TrickBot

A source in the cybersecurity industry has told BleepingComputer that an employee of UHNJ was infected with the TrickBot trojan at the end of August.

RDPやVPNの不備...TrickBot/QakBotなどのマルウェアによってRDP等の認証情報を取得された可能性がある事例なども一般には報告されており...

They compel the victims to click on malicious links and install a malicious executable through social engineering and phishing. | Threat actors like affiliates of ransomware groups have started to utilize this technique to infect targets across the world. They recruit callers who work on phishing campaigns, called the “Callback phishing” technique.

The content repeatedly describes threat actors sending spearphishing or phishing emails with malicious attachments such as Microsoft Office documents, PDFs, RAR/ZIP archives, CHM files, and executables disguised as documents.

The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.

This file contains a malicious, macro-based code that runs and execute a PowerShell command.

The content repeatedly describes threat actors and malware using PowerShell to execute payloads, run commands, download additional malware, perform lateral movement, evade defenses, and execute scripts in memory. | Examples include: 'APT28 downloads and executes PowerShell scripts and performs PowerShell commands'; 'APT3 has used PowerShell on victim systems to download and run payloads after exploitation'; 'TA505 has used PowerShell to download and execute malware and reconnaissance scripts.'

The content notes embedded malicious macros in documents, such as "FIN4 has used spearphishing emails containing attachments ... with embedded malicious macros" and "TrickBot has used an email with an Excel sheet containing a malicious macro."

Examples include malicious Microsoft Office documents, trojanized Word documents, CHM files, malicious executables disguised as documents, and password-protected archives containing executables.

The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.

RDPやVPNの不備...TrickBot/QakBotなどのマルウェアによってRDP等の認証情報を取得された可能性がある事例なども一般には報告されており...

ADVSTORESHELL is capable of setting and deleting Registry values. Agent Tesla can achieve persistence by modifying Registry key entries. APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.

Bootkits are a type of malware that infects the boot process of a computer, allowing attackers to gain persistent access and control over the system.

The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.

TrickBot injects into the svchost.exe process. TRAILBLAZE has injected a hook into an existing process to load BRUSHFIRE in the spaces allocated memory to include the Ivanti Connect Secure (ICS) web process named web.

RDPやVPNの不備...TrickBot/QakBotなどのマルウェアによってRDP等の認証情報を取得された可能性がある事例なども一般には報告されており...

The TrickBot Trojan has received an update that adds a UAC bypass targeting the Windows 10 operating system so that it infects users without displaying any visible prompts. | If it is Windows 7, TrickBot will utilize the CMSTPLUA UAC bypass and if Windows 10, will now use the Fodhelper UAC Bypass.

crypters, which are also referred to as loaders or packers, are applications designed to encrypt and obfuscate malware to evade detection by antivirus (AV) scanners and hinder analysis.

TrickBot injects into the svchost.exe process. TRAILBLAZE has injected a hook into an existing process to load BRUSHFIRE in the spaces allocated memory to include the Ivanti Connect Secure (ICS) web process named web.

RDPやVPNの不備...TrickBot/QakBotなどのマルウェアによってRDP等の認証情報を取得された可能性がある事例なども一般には報告されており...

APT28 macro uses the command certutil -decode to decode contents of a .txt file storing the base64 encoded payload.

Another common evasion category involves detecting that a file is executing in a virtual machine (VM). This can involve fingerprinting resources like low CPU core count, system or video memory, or screen resolution. | The following are just a few examples of what malware authors can check for: Registry key paths showing VM-specific hardware, drivers or services. Filesystem paths for VM-specific drivers or other services. MAC addresses specific to some VM infrastructures.

Bootkits are a type of malware that infects the boot process of a computer, allowing attackers to gain persistent access and control over the system.

TrickBot’s malicious modules are reflectively injected into legitimate processes in order to evade detection.

ADVSTORESHELL is capable of setting and deleting Registry values. Agent Tesla can achieve persistence by modifying Registry key entries. APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.

TrickBot uses mimikatz to harvest emails and other credentials. | screenLocker_x64.dll: a module for reconnaissance and credential harvesting. It uses a component of mimikatz to extract credentials from the target system.

The new module contains a revamped version of its old banking component that tries to intercept credentials for e-banking websites. | Called a "webinject" module, this component has been rewritten to include new methods to inject malicious code inside banking websites.

Its payload is also minified and obfuscated... and contains the code which grabs the victim’s keystrokes and web form submit actions. | The injectDll module performs browser data injection, including JavaScript... The “second” stage of the web-inject... collects information from the login action and saves the “ap_email” and “ap_password” fields for a C2 payload.

