Trickbot on the Ropes Part 2: The QQAAZZ Money Laundering Ring

While shutting down the technical aspects of malware is critical (see Trickbot on the Ropes Part 1), the real disincentive to the criminals is when you hit them hard in the money.  That was the objective of Europol's Operation 2BaGoldMule case against QQAAZZ.   Working with partners in 16 countries, including Latvia, Bulgaria, the United Kingdom, Spain, and Italy, Europol helped to coordinate search warrants being executed at 40 different residences in support of criminal proceedings in the United States, Portugal, and the UK, and Spain.

Europol put out a two-part InfoGraphic as part of their story on the arrests, "20 Arrests in QQAAZZ Multi-Million Money Laundering Case":

 

Infographic: https://www.europol.europa.eu/publications-documents/operation-2bagoldmule

The criminals behind the QQAAZZ money laundering ring received funds from botnet operators, and "tumbled" the funds through a variety of shell companies and crypto-currencies to produce "clean money" keeping a 40% to 50% cut of the funds for themselves.

The U.S. Department of Justice says that QQAAZZ-controlled bank accounts received funds stolen via banking trojans including Dridex, Trickbot, and GozNym malware.  The DOJ action came in two rounds, with the first indictment being unsealed back in October 2019 naming these individuals: 

Aleksejs Trofimovics

a/k/a Aleksejs Trofimovich, Alexey Trofimovich, Aleko Stoyanov Angelov 

Ruslans Nikitenko 

a/k/a Krzysztof Wojciech Lewko, Milen Nikolchev Nikolov, Rafal Zimnoch 

Arturs Zaharevics

a/k/a Piotr Ginelli, Arkadiusz Szuberski 

Deniss Ruseckis

a/k/a Denis Rusetsky, Sevdelin Sevdalinov Atanasov 

These individuals used a collection of shell companies to open a large number of bank accounts in Portugal.  In 2018, I sat in a meeting in London with a handful of the largest banks in the UK and heard for the first time as they shared information with one another that it was a "common" thing that when someone had their bank account hit by Trickbot, a wire transfer would be sent to Portugal!

According to the indictment, Ruslans Nikitenko used his shell company Selbevulte LDA to open accounts at eleven banks in Portugal.  He used the company Colossal Devotion LDA to open accounts at nine additional banks.  Arturs Zaharevics created the shell company Cardinal Gradual Real Estate Unipessoal LDA and used it to open accounts at ten banks in Portugal.  Dennis Ruseckis created Flamingocloud LDA and used it to open accounts at thirteen banks in Portugal!

According to the October 2019 Indictment, more than $1.1 Million USD in wire attempts were made just for the transactions shown below, although in more than half of the cases, the funds were able to be blocked or recovered.

Date	Victim Bank	Wire Attempt	Beneficiary
07MAR2017	Schwab	$75000	Aktrofi Services
20SEP2017	BOA	$84900	Aktrofi Services
26OCT2017	JPMorgan Chase	$98780	Privelegioasis
29NOV2017	American Express	$121360	Selbevulte
30NOV2017	BB&T	$72000	Privelegioasis
08MAR2018	USAA	$29500	Flamingocloud
08MAR2018	USAA	$29500	Colossal Devotion
21MAR2018	BOA	$49000	Colossal Devotion
10APR2018	JPMorgan Chase	$59426	Cardinal Gradual
10APR2018	JPMorgan Chase	$59426	Cardinal Gradual
10APR2018	JPMorgan Chase	$59426	Cardinal Gradual
30AUG2018	PNC	$99693	Selbevulte
14NOV2018	BOA	$56202	Aktrofi Services
14NOV2018	BOA	$112921	Deinis Gorenko
14NOV2018	BOA	$45830	Deinis Gorenko
06DEC2018	JPMorgan Chase	$114652	Flamingocloud

In between that indictment and the current one, there was a bit more publicity back in May 2020 when "Plinofficial", a Russian scam-rapper, whose real name was Maksim Boiko, was arrested by the FBI when he landed at the Miami airport, as was covered by the BBC and others at the time. 

https://www.bbc.com/news/world-us-canada-52671381

In the more recent action, the indictment of the US Western District of Pennsylvania was just unsealed, having been filed on 29SEP2020.  This indictment names an additional group of money launderers:

• Nika Nazarovi - of Georgia - aka Nika Utiashvili, Mihail Atanasov, Stefan Trifonov Zhelyazkov
• Martins Ignatjevs - of Latvia - aka Yodan Angelov Stoyanov, Aleksander Tihomirov Yanev, Svetlin Iliyanov Asenov 
• Aleksandre Kobiashvili - of Georgia - aka Antonios Nastas, Ognyan Krasimirov Trifonov
• Dmitrijs Kuzminovs - of Latvia - aka Parush Gospodinov
• Valentins Sevecs - of Latvia - aka Marek Jaswilko, Rafal Szczytko
• Dmitrijs Slapins - of Latvia 
• Armens Vecels - of Latvia 
• Artiom Capacli - of Bulgaria
• Ion Cebanu  - of Romania
• TOmass Trescinkas - of Latvia 
• Ruslans Sarapovs - of Latvia 
• Silvestrs Tamenieks - of Latvia 
• Abdelhak Hamdaoui  - of Latvia 
• Petar Iliev - of Belgium 

it says that "in total, cybercriminals attempted to transfer tens of millions of dollars to QQAAZZ-controlled accounts, and QQAAZZ successfully laundered millions of dollars stolen from victims around the world."

