FortiGuard Labs analyzed a TrickBot variant that uses DNS tunneling instead of HTTP to communicate with its command-and-control servers, while also hiding its behavior with encrypted strings, runtime API resolution, and NTFS Alternate Data Streams. The malware maintains persistence through Windows Task Scheduler and supports modular actions such as command execution, module download, process hollowing, process doppelgänging, and rundll32-based execution. #TrickBot #westurn.in #Wireshark
Keypoints
- FortiGuard Labs found TrickBot samples sending malformed DNS queries as part of DNS tunneling communication with C2 infrastructure.
- The analyzed variant differs from earlier TrickBot versions that primarily used HTTP for command-and-control traffic.
- TrickBot uses encrypted constant strings and hash-based API resolution at runtime to hinder static analysis.
- Persistence is established through Windows Task Scheduler using a disguised task name such as “Wireshark autoupdate #72784.”
- The malware stores task-related data in NTFS Alternate Data Streams named “$TASK” and “$FILE” to avoid duplicate scheduled tasks.
- DNS tunneling is used to transmit request and response data through specially structured packets and encoded IPv4 addresses.
- The variant supports modular capabilities including EXE and DLL download, process hollowing, process doppelgänging, cmd.exe execution, PowerShell execution, and raw machine code execution.
MITRE Techniques
- [T1071.004 ] Application Layer Protocol: DNS – TrickBot used DNS queries and responses to communicate with its C2 server, hiding traffic inside normal DNS activity (‘communicates with its C2 server over DNS Tunneling’ and ‘send malformed DNS queries’).
- [T1572 ] Protocol Tunneling – The malware embedded command-and-control data inside DNS packets to bypass network security controls (‘hiding non-DNS traffic inside standard DNS queries and responses’).
- [T1053.005 ] Scheduled Task/Job – Persistence was maintained by creating a Windows scheduled task that runs at startup and repeats every 5 minutes (‘leveraging the Windows Task Scheduler’ and ‘Runs at the device startup and repeats the task action every 5 minutes’).
- [T1564.003 ] Hide Artifacts: NTFS File Attributes – TrickBot stored task name and executable path in NTFS Alternate Data Streams to conceal configuration data (‘stores the task name and the full path of its executable file in two NTFS Alternate Data Streams (ADS)’).
- [T1055.002 ] Process Injection: Process Hollowing – The malware supports injecting downloaded modules into a randomly selected process using process hollowing (‘Downloads a module and injects it into a randomly selected process using process hollowing technique’).
- [T1055.005 ] Process Injection: Process Doppelgänging – TrickBot can inject modules through process doppelgänging (‘Downloads a module and injects it in a randomly selected process using process doppelgänging’).
- [T1218.011 ] Signed Binary Proxy Execution: Rundll32 – The malware launches rundll32.exe to execute a downloaded DLL module (‘launches rundll32.exe to execute the downloaded DLL module’).
- [T1059.001 ] Command and Scripting Interpreter: PowerShell – One response command executes PowerShell code through cmd.exe pipes (‘Executes PowerShell codes through anonymous pipes connected to cmd.exe’).
- [T1105 ] Ingress Tool Transfer – TrickBot downloaded executable and DLL modules from the C2 server before execution (‘Downloads an EXE module’ and ‘Downloads a module’).
- [T1059 ] Command and Scripting Interpreter – The malware executed Windows command-line commands and raw machine code as command-driven actions (‘Executes a Windows command-line command’ and ‘Executes raw machine code (ASM code) directly within TrickBot’s memory’).
Indicators of Compromise
- [Domain ] C2 communication and DNS tunneling domain – westurn.in
- [IP Address ] DNS server used for observed traffic – 8.8.8.8
- [SHA-256 ] Associated TrickBot sample hash – DF527A5C2FBDE43816CD02F4CD49EEE4BB82FB4A3C7045021360888C7D504C986C677EB2B3FFD288083C59A13D7BB712D4754AF61A5563873F76C440962346F4105F652E6B8F31C371F2385877E43B6772AFF5D3168D4635F8A1FCBB32142133C331EDEDBF8EE9829895424423CE3FD17E359D2E784FCBCE396AACFF458CF53B19A82E1354AC14A3DA7C840CBDD0CE50DB38432D78E767B36F08E45024C23DBF80245BA792992FBFE24ABAC33F8FD66F24CDEB5F0F21CFDF45A29D107C8D3B
- [File Name ] Observed malicious DLL module – tcp469A.dll
- [File Path ] Example TrickBot executable path used in persistence – E:4d99f6b.exe
- [Task Name ] Disguised scheduled task name – Wireshark autoupdate #72784