Malware

TrickBoot

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Reconnaissance

1 technique

T1592Gather Victim Host InformationEvidence1

At the time of writing, our research uncovered TrickBot performing reconnaissance for firmware vulnerabilities.

Execution

1 technique

T1106Native APIEvidence1

It drops the driver into the Windows directory, starts the RwDrv service, and then makes DeviceIoControl calls to talk to the hardware.

Persistence

3 techniques

T1542Pre-OS BootEvidence1

Bootkits are a type of malware that infects the boot process of a computer, allowing attackers to gain persistent access and control over the system.

T1542.003BootkitEvidence1

Bootkits allow an attacker to control how the operating system is booted or even directly modify the OS to gain complete control over a system

T1543.003Windows ServiceEvidence1

open_or_init_driver... load the driver, create a Windows service, and open a handle to the RwDrv service.

Privilege Escalation

1 technique

T1543.003Windows ServiceEvidence1

open_or_init_driver... load the driver, create a Windows service, and open a handle to the RwDrv service.

Stealth

2 techniques

T1542Pre-OS BootEvidence1

Bootkits are a type of malware that infects the boot process of a computer, allowing attackers to gain persistent access and control over the system.

T1542.003BootkitEvidence1

Bootkits allow an attacker to control how the operating system is booted or even directly modify the OS to gain complete control over a system

Discovery

1 technique

T1082System Information DiscoveryEvidence2

One of the user-mode applications (exe) collects UEFI firmware information such as BIOS write protection settings and SPI registers.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

TrickBoot includes an obfuscated copy of RwDrv.sys embedded within the malware itself. It drops the driver into the Windows directory

Impact

1 technique

T1495Firmware CorruptionEvidence2

Compromising the Management Engine of a system would have considerable value on its own, but the leaks show that the group is using the unique privileges of the ME firmware as a way to gain indirect access to the UEFI/BIOS, drop additional payloads, and gain runtime control of the system below the operating system using System Management Mode (SMM).

INDICATORS OF COMPROMISE

IOCs tracked for this family

9 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

9 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha1●●●●●●●●●●●●View more in app6 years ago

hash.sha256●●●●●●●●●●●●View more in app6 years ago

hash.md5●●●●●●●●●●●●View more in app6 years ago

hash.sha256●●●●●●●●●●●●View more in app6 years ago

ACTIVITY FEED

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

4 SOURCESView more in app

eclypsium blogNews

Sep 19, 2022

Firmware Security Realizations - Part 3 - SPI Write Protections - Eclypsium | Supply Chain Security for the Modern Enterprise

TrickBoot is cited as a TrickBot-related UEFI/firmware-focused capability used to achieve persistence below the OS by interacting with BIOS/SPI flash, making it difficult to detect/remove and potentially enabling destructive outcomes if firmware is modified improperly.

eclypsium blogNews

Jun 2, 2022

Conti Targets Critical Firmware

Firmware-focused malware/tooling referenced as targeting UEFI/BIOS by abusing SPI controller BIOS Control register misconfiguration to write SPI flash and manipulate firmware.

vmware security blogNews

Jun 15, 2021

Detecting UEFI Bootkits in the Wild (Part 1) - VMware Security Blog - VMware

A TrickBot-associated UEFI-focused module that performs firmware reconnaissance, including platform identification and BIOS write-protection checks; the article says it contains no UEFI module and is reconnaissance-only.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching9

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

TrickBoot

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Reconnaissance

1 technique

T1592Gather Victim Host InformationEvidence1

At the time of writing, our research uncovered TrickBot performing reconnaissance for firmware vulnerabilities.

Execution

1 technique

T1106Native APIEvidence1

It drops the driver into the Windows directory, starts the RwDrv service, and then makes DeviceIoControl calls to talk to the hardware.

Persistence

3 techniques

T1542Pre-OS BootEvidence1

Bootkits are a type of malware that infects the boot process of a computer, allowing attackers to gain persistent access and control over the system.

T1542.003BootkitEvidence1

Bootkits allow an attacker to control how the operating system is booted or even directly modify the OS to gain complete control over a system

T1543.003Windows ServiceEvidence1

open_or_init_driver... load the driver, create a Windows service, and open a handle to the RwDrv service.

Privilege Escalation

1 technique

T1543.003Windows ServiceEvidence1

open_or_init_driver... load the driver, create a Windows service, and open a handle to the RwDrv service.

Stealth

2 techniques

T1542Pre-OS BootEvidence1

Bootkits are a type of malware that infects the boot process of a computer, allowing attackers to gain persistent access and control over the system.

T1542.003BootkitEvidence1

Bootkits allow an attacker to control how the operating system is booted or even directly modify the OS to gain complete control over a system

Discovery

1 technique

T1082System Information DiscoveryEvidence2

One of the user-mode applications (exe) collects UEFI firmware information such as BIOS write protection settings and SPI registers.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

TrickBoot includes an obfuscated copy of RwDrv.sys embedded within the malware itself. It drops the driver into the Windows directory

Impact

1 technique

T1495Firmware CorruptionEvidence2

INDICATORS OF COMPROMISE

IOCs tracked for this family

9 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

9 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha1●●●●●●●●●●●●View more in app6 years ago

hash.sha256●●●●●●●●●●●●View more in app6 years ago

hash.md5●●●●●●●●●●●●View more in app6 years ago

hash.sha256●●●●●●●●●●●●View more in app6 years ago

ACTIVITY FEED

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

4 SOURCESView more in app

eclypsium blogNews

Sep 19, 2022

Firmware Security Realizations - Part 3 - SPI Write Protections - Eclypsium | Supply Chain Security for the Modern Enterprise

eclypsium blogNews

Jun 2, 2022

Conti Targets Critical Firmware

Firmware-focused malware/tooling referenced as targeting UEFI/BIOS by abusing SPI controller BIOS Control register misconfiguration to write SPI flash and manipulate firmware.

vmware security blogNews

Jun 15, 2021

Detecting UEFI Bootkits in the Wild (Part 1) - VMware Security Blog - VMware

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching9

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.