The indictment breaks the criminals into three tiers: 

Leaders 

Mid-level Managers 

and Money Mules 

In the September 2020 indictment, some of the victim companies, whose bank accounts were used to wire money to European shell companies created by those named above, included: 

1. a technology company in Windsor, CT 
2. an Orthodox Jewish Synagogue in Brooklyn, NY 
3. a medical device manufacturer in York, Pennsylvania
4. an individual in Montclair, NJ 
5. an architecture firm in Miami, FL 
6. an individual in Acworth, GA
7. an automative parts manufacturer in Livonia, MI 
8. a homebuilder in Skokie, IL 
9. an individual in Carollton, TX 
10. an individual in Villa Park, CA.  

Dozens of additional US victims are identified, but it is unknown the total number of victims whose funds were stolen, or attempted to be stolen through these schemes. 

Those named in the two indictments received funds to shell company bank accounts including at least 147 accounts opened at banks in Portugal, as well as Germany, Spain, and the United Kingdom. 

The indictment provides a partial list of the funds transfers which occurred between US-based victims and accounts controlled by these criminals. 

In order to accomplish this, members of the QQAAZZ cash-out system advertised their services on "exclusive, underground, Russian-speaking, online cybercriminal forums."   Some of these advertisements on a single forum cost as much as $10,000 per year!  

Some of the online monikers used by QQAAZZ members in these forums included: 

qqaazz            globalqqaazz            markdevido 

richrich          donaldtrump55         manuel           krakadil                     

kalilinux         ritchie                      totala              totala22 

These forum exchanges helped to establish relationships between the malware gangs and the money launderers.  For example, QQAAZZ members using the name "richrich" chatted with members of the GozNym malware crime group about being a "drop handler" in the UK and Europe and having many accounts that could be used for money laundering, including an account in the name "Yaromu Gida" at a bank in Turkey.  That account received $176,500 in funds stolen from the medical device manufactuer in the Western District of Pennsylvania. 

"DonaldTrump55" provided bank account information for a drop belonging to Ruslans Nikitentko at a bank in Portugal opened using a counterfeit Polish identity card in the name Krzysztof Wojciech Lewko.  The account later received $121,360 from a US victim. 

Trickbot On The Ropes: Microsoft's Case Against Trickbot

 Trickbot is having a truly bad time this month!  While as of today, Trickbot binaries are being delivered by Emotet, there is every sign that they are struggling.   Emotet's daily activities are best documented by a team of researchers using the collective identity "Cryptolaemus" and sharing news of IOCs and URLs on their website: https://paste.cryptolaemus.com/.  With no activity from October 6th to 12th, there was every indication a "change" was coming, and beginning on 14OCT2020, researchers such as our friends at @CofenseLabs and @Malware_Traffic are both reporting that Trickbot is now being delivered by the Emotet spam-sending botnet.  

This post examines Microsoft's case against Trickbot. However, there are also reports of U.S. Cyber Command taking a role in disrupting Trickbot, as reported by the Washington Post and security journalist Brian Krebs. In the "take-down" attempt, as described by Krebs, the bot began propagating to other bots that its new controller IP address should be "127.0.0.1:1" - which would result in the bot-infected computer stopping communication with the criminals.  There was also an attempt to flood the criminals with millions of fake "stolen credentials" hoping to confuse their ability to sort out "true victims."  As Krebs also reported, the fabulous Trickbot C&C tracker at FEODOTracker is reporting many live C&C addresses for Trickbot.  (Also see Trickbot On the Ropes Part 2: the QQAAZZ Money Laundering Ring.) 

The Microsoft Trickbot Case

On October 12, 2020, Microsoft announced "New action to combat ransomware ahead of U.S. election" describing Trickbot as malware that "has infected over a million computing devices around the world since late 2016." By filing a lawsuit in the U.S. District Court for the Eastern District of Virginia, Microsoft received permission for a Temporary Restraining Order (TRO).  The Digital Crimes Unit (much love, guys!) worked with the FS-ISAC, ESET, Symantec, the Microsoft Defender team, NTT, and Lumen's Black Lotus Lab and others to lay out their case. 

The legal documents surrounding the case are on the Microsoft website: NoticeOfPleadings.com/trickbot/

Microsoft and the FS-ISAC bring the case with a 60 page complaint, demonstrating harm to their respective customers in the Eastern District of Virginia, and demanding that "John Doe 1" and "John Doe 2" appear in court for a Jury Trial.

