Trickbot Dynamic Analysis
- Before doing anything, I'm going to use RegShot to take a snapshot of what the registry looks like on the host I'm going to infect with TrickBot. Later on, after I've infected the host, I'll run RegShot for a second time. Then we'll use the compare button in RegShot to compare the two records and it'll tell us what changes have taken place. I've opened RegShot, clicked 1st shot and followed the prompts.
2. Start Process Explorer and Process Monitor
3. Run TrickBot
4. Immediately after running TrickBot.exe, it appears in the Process Explorer
5. After a few seconds to a minute, TrickBot disappears from Process Explorer.
6. Svchost appears in Process Explorer. We can assume that this Svchost process was launched my Trickbot. Trickbot is known to use process hollowing. So it'll start Svchost in suspended mode. The code from Svchost will be loaded into memory. After that, TrickBot will copy the malicious code into the process, in this case Svchost, and then tell the process it can start executing. This way it's a normal program that's running malicious code. This is a mechanism that's used to keep TrickBot hidden.
7. Stop Process Monitor.
8. Take the 2nd shot with RegShot.
9. Once the 2nd shot is complete, I clicked the Compare button in RegShot. This opens a text file that shows you all of the changes between the 1st and 2nd shots. The things that stood out to me immediately as suspicious were the keys and values that were added to HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache. That location is used for Windows Scheduled Tasks. Scheduled Tasks can be used by malware to gain persistence on a system.
10. Scrolled down and saw the Files added section. It says C:\Windows\System32\Tasks\Ms Cloud Disk was added. I've never heard of that before but I know TrickBot names malicious files in a way to make them appear legitimate.
11. I went to that directory, to C:\Windows\System32\Tasks. This is where scheduled tasks are stored.
12. I opened the Ms Cloud Disk file. I see all of the scheduled task settings. Toward the bottom, I see the command C:\Users\Malcolm Mills\AppData\Roaming\MsCloud\Vticmbqt.exe. So this lets me know TrickBot dropped another executable onto the host, Vticmbqt.exe.
13. I opened Process Monitor next. There was over 300,00 events so I added the following filters:
- Process Name is trickbot.exe
- Operation is WriteFile - Anytime TrickBot wrote to a file
- Operation is RegSetValue - Anytime TrickBot modified anything in the registry
- Process Name is Vticmbqt.exe
- Operation is SetDispositionInformationFile - This is the operation that's used when a file gets deleted or renamed.
I added the filters one by one and they never produced any results.
14. Since there were no results from those filters, I tried one more:
- Path ends with Vticmbqt.exe
15. This filter gave results. It shows svchost creating files and writing to the disk. This lets us know that svchost wrote the Vticmbqte.exe file to the disk and confirms that svchost is malicious and does the dirty work for TrickBot via the process hollowing technique I mentioned earlier.
Indicators of Compromise
Registry Keys added
- HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot\{7EBC0E0E-6363-4800-9DA2-F30ABBCA3FF0}
- HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7EBC0E0E-6363-4800-9DA2-F30ABBCA3FF0}
- HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\MS Cloud Disk
Registry Values added
- HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7EBC0E0E-6363-4800-9DA2-F30ABBCA3FF0}\Path: "\Ms Cloud Disk"
- HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\MS Cloud Disk\ID: "{7EBC0E0E-6363-4800-9DA2-F30ABBCA3FF0}"
- HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\MS Cloud Disk\Index: 0x00000001
Files dropped
- C:\Windows\System32\Tasks\Ms Cloud Disk
- C:\Users\Malcolm Mills\AppData\Roaming\MSCloud\Vticmbqt.exe
These are the Artifacts you could look for on a host that would confirm the host is infected with TrickBot.
Social