Later, new password grabber modules turned TrickBot into a fully-fledged stealing tool that was able to browse Google Chrome, Mozilla Firefox, Microsoft Edge, and other applications containing passwords and credentials.

tdpwgrab32 This module is a password stealer module. It can steal credentials stored in registry, databases of different applications, configuration and “precious files” | outlookDll32 ... tries to retrieve credentials from the Outlook profile stored in the system registry.

Agent Tesla can gather credentials from a number of browsers... APT3 has used tools to dump passwords from browsers... APT41 used BrowserGhost, a tool designed to obtain credentials from browsers, to retrieve information from password stores... TrickBot can obtain passwords stored in files from web browsers such as Chrome, Firefox, Internet Explorer, and Microsoft Edge

AdFind can extract subnet information from Active Directory; actors used ipconfig /all, netsh.exe, ifconfig, arp, route, nbtstat, and related APIs/commands to gather IP, MAC, DNS, DHCP, gateway, proxy, routing, ARP, and adapter information.

"psfin32" is a point-of-sale finder reconnaissance module hunts for point of sale related services, software, and machines in Lightweight Directory Access Protocol (LDAP) | networkDll ... to lightweight directory access protocol (LDAP) queries. | Active Directory Enumeration Methodologies ... allows TrickBot operators to collect domain controller information once they are already on the compromised machine.

Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.

The content repeatedly describes malware and threat actors collecting host details such as hostname, OS version, architecture, CPU, memory, BIOS, language, and other machine characteristics; e.g., "Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host."

Another common evasion category involves detecting that a file is executing in a virtual machine (VM). This can involve fingerprinting resources like low CPU core count, system or video memory, or screen resolution. | The following are just a few examples of what malware authors can check for: Registry key paths showing VM-specific hardware, drivers or services. Filesystem paths for VM-specific drivers or other services. MAC addresses specific to some VM infrastructures.

After gaining administrator credentials, they will deploy the ransomware on the network's devices using PowerShell Empire or PSExec. | Once TrickBot is installed, it will harvest various data, including passwords, files, and cookies, from a compromised computer and will then try spread laterally throughout a network to gather more data.

Patchwork dumped the login data database from \AppData\Local\Google\Chrome\User Data\Default\Login Data ... BeaverTail has also been known to collect login data from Firefox within key3.db, key4.db and logins.json from /.mozilla/firefox/ for exfiltration.

The new module contains a revamped version of its old banking component that tries to intercept credentials for e-banking websites. | Called a "webinject" module, this component has been rewritten to include new methods to inject malicious code inside banking websites.

Its payload is also minified and obfuscated... and contains the code which grabs the victim’s keystrokes and web form submit actions. | The injectDll module performs browser data injection, including JavaScript... The “second” stage of the web-inject... collects information from the login action and saves the “ap_email” and “ap_password” fields for a C2 payload.

APT41 used the Steam community page as a fallback mechanism for C2. Bazar has the ability to use an alternative C2 server if the primary server fails. BISCUIT malware contains a secondary fallback command and control server that is contacted after the primary command and control server.

all command and control (C&C) servers tied to the most recent campaigns reside within web hosting provider networks and were communicating with their infected hosts over port 443. | All of them used port 443 / HTTPS as a connection method from the infected machine back to the C&C host, a method commonly used by malware authors to evade detection from network security devices that don’t inspect encrypted traffic.

The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications.

Qbot and TrickBot, in particular, were Emotet’s main customers and used their access to deploy ransomware (e.g. Ryuk, Conti, ProLock, Egregor, DoppelPaymer, and others).

ADVSTORESHELL C2 traffic is encrypted, then encoded with Base64 encoding. APT19 HTTP malware variant used Base64 to encode communications to the C2 server. APT33 has used base64 to encode command and control traffic.

The content is a catalog of malware and threat groups that encrypt command-and-control communications using algorithms such as DES, AES, RC4, XOR, Blowfish, RSA, Camellia, RC2, RC6, and custom ciphers.

APT29 also used PowerShell to create new tasks on remote machines, identify configuration settings, evade defenses, exfiltrate data, and to execute other commands.

Trickbot は Ryuk や Conti など複数のランサムウェアの展開に使用されていたことが分かっています。

This campaign used many advanced persistence, lateral movement, and detection evasion measures, including attempts to disable Windows Defender, the use of EternalBlue to spread, and the stopping of multiple services and processes related to anti malware products.