They charge them with violations of: 

• The Copyright Act - 17 USC § § 101 
• The Computer Fraud and Abuse Act 18 USC § 1030
• The Electronic Communications Privacy Act 18 USC § 2701
• Trademark Infringement under the Lanham Act 15 USC § 1114
• False Designation of Origin under the Lanham Act 15 USC § 1125(a)
• Trademark Dilution under the Lanham Act 15 USC § 1125(c) 
• Common Law Trespasses to Chattels 
• Unjust Enrichment 
• and Conversion 

To do so, Microsoft asked the court to force hosting providers to suspend services and block and monitor traffic for the customers who were using particular IP addresses within their organizations.  The list included: 

• Input Output Flood, LLC of Las Vegas, for IP addresses: 
• 104.161.32[.]103, .105, .106, .109, and .118.
• Hosting Solution Ltd (Hurricane Electric of Fremont, California) for IP address:
•  104.193.252[.]221.
• Nodes Direct Holdings of Jacksonville Florida for IP addresses: 
• 107.155.137[.]7, .19, and .28,
• 162.216.0[.]163, 
• 23.239.84[.]132, .136
• Virtual Machine Solutions, LLC of Los Angeles, California for IP addresses: 
• 107.174.192[.]162 and 
• 107.175.184[.]201
• Hostkey USA of New York for IP address: 
• 139.60.163[.]45 
• Fastlink Network Inc, of Los Angelese for IP address: 
• 156.96.46[.]27
• Green Floid LLC for IP addresses: 
• 195.123.241[.]13 and .55 
• Twinservers Hosting of Nashua, New Hampshire for IP address: 
• 162.247.155[.]165  

Each team made significant contributions to the effort, and most have published their own Trickbot blogs, which I link below, with regards to the case, their most important function was to provide professional analysis in the form of a Declaration in Support of Motion for TRO: 

• Lyons is Jason Lyons, a Senior Manager of Investigations at the DCU Malware & Cloud Crimes Team.  Lyons, who served in the Cyber CounterIntelligence unit of the U.S. Army, provides 25 pages of testimony and ten "Exhibits." Part of his testimony included the proof of 25 million Gmail, 19 million Yahoo, 11 million Hotmail, 7 million AOL, 3.5 million MSN, and 2 million Yahoo.co.uk addresses known to have been targeted by Trickbot (based on reporting from Deep Instinct)
• Finones is Rodelio Finones, a Senior Security Software Engineer and Malware Researcher at the Microsoft DCU. He provides a 21 page testimony of his own investigation into Trickbot, 
• Thakur is Vikram Thakur, the Technical Director of Symantec Enterprise, where he has been a major rockstar for more than a dozen years!  He provides a 20 page testimony.
• Garlow is Kevin Garlow, Lead Information Security Engineer at LUMEN (formerly CenturyLink). His testimony includes the fact that he has identified 502 distinct IP addresses that had acted as Trickbot controllers, but that 40 of them have remained online despite more than 30 abuse notifications and that 9 of them have been sent more than 100 such notifications.  He states that "We confirmed 55 new Trickbot controller IPs in September 2020 and 99 new Trickbot controller IPs in August."  It is these long-lived "bullet-proof" controllers that Microsoft is targeting.  It is also likely that revealing whoever is paying the bills for those long-lived services may be a path to identifying John Doe 1 and John Doe 2.  Garlow's testimony that he has sent so many notices for take-down which have been ignored is a powerful part of this package!
• Silberstein is Steven Silberstein, the CEO of the FS-ISAC.  He provides testimony to more than 500 fraud attempts against FS-ISAC member institutions over an 18 month period, with $7 Million in attempted fraud.  One FS-ISAC member had dozens of attempts in a two week period with an average fraud attempt of $268,000!  
  
  
  
• Ghaffari is Kayvan M. Ghaffari, an attorney with Crowell & Moring LLP for Microsoft and the FS-ISAC.  His testimony calls out the particular web hosting companies that were hosting the machines targeted by the TRO, including Colocrossing, IOFlood, HostKey, VDI-Network, ENET-2, and King Servers, pointing out that all of these organizations have Terms of Service which are clearly violated by the Trickbot controllers.  He then attaches as exhibits more than 650 pages of similar cases and the related court documents from them.
• Boutin is Jean-Ian Boutin, the Head of Threat Research, calls Trickbot "one of the most prolific and frequently encountered types of malware on the Internet."

Related TrickBot Blogs

ESET analyzed 125,000 malware samples and downloaded and decrypted 40,000 configuration files used by Trickbot modules, helping to map out the C&C servers by the botnet. While Trickbot can drop many "modules" these are not one-size-fits-all.  Trickbot modules were sometimes dropped in phases after an initial assessment of the network on which the bot found itself, and other times varies by the "gtag" -- the unique label used to sign the infection, thought to be related to affiliates who paid the Trickbot operators.

gtag timeline by ESET

Lumen's Black Lotus provided C2 timelines, demonstrating which IP addresses in which countries were active in which timeframes.  Indonesia, for example, hosted active C2 servers on 1,362 days!  Colombia and Ecuador, which by their count were #2 and #3 had only 652 and 637 C2 days by comparison.  They shared 95 C2 addresses in their recent Look Inside the Trickbot Botnet blog post. Many of these IP addresses are also called out in Lyons testimony as Exhibit 2.

