Fortinet Analyzes TrickBot Variant Using DNS Tunneling for C2
Summary
Fortinet details a TrickBot variant that uses DNS tunneling for command-and-control, persists through scheduled tasks, and can download and execute modules. The analyzed C2 server was offline, so researchers simulated its responses.
Key points
- The Windows malware sends encoded command-and-control data through malformed DNS queries and responses; the analyzed C2 server was offline.
- It encrypts strings and resolves Windows APIs at runtime to hinder static analysis.
- It creates a recurring Windows Scheduled Task, disguises it as a Wireshark update, and stores task details in NTFS Alternate Data Streams.
- DNS requests use packet types 0x30, 0x31, and 0x32 for commands, response sizing, and response data; response data is encoded in IPv4 addresses.
- Supported commands include executing Windows commands and PowerShell, downloading modules, and using process hollowing or process doppelgänging.
- Fortinet lists westurn.in as the C2 domain and provides sample hashes; it says its security services detect or block the campaign.
Article Details
- Attack Vectors
- TrickBot used DNS tunneling to exchange command-and-control requests and responses through malformed DNS queries and DNS response IP addresses.
- The malware established persistence by creating a Windows Task Scheduler task configured to run at startup and every five minutes.
- The variant stored task and executable-path information in NTFS Alternate Data Streams.
- TrickBot supported downloading and executing modules, including execution through rundll32.exe, process hollowing, process doppelgänging, PowerShell, and direct execution of machine code.
- Defensive Notes
- Fortinet reported protection through FortiGuard AntiSPAM, Web Filtering, IPS, and Antivirus services; the TrickBot DNS tunneling IPS signature is named Trick.Botnet.
- FortiNDR Cloud detects TrickBot DNS tunneling using behavioral analysis of DNS traffic.
- The reported FortiGuard Antivirus signature for the samples is W64/TrickBot.WC!tr.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | westurn[.]in | Domain identified by the article as the TrickBot campaign's C2 server domain. |
| SHA256 | 105f652e6b8f31c371f2385877e43b6772aff5d3168d5d4635f8a1fcbb321421 | SHA-256 hash listed for a TrickBot sample. |
| SHA256 | 33c331ededbf8ee9829895424423ce3fd17e359d2e784fcbce396aacff458cf5 | SHA-256 hash listed for a TrickBot sample. |
| SHA256 | 3b19a82e1354ac14a3da7c840cbdd0ce50db38432d78e767b36f08e45024c23d | SHA-256 hash listed for a TrickBot sample. |
| SHA256 | 6c677eb2b3ffd288083c59a13d7bb712d4754af61a5563873f76c440962346f4 | SHA-256 hash listed for a TrickBot sample. |
| SHA256 | bf80245ba792992fbfe24abac33f8fd66f24cdeb5f0f21cfdf45a29d107c8d3b | SHA-256 hash listed for a TrickBot sample. |
| SHA256 | df527a5c2fbde43816cd02f4cd49eee4bb82fb4a3c7045021360888c7d504c98 | SHA-256 hash listed for a TrickBot sample. |
MITRE ATT&CK
T1053.005 · Scheduled TaskThe malware created a scheduled task configured to run at startup and repeat every five minutes.T1055.002 · Portable Executable InjectionA supported response command injects a downloaded module into a randomly selected process using process hollowing.T1055.005 · Thread Local StorageA supported response command injects a downloaded module into a randomly selected process using process doppelgänging.T1059 · Command and Scripting InterpreterThe malware supported executing Windows command-line commands, including commands through anonymous pipes connected to cmd.exe.T1059.001 · PowerShellA supported response command executes PowerShell code through anonymous pipes connected to cmd.exe.T1071.004 · DNSTrickBot used DNS queries and responses for command-and-control communication.T1105 · Ingress Tool TransferTrickBot requested and downloaded executable modules from its C2 server.T1218.011 · Rundll32TrickBot launched rundll32.exe to execute a downloaded DLL through its Control_RunDLL export function.T1564.003 · Hidden WindowTrickBot stored its task name and executable path in NTFS Alternate Data Streams.T1572 · Protocol TunnelingTrickBot tunneled command-and-control data through DNS packets.
People
Malware
Anchor DNSWhile DNS-based TrickBot variants, including Anchor DNS, have been publicly documented previously, this analysis focuses on recently observed samples and provides an in-depth technical analysis of their implementationTrickBotAfter conducting an in-depth analysis, I determined that these samples are TrickBot variants that use DNS tunneling to communicate with their command-and-control (C2) servers.
Vendors
Products
FortiClientFortinet FortiGate, FortiMail, FortiClient, and FortiEDR support the FortiGuard AntiVirus service, and the FortiGuard AntiVirus engine is part of each solution.FortiEDRFortinet FortiGate, FortiMail, FortiClient, and FortiEDR support the FortiGuard AntiVirus service, and the FortiGuard AntiVirus engine is part of each solution.FortiGateFortiGate and FortiNDR detect the TrickBot DNS Tunneling with the IPS signature:FortiGuardFortiGuard Labs recently observed several malicious samples that were sending malformed DNS queries.FortiMailFortinet FortiGate, FortiMail, FortiClient, and FortiEDR support the FortiGuard AntiVirus service, and the FortiGuard AntiVirus engine is part of each solution.FortiNDRFortiGate and FortiNDR detect the TrickBot DNS Tunneling with the IPS signature:FortiNDR CloudFortiNDR Cloud detects TrickBot DNS tunneling through behavioral analysis of DNS traffic.FortiPhishThe FortiPhish Phishing Simulation Service, together with Fortinet’s Security Awareness and Training Service, uses real-world phishing scenarios to train and test employees against common social engineering tactics.Microsoft WindowsAffected Platforms: Microsoft Windows