Agent|3a 20|WinHTTP loader/1.'"; sid:1; rev:1; flow:established,to_server; content:"User-Agent|3a 20|WinHTTP loader/1."; http_header; fast_pattern:only; content:".png|20|HTTP/1."; pcre:"/^Host\x3a\x20(?:\d{1,3}\.){3}\d{1,3}(?:\x3a\d{2,5})?$/mH"; content:!"Accept"; http_header; content:!"Referer|3a 20|"; http_header; classtype:bad-unknown; metadata:service http;)
  • alert tcp any $HTTP_PORTS -> any any (msg:"TRICKBOT:HTTP Server Header contains 'Server|3a 20|Cowboy'"; sid:1; rev:1; flow:established,from_server; content:"200"; http_stat_code; content:"Server|3a 20|Cowboy|0d 0a|"; http_header; fast_pattern; content:"content-length|3a 20|3|0d 0a|"; http_header; file_data; content:"/1/"; depth:3; isdataat:!1,relative; classtype:bad-unknown; metadata:service http;)
  • alert tcp any any -> any $HTTP_PORTS (msg:"TRICKBOT:HTTP URI POST contains C2 Exfil"; sid:1; rev:1; flow:established,to_server; content:"Content-Type|3a 20|multipart/form-data|3b 20|boundary=------Boundary"; http_header; fast_pattern; content:"User-Agent|3a 20|"; http_header; distance:0; content:"Content-Length|3a 20|"; http_header; distance:0; content:"POST"; http_method; pcre:"/^\/[a-z]{3}\d{3}\/.+?\.[A-F0-9]{32}\/\d{1,3}\//U"; pcre:"/^Host\x3a\x20(?:\d{1,3}\.){3}\d{1,3}$/mH"; content:!"Referer|3a|"; http_header; classtype:bad-unknown; metadata:service http;)
  • alert tcp any any -> any $HTTP_PORTS (msg:"HTTP URI GET/POST contains '/56evcxv' (Trickbot)"; sid:1; rev:1; flow:established,to_server; content:"/56evcxv"; http_uri; fast_pattern:only; classtype:bad-unknown; metadata:service http;)
  • alert icmp any any -> any any (msg:"TRICKBOT_ICMP_ANCHOR:ICMP traffic conatins 'hanc'"; sid:1; rev:1; itype:8; content:"hanc"; offset:4; fast_pattern; classtype:bad-unknown;)
  • alert tcp any any -> any $HTTP_PORTS (msg:"HTTP Client Header contains POST with 'host|3a 20|*.onion.link' and 'data=' (Trickbot/Princess Ransomeware)"; sid:1; rev:1; flow:established,to_server; content:"POST"; nocase; http_method; content:"host|3a 20|"; http_header; content:".onion.link"; nocase; http_header; distance:0; within:47; fast_pattern; file_data; content:"data="; distance:0; within:5; classtype:bad-unknown; metadata:service http;)
  • alert tcp any any -> any $HTTP_PORTS (msg:"HTTP Client Header contains 'host|3a 20|tpsci.com' (trickbot)"; sid:1; rev:1; flow:established,to_server; content:"host|3a 20|tpsci.com"; http_header; fast_pattern:only; classtype:bad-unknown; metadata:service http;)

Hashes

  • 7d57b8a21ea34fe0c01e801436f7b6e4
  • 2b3ffb06fa94e535e0b474dc70d1b5e0
  • 42a1b0d6f55b1b7143ab42b057765ba
  • 80c8a7211e93fc8a3a52b103c7b92d60
  • e05d85acc62b2795bfb94a681e64e20f
  • 7cb195e05a78a39cacb0c0d4d4fa23e4c3366785
  • 8d6ed63f2ffa053a683810f5f96c76813cdca2e188f16d549e002b2f63cee001
  • 236f4e149402cba69141e6055a113a68f2bd86539365210afb9861f4e2d3ad5f
  • 04eadc285ef0342a29997650eb0625eda6710ba6e8bb065b6e5ea5a09bf26db8
  • b18968f545ec472e621bea49edae6532ba611fe99e4984e02d6d95f80d8e066e
  • 62cf90d565675daf9b9f288e592c5c1331bab3a11f97130f0d7109791f2aab19

IP Address

  • 36.37.176[.]6
  • 74.131[.]16
  • 185.118.167[.]120

Domains

  • hxxp://myexternalip[.]com/raw
  • hxxp://api.ipify[.]org/
  • hxxps://snapfile[.]org/d/c7817a35554e88572b7b
  • hxxp://canarytokens[.]com/tags/traffic/images/azp6ai8pg5aq0c619ur0qzi6h/post.jsp
  • hxxp://Watson[.]Microsoft[.]com/StageOne/236f4e149402cba69141e6055a113a68f2bd86539365210afb9861f4e2d3ad5f/0_0_0_0/57b70f98/StackHash_ac38/0_0_0_0/00000000/c0000005/1a010044.htm?LCID=1033&OS=6.1.7601.2.00010100.1.0.1.17514&SM=LEN&SPN=647&BV=7UET92WW&MID=54046387-FC68-43CA-9068-077C0A157181

Files

  • jdmowcibgc.exe
  • executable.exe
  • sample2.exe
  • SHELL32.dll
  • ntdll.dll
  • KERNEL32.dll
  • msvcrt.dll

How to Prevent TrickBot Malware?

Cyber security threats and ransomware attacks are increasing at a tremendous pace. It is extremely difficult for cyber security analysts and incident responders to investigate and detect and prevent cyber security threats using conventional tools and techniques. NetSecurity’s ThreatResponder, with its diverse capabilities, can help your team detect the most advanced cyber threats, including APTs, zero-day attacks, and ransomware attacks. It can also help automate incident response actions across millions of endpoints, making it easy, fast, and hassle-free.

Want to try our ThreatResponder, cutting-edge Endpoint Detection & Response (EDR), and ThreatResponder FORENSICS, the Swiss knife for forensic investigators in action? Click on the below button to request a free demo of our NetSecurity’s ThreatResponder platform.


Disclaimer

The page's content shall be deemed proprietary and privileged information of NETSECURITY CORPORATION. It shall be noted that the contents of this page are copyrighted by NETSECURITY CORPORATION. Any violation/misuse/unauthorized use of this content "as is" or "modified" shall be considered illegal and subjected to articles and provisions that have been stipulated in the General Data Protection Regulation (GDPR) and Personal Data Protection Law (PDPL).

Author image
I am an experienced and CEH certified cybersecurity professional with expertise in incident response, forensic investigations, cyber threat intelligence, vulnerability mgmt. and cyber threat research.
Author image
About Inno Eroraha
Dulles, Virginia Website
Inno Eroraha is the Founder & Chief Strategist of NetSecurity Corporation, a cybersecurity products and services company based in Dulles, VA. NetSecurity is the developer of ThreatResponder Platform.
You've successfully subscribed to NetSecurity Blog
Great! Next, complete checkout for full access to NetSecurity Blog
Welcome back! You've successfully signed in.
Unable to sign you in. Please try again.
Success! Your account is fully activated, you now have access to all content.
Error! Stripe checkout failed.
Success! Your billing info is updated.
Error! Billing info update failed.