TrickBot variant uses DNS tunneling for C2 instead of HTTP, with ADS-stored config and in-memory modules
FortiGuard Labs analyzed a TrickBot variant that carries command-and-control (C2) traffic over DNS tunneling, embedding encoded data in DNS queries and responses, instead of the HTTP used by earlier variants. The malware persists through Windows Task Scheduler, stores its configuration in NTFS Alternate Data Streams, and hinders analysis with encrypted strings and runtime API resolution. Its modular architecture keeps the family's core capabilities despite the change in C2 transport. Fortinet states that its customers are already protected by FortiGuard AntiVirus, IPS, Web Filtering and Botnet Domain DB coverage.
Detalhes técnicos
- C2 channel: data is encoded into DNS queries and responses (DNS tunneling), replacing the HTTP C2 of earlier variants.
- Persistence: Windows Task Scheduler.
- Configuration storage: NTFS Alternate Data Streams.
- Anti-analysis: encrypted strings and runtime API resolution.
- Capabilities: modular, in-memory module execution, command execution, process injection and PowerShell execution.
- Detection: FortiGate and FortiNDR use an IPS signature for TrickBot DNS tunneling. FortiNDR Cloud also detects it through behavioral analysis of DNS traffic.
- The article references a C2 domain but does not name it. It lists six sample SHA-256 hashes.
Remediação
- Monitor DNS traffic for anomalous, high-entropy or unusually long queries, and apply behavioral DNS detection.
- Hunt for suspicious scheduled tasks and for files with unexpected Alternate Data Streams.
- Block the associated C2 domain and keep AV and IPS signatures up to date.
- Run user awareness and phishing-simulation training.
Linha do tempo
-
TrickBot variant uses DNS tunneling for C2 instead of HTTP, with ADS-stored config and in-memory modules
ler a análise desta fonte ocultar
FortiGuard Labs analyzed a TrickBot variant that carries command-and-control (C2) traffic over DNS tunneling, embedding encoded data in DNS queries and responses, instead of the HTTP used by earlier variants. The malware persists through Windows Task Scheduler, stores its configuration in NTFS Alternate Data Streams, and hinders analysis with encrypted strings and runtime API resolution. Its modular architecture keeps the family's core capabilities despite the change in C2 transport. Fortinet states that its customers are already protected by FortiGuard AntiVirus, IPS, Web Filtering and Botnet Domain DB coverage.
Technical Details
- C2 channel: data is encoded into DNS queries and responses (DNS tunneling), replacing the HTTP C2 of earlier variants.
- Persistence: Windows Task Scheduler.
- Configuration storage: NTFS Alternate Data Streams.
- Anti-analysis: encrypted strings and runtime API resolution.
- Capabilities: modular, in-memory module execution, command execution, process injection and PowerShell execution.
- Detection: FortiGate and FortiNDR use an IPS signature for TrickBot DNS tunneling. FortiNDR Cloud also detects it through behavioral analysis of DNS traffic.
- The article references a C2 domain but does not name it. It lists six sample SHA-256 hashes.
Remediation
- Monitor DNS traffic for anomalous, high-entropy or unusually long queries, and apply behavioral DNS detection.
- Hunt for suspicious scheduled tasks and for files with unexpected Alternate Data Streams.
- Block the associated C2 domain and keep AV and IPS signatures up to date.
- Run user awareness and phishing-simulation training.