TrickBot is a modular malware family that uses DNS tunneling to communicate with its command-and-control (C2) servers. The malware maintains persistence on the victim's computer by leveraging the Windows Task Scheduler, storing its configuration in NTFS Alternate Data Streams, and using encrypted strings and runtime API resolution to hinder analysis. TrickBot employs several obfuscation techniques to protect itself from static analysis, including encrypting constant strings at runtime, dynamically calculating constant numbers, and resolving Windows APIs at runtime using hash-based lookups.
The malware uses DNS tunneling to bypass network security controls by hiding non-DNS traffic inside standard Domain Name System (DNS) queries and responses.[/subscribe_to_unlock_form]
TrickBot is a modular malware family that uses DNS tunneling to communicate with its command-and-control (C2) servers. The malware maintains persistence on the victim's computer by leveraging the Windows Task Scheduler, storing its configuration in NTFS Alternate Data Streams, and using encrypted strings and runtime API resolution to hinder analysis. TrickBot employs several obfuscation techniques to protect itself from static analysis, including encrypting constant strings at runtime, dynamically calculating constant numbers, and resolving Windows APIs at runtime using hash-based lookups.
The malware uses DNS tunneling to bypass network security controls by hiding non-DNS traffic inside standard Domain Name System (DNS) queries and responses.[emaillocker id="1283"]
The TrickBot variant analyzed in this study has a modular architecture that enables in-memory module execution and supports functions such as command execution, process injection, and PowerShell execution. The malware's control commands are delivered through DNS packets, which are used to transport data between the C2 server and the compromised device.
| Tactic | Technique Id | Technique | Sub-technique |
|---|---|---|---|
| Persistence | T1053.005 | Scheduled Task/Job | Scheduled Task |
| Defence Evasion | T1027.002 | Obfuscated Files or Information | Software Packing |
| Defence Evasion | T1055.002 | Process Injection | Portable Executable Injection |
| Defence Evasion | T1055.005 | Process Injection | Thread Local Storage |
| Defence Evasion | T1218.011 | System Binary Proxy Execution | Rundll32 |
| Defence Evasion | T1564.003 | Hide Artifacts | Hidden Window |
| Command and control | T1071.004 | Application Layer Protocol | DNS |
| Command and control | T1572 | Protocol Tunneling | - |
| Objective | Behavior ID | Behavior |
|---|---|---|
| Anti-Static Analysis | B0032 | Executable Code Obfuscation |
| Discovery | E1082 | System Information Discovery |
| Command & Control | B0030 | C2 Communication |
| Anti-Static Analysis | E1027 | Obfuscated Files or Information |
| Command & Control | E1105 | Ingress Tool Transfer |
| Persistence | F0012 | Registry Run Keys / Startup Folder |
The following reports contain further technical details:
[/emaillocker]