ATT&CK ReferencesJoe Sec Trickbot

Joe Sec Trickbot

Joe Security. (2020, July 13). TrickBot's new API-Hammering explained. Retrieved September 30, 2021.

Techniques1

None recorded.

None recorded.

None recorded.

Technique	Used by	Procedure example
T1055 Process Injection	MalwareTrickBot	TrickBot has used `Nt*` Native API functions to inject code into legitimate processes such as `wermgr.exe`. Joe Sec Trickbot
T1106 Native API	MalwareTrickBot	TrickBot uses the Windows API call, CreateProcessW(), to manage execution flow. TrickBot has also used `Nt*` API functions to perform Process Injection. Joe Sec Trickbot S2 Grupo TrickBot June 2017
T1140 Deobfuscate/Decode Files or Information	MalwareTrickBot	TrickBot decodes the configuration data and modules. Cyberreason Anchor December 2019 Fidelis TrickBot Oct 2016 Joe Sec Trickbot
T1497.003 Time Based Checks	MalwareTrickBot	TrickBot has used `printf` and file I/O loops to delay process execution as part of API hammering. Joe Sec Trickbot

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.