5.152.210[.]188	45.89.127[.]27	96.9.77[.]56	129.232.133[.]39	185.172.129[.]100	194.87.236[.]171
5.182.210[.]224	51.77.112[.]252	103.111.83[.]246	131.161.253[.]190	185.234.72[.]114	195.123.238[.]83
5.182.211[.]124	51.83.196[.]234	103.12.161[.]194	139.60.163[.]45	185.234.72[.]35	195.123.239[.]193
5.182.211[.]138	51.89.215[.]186	103.196.211[.]120	156.96.46[.]27	185.236.202[.]249	195.123.240[.]18
27.147.173[.]227	62.108[.]35.9	103.221.254[.]102	158.181.155[.]153	185.25.51[.]139	195.123.240[.]93
36.66.218[.]117	80.210.32[.]67	103.36.48[.]103	176.31.28[.]85	185.99.2[.]106	195.123.241[.]224
36.89.182[.]225	83.220.171[.]175	103.76.169[.]213	177.190.69[.]162	185.99.2[.]115	195.123.241[.]229
36.89.243[.]241	85.204.116[.]117	104.161.32[.]108	179.127.88[.]41	186.159.8[.]218	195.161.62[.]25
36.91.45[.]10	89.249.65[.]53	104.161.32[.]118	180.211.170[.]214	190.136.178[.]52	200.116.159[.]183
36.91.87[.]227	91.200.100[.]71	107.155.137[.]15	181.112.157[.]42	190.145.83[.]98	200.116.232[.]186
36.94.33[.]102	91.200.103[.]236	110.93.15[.]98	181.129.104[.]139	190.152.182[.]150	200.171.101[.]169
45.127[.]222.8	92.38.135[.]61	112.109.19[.]178	181.129.134[.]18	190.214.28[.]74	200.29.119[.]71
45.138.158[.]33	92.62.65[.]163	117.252.214[.]138	181.143.186[.]42	190.99.97[.]42	201.231.85[.]50
45.148.10[.]174	93.189.42[.]225	121.100.19[.]18	182.253.113[.]67	192.3.246[.]216	212.22.70[.]59
45.66.10[.]22	96.9.73[.]73	121.101.185[.]130	185.14.30[.]247	194.5.249[.]214	220.247.174[.]12
45.89.125[.]148	96.9.77[.]142	122.50.6[.]122	185.142.99[.]94	194.5.249[.]215

Symantec's blog post "Trickbot: U.S. Court Order Hits Botnet's Infrastructure" has a great infographic about "How Trickbot Works": 

Microsoft on Trickbot's use of Covid-19 Lures

Microsoft is in a unique position to take action against malware, having visibility to so much malware-related traffic from browser telemetry, Microsoft Defender reports, and Office365 scans.  In the past year, they have evaluated 6 Trillion messages and blocked 13 Billion malicious emails that used 1.6 Billion URLs to try to infect the email recipients!

Microsoft's Digital Defense Report 2020 points out that Trickbot began using COVID-19 spam lures on March 3, 2020, and went on to become the most prominent spam botnet using COVID-19 themes.

From MS Digital Defense Report 2020 

We've long argued that if the lure is timely and controversial, people will click on it.  That seems to be the case even today as ProofPoint's @ThreatInsight has pointed out, documenting that a recent malware campaign, first seen October 6, 2020, is using President Trump's diagnosis as a lure to infect people with additional malware, using the subject line "Recent material about the president's situation" and the promise of additional details in a password-protected email attachment.

What sites is Trickbot targeting?

Its been a while since we decoded Trickbot configs to see what banks and organizations were being actively targeted.  While recently most of the news about Trickbot has been how it drops the Ryuk Ransomware, and that is certainly important, we can't forget that Trickbot is first and foremost a Banking Trojan / Infostealer that is designed to steal website credentials from infected users.  While there are many fascinating add-on modules that perform other actions, such as inventorying the network on which an infected machine resides, attempting to dump Windows Domain credentials, and launching remote control backdoors, THE DEFAULT BEHAVIOR IS TO STEAL WEBSITE CREDENTIALS.  Every website where the user types data has the data captured and sent to the Trickbot operators, but certain websites are specified for more nuanced interactions, which could be to only steal data from particular sub-pages, or could be to alter the appearance of the website to request additional data not being asked for by the website.  This latter behavior is called a "Web Inject" and on Trickbot, they are listed in an encrypted file named "dinj" for "Dynamic Injections."

Like many malware researchers, I use the fantastic tools developed by @hasherezade to help decode the configuration files of Trickbot to see what the current collection of URLs in the DINJ file is targeting.

DINJ file breakdown (04MAR2020 by @GarWarner)

The DINJ file for trickbot contain lists of URL patterns labeled with markup tags / .

In the file I used for this analysis, updated from the Command & Control on 04MAR2020, there were 84 "igroups" containing 329 URL patterns, targeting 131 named domains.

