Procedure examples

TrickBot collects local files and information from the victim’s local machine.

TrickBot collects a list of install programs and services on the system’s machine.

TrickBot can use secondary C2 servers for communication after establishing connectivity and relaying victim information to primary C2 servers.

TrickBot obtains the IP address, location, and other relevant network information from the victim’s machine.

TrickBot can enumerate computers and network devices.

TrickBot has used a VNC module to monitor the victim and collect information to pivot to valuable systems on the network

TrickBot uses non-descriptive names to hide functionality.

TrickBot leverages a custom packer to obfuscate its functionality.

TrickBot uses an AES CBC (256 bits) encryption algorithm for its loader and configuration files.

TrickBot can identify the user and groups the user belongs to on a compromised host.

The TrickBot downloader has used an icon to appear as a Microsoft Word document.

TrickBot can send information about the compromised host and upload data to a hardcoded C2 server.

TrickBot creates a scheduled task on the system that provides persistence.

TrickBot has used Nt* Native API functions to inject code into legitimate processes such as wermgr.exe.

TrickBot injects into the svchost.exe process.

TrickBot has the ability to capture RDP credentials by capturing the CredEnumerateA API

TrickBot uses module networkDll for process list discovery.

TrickBot has been known to use PowerShell to download new payloads, open documents, and upload data to command and control servers.

TrickBot has used macros in Excel documents to download and deploy the malware on the user’s machine.

TrickBot can identify the groups the user on a compromised host belongs to.

TrickBot uses HTTPS to communicate with its C2 servers, to get malware updates, modules that perform most of the malware logic and various configuration files.

TrickBot gathers the OS version, machine name, CPU type, amount of RAM available, and UEFI/BIOS firmware information from the victim’s machine.

TrickBot searches the system for all of the following file extensions: .avi, .mov, .mkv, .mpeg, .mpeg4, .mp4, .mp3, .wav, .ogg, .jpeg, .jpg, .png, .bmp, .gif, .tiff, .ico, .xlsx, and .zip. It can also obtain browsing history, cookies, and plug-in information.

TrickBot collects the users of the system.

TrickBot collects email addresses from Outlook.

TrickBot has been known to reach a command and control server via one of nine proxy IP addresses.

TrickBot downloads several additional files and saves them to the victim's machine.

TrickBot uses the Windows API call, CreateProcessW(), to manage execution flow. TrickBot has also used Nt* API functions to perform Process Injection.

TrickBot uses brute-force attack against RDP with rdpscanDll module.

TrickBot can modify registry entries.

TrickBot can Base64-encode C2 commands.

TrickBot module shareDll/mshareDll discovers network shares via the WNetOpenEnumA API.

TrickBot decodes the configuration data and modules.

TrickBot uses web injects and browser redirection to trick the user into providing their login credentials on a fake or modified web page.

TrickBot has attempted to get users to launch malicious documents to deliver its payload.

TrickBot utilizes EternalBlue and EternalRomance exploits for lateral movement in the modules wormwinDll, wormDll, mwormDll, nwormDll, tabDll.

TrickBot uses vncDll module to remote control the victim machine.

TrickBot can gather information about domain trusts by utilizing Nltest.

TrickBot module "Trickboot" can write or erase the UEFI/BIOS firmware of a compromised device.

TrickBot has used printf and file I/O loops to delay process execution as part of API hammering.

TrickBot can implant malicious code into a compromised device's firmware.

TrickBot establishes persistence by creating an autostart service that allows it to run whenever the machine boots.

TrickBot establishes persistence in the Startup folder.

TrickBot can obtain passwords stored in files from several applications such as Outlook, Filezilla, OpenSSH, OpenVPN and WinSCP. Additionally, it searches for the ".vnc.lnk" affix to steal VNC credentials.

TrickBot has retrieved PuTTY credentials by querying the Software\SimonTatham\Putty\Sessions registry key

TrickBot has come with a signed downloader component.

TrickBot can obtain passwords stored in files from web browsers such as Chrome, Firefox, Internet Explorer, and Microsoft Edge, sometimes using esentutl.

TrickBot can steal passwords from the KeePass open source password manager.

TrickBot used COM to setup scheduled task for persistence.

TrickBot has used a hidden VNC (hVNC) window to monitor the victim and collect information stealthily.