(Aaron) So TrickBot malware doesn't really discriminate, right?
And once on your system, it's then going to download modules.
And we had discussed, too, that to get this analysis to work properly,
you had to like let your system dwell for awhile because it takes a
little time to download these different modules?
(Tyler) Yeah, yeah.
TrickBot, when it first runs, it's going to get in there,
it's going to do some things, but it's going to sleep for a little bit.
It's going to wait for awhile before it actually starts really doing anything.
So most malware, when you're running it,
when you're analyzing it,
you'll get to a point where you'll maybe run it for 2 or 3 minutes,
maybe 5 minutes.
TrickBot, you kind of have to let it run for 10,
15, 20 minutes at least in order to let it kind of start really,
really doing its stuff.
And the way that it works is it will go out to a
number of command and control channels, servers on the internet,
and it will start downloading modules.
And these modules are encrypted per machine,
so in other words if my system were to get infected and
your system were to get infected, and they downloaded the same modules,
the modules would actually look different because each module is
encrypted based on a key that's generated per each machine.
(Aaron) The key is generated on the machine?
(Tyler) On the machine itself, yes.
(Aaron) Wow, okay.
That's interesting.
Is modularized malware and kind of encrypted per machine
malware more of a trend that we're seeing now?
(Tyler) Modularized malware has been around for a while.
It's definitely something that has gone on for a time.
The encrypted per machine though, that's definitely a trend.
Before TrickBot, I think there were some malware that did it,
but it was really rare.
The fact that TrickBot does this and is so prevalent in the industry,
it's so popular with malware authors or attackers,
I think we're going to start seeing this trend as we move forward.
(Aaron) This isn't necessarily my specific area of expertise,
especially when we get into like reversing and debugging stuff,
but I tried ahead of this to impress you,
and failed miserably, but downloaded a sample TrickBot,
right?
And it was interesting, we can talk about how it didn't get to the point,
because TrickBot takes a while to do its thing.
Nothing in the name like hybrid analysis or VirusTotal,
or ANY.RUN,
got to a point where it actually downloaded anything or even completed anything.
So that kind of speaks to why we're here needing to do
this dynamic analysis on our own devices,
right?
But I did actually debug some of this and got to look through everything.
It turns out like every single function is encrypted,
just like we expected it to be.
So it wasn't really, even after unpacking,
there wasn't a lot of information to be gained from this.
I did identify,
and we talked about this in setting up our virtual machine malware analysis lab,
I did identify that it nearly was one of the only functions I
could properly identify is DebuggerPresent.
So I got that, here's a little IDA Pro snapshot,
hopefully I get some kudos, we'll see.
(Tyler) Oh yeah, absolutely.
(Aaron) That only took me 5 hours.
(Tyler) And TrickBot does have a lot of protections in place,
and unless you're a, I think,
a dedicated reverse engineer and you have time and experience on your side,
TrickBot is one of those which it might be a bit more
difficult to look at it from that perspective.
Now fortunately,
there are a lot of ways that we can still analyze
TrickBot and see what it's doing, where it's contacting,
and even decrypting its configuration files,
and its modules that it's downloading so we can see
at least where on the network, on the internet,
that it's communicating with.
(Aaron) Yeah, that's awesome.
I'm super excited to get into that.
If we pop up ANY.RUN here,
and here is one of the hashes that was a TrickBot sample,
and we take a look at what it did.
It essentially tried to disable Windows Defender,
which we have talked about, we've seen it doing that.
(Tyler) Yeah, TrickBot does not like Windows Defender.
In fact,
one of the recent analysis I read about it said that TrickBot has just
added a dozen new ways to disable Windows Defender.
So it's definitely trying to get rid of that anti-virus
that comes with all Windows systems now.
(Aaron) Who knew there were so many ways to disable Windows Defender.
(Tyler) Oh yeah, yeah.
(Aaron) But yeah, and then from this I really got not much else.
Because it knew it was on an environment that was
meant for analyzing its behavior, there's no packet traffic,
it essentially attempts to disable Windows Defender,
and then I'm pretty sure we time out on any runs,
like back end, so it's not going to download any modules,
we don't really get much else out of this.
(Tyler) Yeah, the thing you have to remember about online sandboxes,
like ANY.RUN or even VirusTotal,
because VirusTotal will do some behavioral analysis now,
is that it's very easy for attackers to go in and kind of
fingerprint them to figure out what it looks like when
they're in one of these sandboxes,
so there's definitely these anti-sandbox techniques in malware,
and I'm sure TrickBot is using them.
And like you said, ANY.RUN is only going to run it,
it says there, for 60 seconds.
So,
that is definitely not long enough for even TrickBot to kind of
get to its full installation on the system.
It usually takes you 2 or 3 minutes for it to do that.
(Aaron) That was actually one of the only other functions
to be able to identify is that it actually uses the wait
function quite a bit to wait, probably to time out on things like this.
Once we're 60 seconds,
nothing happens and any automated malware analysis is probably going to say oh,
we're done.
(Tyler) That's exactly it.
You know, if you use an automated malware analysis system,
even something like Cuckoo Sandbox that you would set up,
you have timeouts in there.
Maybe it's 5 minutes, maybe it's 10 minutes,
but it's definitely going to be shorter than what TrickBot is willing to wait.
It knows that if it gets on a real system,
if it wastes 20 minutes that's no big deal to it,
20 minutes from now,
it's going to still be able to do its stuff if it's a real system.
(Aaron) So, ANY.RUN is using Windows 7,
and we talked about it's important to figure out what OS we want to use,
so as we get into this analysis in the upcoming modules,
what OS did you decide to use for this?
(Tyler) So, I'm using Windows 7, and there's a very specific reason for that.
So, TrickBot will run on Windows 7 or Windows 10,
but there's been a recent change in TrickBot to
where if it's running on Windows 10, it will still download the modules,
but it keeps them in memory.
Those modules never touch disk.
(Aaron) Seriously?
(Tyler) So,
it then becomes very difficult for an analyst to
see what modules were downloaded, what the configurations for them were,
really the only way to do that at that point is to either have network
monitoring set up in place or to do memory analysis.
So,
instead what we're going to do is we're going to use Windows 7 because on
Windows 7 TrickBot still goes and downloads the modules to disk,
just so we can see what they look like, how we can decode them,
and so on.
(Aaron) Yeah,
they're going to be the same modules that are in there on
Windows 10 with the same functions.
(Tyler) Yeah, exact same ones.
(Aaron) So it's behaviorally no different,
the indicators that we're getting are no different.
So there's no reason to be like a malware reversing purist.
Our whole goal is to get to where we can just detect
it on the rest of the network.
(Tyler) Exactly.
We're just going to make it easy for us.
(Aaron) Awesome.
I'm really looking forward to getting into that,
and if you missed how to set up the malware analysis
sandbox that we're going to be using,
go ahead and check out a Play by Play for setting up
the malware analysis sandbox lab, right?
(Tyler) Right.