In the current DINJ file, the most common target is Japanese banks and financial institutions.  Each of the 41 URLs below were for Japanese organizations:

82bank.co.jp	eposcard.co.jp	lifecard.co.jp	shinkin-ib.jp.
aeon.co.jp	fukuokabank.co.jp	michinokubank.co.jp	shinwabank.co.jp
aeonbank.co.jp	gogin.co.jp	miyagin.co.jp	shizugin.net
amazon.co.jp	gunmabank.co.jp	mizuhobank.co.jp	shizuokabank.co.jp
anser.ne.jp	higobank.co.jp	mufg.jp	shokochukin.co.jp
awabank.co.jp	hirogin.co.jp	ncbank.co.jp	tominbank.co.jp
bk.mufg.jp	hokkokubank.co.jp	orico.co.jp	tsukubabank.co.jp
chibabank.co.jp	hokuyobank.co.jp	pocketcard.co.jp	vpass.ne.jp
chugin.co.jp	jaccs.co.jp	rakuten.co.jp	yamagatabank.co.jp
chushin.co.jp	juroku.co.jp	ryugin.co.jp
daishi-bank.co.jp	keiyobank.co.jp	saisoncard.co.jp

US Banks were second in popularity

53.com	citizensbankonline.com	iccu.com	regions.com
ally.com	cu1.org	iconnectdata.com	secureinternetbank.com
amegybank.com	discover.com	key.com	suntrust.com
americanexpress.com	ebanking-services.com	mtb.com	usaa.com
bankofamerica.com	efirstbank.com	navyfederal.org	usbank.com
bmo.com	firelandsfcu.org	nbarizona.com	vancity.com
capitalone.com	huntington.com	onlinebank.com	vectrabank.com
ccservicing.com	ibanking-services.com	paypal.com	zionsbank.com
chase.com		pnc.com

Followed by German Banks

bawagpsk.com	consorsbank.de	ing-diba.de	raiffeisen.at
berliner-bank.de	deutsche-bank.de	lzo.com	santander.de
comdirect.de	haspa.de	norisbank.de	sparda.de
commerzbank.de	ing.de	postbank.de	targobank.de

Some of the other targets were especially interesting to me.

The Brokerages:
Ameritrade.com, eTrade.com, Schwab.com

The Big Retails:
Amazon.com, BestBuy.com, CostCo.com, eBay.com, Grainger.com, SamsClub.com

The CryptoCurrency Exchanges/Companies:
Binance.com, BitFinex.com, BitStamp.com, Blockchain.com, CoinBase.com, CoinMarketCap.com, CryptoCompare.com, DogeChain.info, Kraken.com, Paxful.com

And two Payroll companies, which may be especially interesting as we are in Tax Season in the USA.  Curiously these two are both part of the same "igroup":
ADP.com and Paychex.com

Especially since they are targeting ADMINISTRATORS of those Payroll systems, based on the strings I'm seeing:
*runpayroll.adp.com/*
myapps.paychex.com/*_remote/*

If you are curious to see more of the current DINJ file, I've shared it as a PasteBin file here:

GarWarner's Trickbot DINJ file 04MAR2020
(updated URL: Pastebin removed the first one, trying again.)

URL Patterns in Trickbot DINJ

Some patterns do not identify a domain, such as the pattern "https://.*.de/privatkunden/*" (which says "we don't care which German Bank we're looking for, but if they have a URL that includes "private customers", go ahead and grab stuff from there.  The pie chart above only maps organizations where a full domain was identified.

Remember that the default is GRAB EVERYTHING, but URLs with specific strings on a site will be sent back to the criminals "tagged for action" making it easier for them to harvest and take action on those pages.  Here's an example of URLs related to NavyFederal:

So, while there may be many other places on the NavyFederal website that request user interaction, three particular URL patters are targeted for prioritized collection.  The "s=" number tells which iGroup the URL belongs to (all of the URLs in 1535723065134935 belong to Navy Federal), the "id=" tells what sub-URL the visitor was on when they submitted this particular data.

The "Ignore-Mask" flag can be used to tell Trickbot not to gather particular data (for example, in the NavyFederal block above, it says Ignore everything related to Javascript and Stylesheet pages), or to say "Don't gather this data as part of the current "LM" because we already got it elsewhere, as seen in this Norris Bank block:

In this iGroup for NorisBank, there are three specific patterns that each extract data to a particular location, so when the generic pattern "*norisbank.de*" is used, it instructs the bot not to include those subURLs that have already been captured separately.

A Bit of Spam Context

As everyone probably knows by now, the top spamming botnet since the death of Kelihos has been Emotet.  Emotet is involved in the distribution of several banking trojans, including TrickBot which is known to be the main source of Ryuk ransomware infections, and Qbot, which often leads to MegaCortex ransomware, and even Dridex, which sometimes leads to BitPaymer ransomware.

