ID	X0025
Type	Spyware, Trojan (banking trojan)
Aliases	None
Platforms	Windows
Year	2016
Associated ATT&CK Software	TrickBot

TrickBot

TrickBot is a trojan spyware program that has mainly been used for targeting banking sites. TrickBot is written in the C++ programming language.

ATT&CK Techniques

Name	Use
Execution::Shared Modules (T1129)	TrickBot parses PE headers. [7]

See ATT&CK: TrickBot - Techniques Used.

Enhanced ATT&CK Techniques

Name	Use
Discovery::File and Directory Discovery (E1083)	The malware collects machine information and local files with specified file extensions. [1]
Anti-Static Analysis::Software Packing (F0001)	The malware has a custom packer to obfuscate itself. [1]
Defense Evasion::Process Injection (E1055)	The malware injects itself into svchost.exe. [2]
Persistence::Registry Run Keys / Startup Folder (F0012)	The malware has an auto-start service that allows it to run whenever the machine boots. [3]
Defense Evasion::Disable or Evade Security Tool (F0004)	The malware terminates the following anti-malware services: Window Defender, MBamService (Malwarebytes), SAVService (Sophos AV). [3]
Collection::Archive Collected Data::Encryption (E1560.m02)	The malware uses a custom crypter leveraging Microsoft's CryptoAPI to encrypt C2 traffic. C2 update responses seem to have been digitally signed using bcrypt. [4]
Defense Evasion::Bootkit (F0013)	The malware can implement malicious code into firmware, allowing read, write, and/or erasure of the UEFI/BIOS firmware. [5]
Lateral Movement::Supply Chain Compromise (E1195)	TrickBot comes with a signed downloader component. [5]
Discovery::System Information Discovery (E1082)	The malware collects information about the computer, resources, services, installed programs, firmware, and operating system versions. [1]
Defense Evasion::Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02)	TrickBot encodes data using XOR. [7]
Execution::Command and Scripting Interpreter (E1059)	TrickBot accepts command line arguments. [7]

MBC Behaviors

Name	Use
Execution::Remote Commands (B0011)	The malware receives various commands from the C2 server. [2]
Cryptography::Encrypt Data::AES (C0027.001)	The malware uses an AES CBC (256 bits) encryption algorithm for its loader and configuration files. [1]
Anti-Behavioral Analysis::Dynamic Analysis Evasion (B0003.012)	The malware uses numerous printf loops to delay the execution process and overload the sandbox with junk data (API Hammering). [6]
Impact::Spamming (B0039)	In July 2019, TrickBot was observed infecting computers to steal email passwords and address books to spread malicious emails. [8]
Data::Encode Data::XOR (C0026.002)	TrickBot encodes data using XOR. [7]
Discovery::Code Discovery::Inspect Section Memory Permissions (B0046.002)	TrickBot inspects section memory permissions. [7]
Memory::Allocate Memory (C0007)	TrickBot allocates RWX memory. [7]
Process::Create Process (C0017)	TrickBot creates a process on Windows. [7]
Process::Create Process::Create Suspended Process (C0017.003)	TrickBot creates a suspended process. [7]
Process::Terminate Process (C0018)	TrickBot terminates processes. [7]

Indicators of Compromise

SHA256 Hashes

a162bb9219a09b302b90bc6f908e117e3fb2c722560336d378fd76a8f22f78f8 MD5 Hashes
28661ea73413822c3b5b7de1bef0b246
218613f0f1d2780f08e754be9e6f8c64
135e4fa98e2ba7086133690dbd631785
719578c91b4985d1f955f6adb688314f
132c4338cdc46a0a286abf574d68e2e0
e8e7b0a8f274cad7bdaedd5a91b5164d Yara Rules
rule MALW_trickbot_bankBot : Trojan { meta: author = "Marc Salinas @Bondey_m" description = "Detects Trickbot Banking Trojan" strings: $str_trick_01 = "moduleconfig" $str_trick_02 = "Start" $str_trick_03 = "Control" $str_trick_04 = "FreeBuffer" $str_trick_05 = "Release" condition: all of ($str_trick_*) }
rule MALW_systeminfo_trickbot_module : Trojan { meta: author = "Marc Salinas @Bondey_m" description = "Detects systeminfo module from Trickbot Trojan" strings: $str_systeminf_01 = "" $str_systeminf_02 = "" $str_systeminf_03 = "" $str_systeminf_04 = "GetSystemInfo.pdb" $str_systeminf_05 = "" $str_systeminf_06 = "" condition: all of ($str_ systeminf_*) }
rule MALW_dllinject_trickbot_module : Trojan { meta: author = "Marc Salinas @Bondey_m" description = " Detects dllinject module from Trickbot Trojan" strings: $str_dllinj_01 = "user_pref(" $str_dllinj_02 = "" $str_dllinj_03 = "" $str_dllinj_04 = "" condition: all of ($str_ dllinj_*) }
rule MALW_mailsercher_trickbot_module : Trojan { meta: author = "Marc Salinas @Bondey_m" description = " Detects mailsearcher module from Trickbot Trojan" strings: $str_mails_01 = "mailsearcher" $str_mails_02 = "handler" $str_mails_03 = "conf" $str_mails_04 = "ctl" $str_mails_05 = "SetConf" $str_mails_06 = "file" $str_mails_07 = "needinfo" $str_mails_08 = "mailconf" condition: all of ($str_mails_*) }