(Aaron) We've detonated some malware and we've watched
it do its thing for a little bit.
It downloaded some modules, just like we talked about,
and now we're going to kind of jump back into a previously infected,
before we did this Play by Play,
a previously infected box that's had some time on the
network because we've seen it take 15 minutes,
30 minutes, weeks to download everything and accomplish its missions,
right?
(Tyler) Yeah, so what I did was, the same malware example we had just looked at,
I had previously infected my system,
let it run for an hour or two just to give it a long time
to kind of download whatever it wanted.
And we're going to go in,
and we're actually going to now look at the files that it
downloaded and learn how we can actually decrypt them.
Because remember that when TrickBot downloads the plugins to the system,
it encrypts them per system.
So unless we get some data from this system,
we're not going to be able to decrypt it.
(Aaron) Right,
and here's where we'll able to get some indicators out of those
configurations that we can use for detection.
(Tyler) Right, exactly.
(Aaron) Awesome.
Well, let's jump into that.
(Tyler) Sure.
So,
the first thing that we're going to do is I'm just going to
jump into the directory where TrickBot's at.
(Aaron) John's directory.
(Tyler) Yeah, John's AppData/Roaming directory.
Remember speedLAN looks familiar.
(Aaron) But, why have LAN when you can have speedLAN?
(Tyler) Exactly.
And then I'm going to jump into the data directory.
Remember, the data directory is where all the plugins are.
And so we're seeing five different plugins here,
as well as the directories that contain some of their configuration files.
And all these files within here, all of the DLL files,
and these are actually DLL files, they're just encrypted,
as well as the files that we'll see in the configuration directories,
they're all encrypted.
(Aaron) So they're encrypted,
which is why they're just showing up as just file as opposed
to showing up as a recognized DLL file.
(Tyler) Right.
Now, even if you can't decrypt them,
you can still get a lot of information as to what TrickBot was doing.
Because each of these plugin names, they're always named the same.
And they have been researched pretty well.
And so you can just look at the names and tell what it was doing.
So for example, this injectDll64,
this is one of the modules that grabs banking activity.
So its sole purpose is to kind of inject itself into browsers,
and when you log into your banking website,
to grab the credentials there, and you know,
potentially some additional information.
(Aaron) So that's modifying the web page on the client side with
essentially a scraper for when you type in that information?
(Tyler) Exactly.
(Aaron) Got it.
(Tyler) The networkDll64, this is the one that's usually downloaded initially.
Its sole purpose is to go and grab system information.
The interesting thing about all of these modules is that for the most part,
the network traffic is encrypted.
It's usually SSL or TLS encrypted over various ports.
For some reason, this network DLL, the network traffic for it, is not encrypted.
And so, when we do some network analysis later on,
we will actually be able to see what it was sending.
(Aaron) Oh, that's interesting.
So is this, do you think it's not encrypted because that module is potentially,
if we look at a software development team and we have a modularized program,
like any other normal program,
especially organized crime still is called organized crime for
a reason because it's ran like a business,
right?
So, for effective software with each lifecycle,
you're going to have teams that maybe work on the network module,
but don't have the same cipher suite capability built into that.
For that reason, maybe like, cross team communication?
(Tyler) It's possible.
It's definitely possible, or you know,
this could just be like some really old one that
somebody forgot to turn encryption on, or yeah,
who knows?
Yeah, who knows?
But yeah, for some reason this one does not,
at least for the most part does not send its
information encrypted over the network.
(Aaron) It's copy/pasted from Stack Overflow?
(Tyler) Probably, probably.
Psfin64,
this is an interesting one because it's actually used for point-of-sale devices.
So if it gets on, if TrickBot gets on a point-of-sale device,
and a lot of point-of-sale devices run Windows,
and if you're not sure what a point-of-sale device is,
these are the cash registers that you slide your card in at Target or Walmart,
or any other place in the world.
You know,
these things can get infected and this module is specifically made to
grab credit card information from point-of-sale devices.
(Aaron) Got it.
And Target is a good example, right?
(Tyler) Right.
Because they did get hit pretty hard (Aaron) Yep.
(Tyler) Pwgrab is exactly what it sounds like.
Its purpose is to go across the system and grab any saved user credentials.
So,
you know when you're in your browser and it says do
you want to save this password,
or you go to your email and you save your email client
and you save your user password there?
That's stored somewhere on your computer,
and there are ways to decode that data to get it back.
This module just scans across the entire computer looking for
all that data because it knows where it's at.
And so it's going to grab that out and it's going to
send that back to the attackers.
(Aaron) So whether that's a Chrome back-end datastore or a Mozilla,
or whatever it is, do you know if it has,
because there's capabilities as well for cracking older versions of KeyStore?
And that's been something that I've seen with other malware.
Does it have a KeyStore capability?
(Tyler) It wouldn't surprise me if it did.
I don't know for sure.
(Aaron) Okay.
(Tyler) But,
you can see that this module is much larger than all the other modules.
It's 1.2 MB or so.
It would not surprise me if it had this capability to do that.
If you think about it, when an attacker gets on a system,
if I have safe credentials,
then it makes sense for them to go and find it everywhere that they can
because then they don't have to wait for me to log in,
they can just grab it directly.
(Aaron) Is this also the module that's going to dump LSASS?
(Tyler) No, this one won't dump LSASS and do Mimikatz type capabilities.
There's another module,
it doesn't look like that plugin was downloaded in this case.
But yeah, there's another module that will do that.
(Aaron) Okay.
(Tyler) This module is also interesting because even on Windows 10
where the modules are downloaded directly into memory,
when this runs it leaves in the data directory here,
it will leave a file called grabber_temp.INTEG .RAW,
and all that is is like some temporary file leftover from when it's
grabbing credentials out of everywhere around your computer.
So that's another indicator that you can look for.
If you see this this file on your system,
then chances are you've had TrickBot and it's grabbed any
safe credentials that were on the system.
(Aaron) Right, so you not only know that you are infected,
you also know that any KeyStore that's been available has been compromised.
(Tyler) Right.
This last module, systeminfo64,
this is another module that just goes through and grabs some system information,
but a lot of researchers have actually seen this module used
specifically to determine if the resources of this computer meet the
requirements for deploying the Ryuk ransomware.
So, this is a good indication, if you see systeminfo64,
chances are, eventually,
this version of TrickBot will be deploying Ryuk ransomware on your system.
(Aaron) So,
it's probably just pumping information back to a Reddit
server somewhere that's saying yes or no?
(Tyler) Yeah, yeah, pretty much.
Or at least recording that information so that when the attacker decides,
hey, I'm going to deploy Ryuk, then it knows,
oh well,
you know these 10 servers are the ones that I want to deploy on
because it's going to hurt the company the most.