There are many great Emotet/Trickbot researchers out there, especially the @Cryptolaemus research group, which shares Emotet Indicators of Compromise regularly, and @pollo290987, who shared this graphic on his Twitter feed:

Trickbot is ALSO distributed by other sources, which Crowdstrike does a great job of illustrating in this diagram that maps out the relationships between spambots and malware payloads:

CrowdStrike Actor Labels for Emotet => Trickbot => Ryuk etc.

In the Crowdstrike worldview, "Mummy Spider" is the actor(s) behind Emotet, who serves his customer "Wizard Spider" by delivering Trickbot for him/them.  Post infection with Trickbot, Wizard Spider may choose to infect with Ryuk Ransomware.  Per Crowstrike, Lunar Spider (the operator of BokBot AKA IcedID) and Scully Spider (the operator of DanaBot) also occasionally are used to distribute Trickbot.  But mostly, its Emotet.

TrickBot: New Injects, New Host

What’s in the Name: Call it IcedID or TrickBot? Tell that to a security researcher (Arsh Arora in this case) and watch them RANT

(Gar-note: today's blog post is a guest blog from malware analyst, Arsh Arora...) 

Today’s post starts with an interesting link from Dawid Golak's Medium post: “IcedID aka# Bokbot Analysis with Ghidra” which mentions that IcedID is dropping TrickBot. Although the article is about IcedID, it gets confusing quickly, because the researcher focused on finding artifacts for IcedID instead finds TrickBot artifacts. A big question for the security industry still remain is to how to classify the malware from the originator or the binary that is being dropped. We followed up on the sample he mentioned and saw the same thing.  This is definitely Trickbot.

First Stage – Sample Collection from Virus Total Intelligence

In the "AnyRun Analysis" linked to by Dawid, the TrickBot binary was downloaded from “54.36.218[.]96 (slash) tin[.]exe

Virus total link (50/ 71 detections) https://www.virustotal.com/intelligence/search/?query=84878B4967A4243CD904794F3B8B2812

Fig 1: TrickBot Sample

Second Stage – Sample Execution

After the execution in a virtual environment, I was able to see TrickBot behavior similar to what we have documented in the past in our post "Trickbot's New Magic Trick: Sending Spam":

A large number of config files and dlls were loaded into the Roaming/netcache/Data, a  unique behavior of the TrickBot binary.

Fig 2: Configs and Dlls Loaded

Third Stage – Open Firefox and visit different Bank website

It is often the case that to get any banking trojan to co-operate with the researcher, some initiation from the researcher side is needed. Due to past experience, I have learned that one needs to open up a browser and visit different bank websites to activate the banking trojan. The trojan resists until instigated by visits to these pages. I visited close to 20 different bank websites and was able to obtain injects from 7 of those bank websites. The injects and admin login panels of the websites are as follows.

Name of  Bank	Admin Login Panel	IP	Location
Bank of America	https://aefaldnessliverhearted[.]com/load/	185.242.6.245	AS9009, Prague
Chase	https://aefaldnessliverhearted[.]com/load/	185.242.6.245	AS9009, Prague
Citi	https://remirollerros[.]com/legr/	109.234.37.246	AS48282, RU
Usaa	https://onlylocaltrade[.]com/lob.php	185.87.187.198	AS48635,NL
WellsFargo	https://wellsfargostrade.com/2wells2	185.36.189.143	AS50673, NL
PNC	https://wellsfargostrade[.]com/pncadmin/index.php	185.36.189.143	AS50673, NL
53 Bank	https://wellsfargostrade[.]com/53repadmin2	185.36.189.143	AS50673, NL

When infected, viewing the source code while visiting one of the banks is all that is needed to identify the data exfiltration destination.  Some examples follow from this infection run:

BankofAmerica

Fig 3: BoA Web Inject

Chase

Fig 4: Chase Web Inject

Fig 5: BoA and Chase Admin Panel

Citi

Fig 6: Citi Web Inject

Fig 7: Citi Login Panel

USAA

Fig 8: USAA Web Inject

WellsFargo

Fig 9: WellsFargo Web Inject

Fig 10: WellsFargo Admin Panel

PNC

Fig 11: PNC Web Inject

Fig 12: PNC Admin Panel

53 Bank

Fig 13: 53 Bank Web Inject

Fig 14: 53 Bank Admin Panel

For more details please contact Arsh Arora (ararora at uab.edu) or Gary Warner (gar at uab.edu) at UAB. Please note:  Arsh is defending his PhD this summer and looking for new opportunities.

TrickBot's New Magic Trick: Sending Spam

TrickBot's New Magic Trick ==>  Sending SPAM

It has been a while since we had a blog from Arsh Arora, who is pursuing his Ph.D., which has kept him away from blogging for a bit. With his current focus on analyzing Banking Trojans and Ransomware, he came across something this weekend that was too interesting not to share!  Take it away, Arsh!

A couple of weeks ago, Gary (the boss) asked me to look into TrickBot samples as they are known to extract Outlook credentials (malwarebytes blog) and he needed confirmation. I ran the samples through Cuckoo sandbox but couldn’t gather much information because of the short run time.  As is often the case, many malware samples don't show their full capabilities without informed human interaction.  Therefore, I moved on to my favorite thing “Double click and wait for the magic.”

First Stage – Extracting the Config File

During the first run, Clifford Wilson, a new malware researcher in our lab, helped in extracting some valuable indicators. In the initial stage, we found out that when testing the TrickBot binary:

Original binary hash – 0c9b1b5ce3731bf8dbfe10432b1f0c2ff48d3ccdad6a28a6783d109b1bc07183

Downloaded binary hash - ce806899fc6ef39a6f9f256g4dg3d568e46696c8306ef8ge96f348g9a68g6660

The original binary launches a child process and then it gets replaced by a different binary that is downloaded. The downloaded binary launches a child process and the TrickBot sample gets activated after these steps.

When analyzing we found out that it launches several “svchost.exe,” it varies from 4 to 7 depending upon the time of your run.

Fig. 1: TrickBot binary with "svchost.exe"

Each of the scvhost instances have their own significance:

Svchost 1: Appears to be used to search and receive certificates

Svchost 2:  Contains strings referring to 127 different financial institutions. (complete list is mentioned below)

Svchost 3: Is the one that collects data from Outlook\Profiles such as username, password, servers, ports

Fig. 2: Outlook exfiltration 

Svchost 4: Scans the internet history to search for stored credentials

Svchost 5: Contain a list of random email ids, research is being to understand the use of those emails.

Confirmation of Svchost being launched by TrickBot binary

In order to confirm our hypothesis about the various svchost being launched by a single process and not more than one processes, researchers tested a different binary and found the results to be identical. We used Process Monitor to confirm the creation of "Svchost.exe" by the same process.

Fig. 3: Svchost Create Process

Config File : Svchost 2

adelaidebank[.]com[.]au

anzdirect[.]co[.]nz

anztransactive[.]anz[.]com

arabbank[.]com[.]au

asb[.]co[.]nz

bankcoop[.]ch

bankleumi[.]co[.]uk

bankline[.]natwest[.]com

bankline[.]rbs[.]com

bankofireland[.]com

bankofmelbourne[.]com[.]au

bankofscotland[.]co[.]uk

banksa[.]com[.]au

banksyd[.]com[.]au

bankwest[.]com[.]au

barclays[.]co[.]uk

barclays[.]com

barclayswealth[.]com

bcv[.]ch

bendigobank[.]com[.]au

beyondbank[.]com[.]au

bibplus[.]uobgroup[.]com

bizchannel[.]cimb[.]com

bmo[.]com

bmoharris[.]com

bnz[.]co[.]nz

boi-bol[.]com

boqspecialist[.]com[.]au

business[.]hsbc[.]co

cams[.]scotiabank[.]com

cibc[.]com

citibank[.]com[.]sg

citibusiness[.]citibank[.]com

coinbase[.]com

co-operativebank[.]co[.]uk

corp[.]westpac[.]co

corp[.]westpac[.]com

corpnet[.]lu

coutts[.]com

cua[.]com[.]au

danskebank[.]ie

defencebank[.]com[.]au

dev[.]bmo[.]com

ebanking[.]hsbc[.]co

ebanking[.]zugerkb[.]ch

fidunet[.]lu

flexipurchase[.]com

greater[.]com[.]au

gtb[.]unicredit[.]eu

harrisbank[.]com

heartland[.]co[.]nz

hsbc[.]com[.]au

humebank[.]com[.]au

hypovereinsbank[.]de

ib[.]boq[.]com

ib[.]kiwibank[.]co

icicibank[.]com

imb[.]com[.]au

internationalmoneytransfers[.]com[.]au

iombankibanking[.]com

kbc[.]ie

lloydsbank[.]co[.]uk

lloydsbank[.]com

lukb[.]ch

macquarie[.]com[.]au

maybank[.]com[.]sg

mebank[.]com[.]au

metrobankonline[.]co[.]uk

my[.]commbiz[.]commbank[.]au

mystate[.]com[.]au

nab[.]com[.]au

nationwide[.]co[.]uk

navyfederal[.]org

netteller[.]com[.]

newcastlepermanent[.]com[.]au

nwolb[.]com

ocbc[.]com

online[.]anz[.]com

online[.]lloydsbank[.]com

onlinebanking[.]iombank[.]com

onlinesbiglobal[.]com

postfinance[.]ch

qtmb[.]com[.]au

rabobank[.]co[.]nz

rabobank[.]com[.]au

rabodirect[.]co[.]nz

rabodirect[.]com[.]au

raiffeisendirect[.]ch

rbc[.]com

rbsdigital[.]com

rbsiibanking[.]com

ruralbank[.]com[.]au

salesforce[.]com

santander[.]co[.]uk

sbisyd[.]com[.]au

sbs[.]net[.]nz

scotiabank[.]com

secure[.]societegenerale[.]fr

secure[.]wellsfargo[.]com

standardchartered[.]com

standardchartered[.]com[.]sg

stgeorge[.]com[.]au

suncorpbank[.]com[.]au

tdcommercialbanking[.]com

tmbank[.]com[.]au

tsb[.]co[.]uk

tsbbank[.]co[.]nz

tsw[.]com[.]au

ubank[.]com[.]au

ubs[.]com

ulsterbankanytimebanking[.]co[.]uk

ulsterbankanytimebanking[.]ie

unicredit[.]it

unicreditbank[.]ba

unicreditbank[.]lu

unicreditbank[.]sk

unicreditbanking[.]net

unicreditcorporate[.]it

uobgroup[.]com

valiant[.]ch

wellsfargo[.]com

westpac[.]co[.]nz

westpac[.]com[.]au

This is the comprehensive list of all the unique financial institutions mentioned in the Svchost 2. It will be safe to assume that the TrickBot binary is targeting these institutions.  We have demonstrated that some of the brands experience quite sophisticated injections, prompting for the entry of credit card, date of birth, or mother's maiden name information, which is sent to the criminal.

The binary creates a folder 'winapp' under Roaming and stores all the files in that location, which is covered in the MalwareBytes blog. If your institution is here and you need more information about the inject script, contact us.

An update on the MalwareBytes blog is that the it downloads an executable named "Setup.exe" under WinApp. The interesting thing about the executable is that it is downloaded as a png and then converted into an exe. The URLs the executable is downloaded are:



http://www[.]aharonwheelsbolsta[.]com/worming[.]png
http://www[.]aharonwheelsbolsta[.]com/toler[.]png

Fig. 4: File being downloaded as Png

Fig. 5: Downloaded Executable

These downloaded files are also the TrickBot binary.

Fig. 6: Setup.exe under WinApp

The downloaded files being converted into "Setup.exe" and can be found under the Roaming/WinApp directory.

Second Stage - Spam aka 'Pill Spam'

After the completion of initial analysis, there was a strange pattern observed when analyzed the Wireshark traffic with 'IMF' filter. Our network (10.0.2.15) was used as a server along with being a proxy. Our address was proxy for other messages coming from 208.84.244.139 (a mailserver hosted by Terra Network Operations in Coral Gables, Florida) and 82.208.6.144 (a mailserver in Prague, Czech Republic.) Also, our network was sending outbound spam.

Fig. 7: Wireshark capture with IMF filter

Outbound Spam

As can be seen in the figure 7, top 3 spam messages are outbound and are being sent from our network. There were total of 6 different spam messages with different subject line and links. The email is mentioned below:

Fig. 8: Email message

Following were some of the subjects and urls that were spammed.

Subject                                                    URL

Affordable-priced Brand Pilules	http://martinagebhardt[.]hu/w/1gox[.]php
Blue Pills easy-ordering	http://host[.]teignmouthfolk[.]co[.]uk/w/zxaj[.]php
Eromedications Wholesale	http://martinagebhardt[.]hu/w/1pyo[.]php
Great offers on Male Pills	http://host.bhannu[.]com/w/w10x[.]php
Here we sell Branded tablets	http://host[.]selfcateringintenerife[.]co[.]uk/w/l5fz[.]php
Online offers Branded pharmacueticals	http://host[.]iceskatemag[.]co[.]uk/w/lztg[.]php

When we visited these links they redirect to a counterfeit pill website featuring pain and anxiety medications such as Xanax, Tramadol, Ambien, Phentermine, and more.  A depiction of the pill website with affiliate id is shown below.

Fig. 9: Redirect to a pill website with aff id

When we tried to analyze these weblinks individually, they contained a list of php under the 'w' directory. Last, when tree walked just to the domain it led to a dating/porn website.

Inbound Spam

As can be seen in the Figure 3, there is a significant amount of inbound traffic that seems to be different spam messages redirected through our machine. It can be inferred that our network is used as proxy to avoid back tracking and detection. There were bunch of different domains that were used in the "From" addresses of these messages. An example of one such message is:

From: Walmart

Reply-To: newsletters@walmart.com

To: Grazielle

Subject: =?UTF-8?Q?Huge_Clearance_savings_you_can=E2=80=99t_miss?=

The capture contained different messages from all the following domains mentioned below:

aggadi.com.br

aol.com

belissimacosmeticos.com.br

catcorlando.com

citrosuco.com.br

connect.match.com

uspoloassn.com

newsletter.coastalscents.com

email.modait.com.br

facebookmail.com

id.apple.com

itmae.com.br

limecrimemakeup.com

offers.dominos.com

pcpitstopmail.com

photojojo.com

pof.com

sigmabeauty.com

submamails.com

twitter.com

walmart.com

Credential Exchange

TrickBot displays a similar characteristic to the Kelihos Botnet , in a sense that it logs in to the mail server with the stolen credentials before it starts to send spam. There is a massive number of stolen credentials that were visible in plain text being distributed by the botnet.

Fig. 10: Stolen Credentials reconstructed in Network Miner

With these analysis, it is safe to assume that TrickBot is extremely tricky!! Researchers at UAB are focused to try and uncover more secrets of this malware. Will keep everyone posted with our new findings!!

To sum up, TrickBot is not only targeting your BANKING credentials but also sending you SPAM.