Anthony, N., Pascual, C.. (2018, November 1). Trickbot Shows Off New Trick: Password Grabber Module. Retrieved November 16, 2018.
Not cited by any technique.
None recorded.
None recorded.
None recorded.
| Technique | Used by | Procedure example |
|---|---|---|
| T1016 System Network Configuration Discovery |
MalwareTrickBot | TrickBot obtains the IP address, location, and other relevant network information from the victim’s machine. |
| T1083 File and Directory Discovery |
MalwareTrickBot | TrickBot searches the system for all of the following file extensions: .avi, .mov, .mkv, .mpeg, .mpeg4, .mp4, .mp3, .wav, .ogg, .jpeg, .jpg, .png, .bmp, .gif, .tiff, .ico, .xlsx, and .zip. It can also obtain browsing history, cookies, and plug-in information. |
| T1087.001 Local Account |
MalwareTrickBot | TrickBot collects the users of the system. |
| T1087.003 Email Account |
MalwareTrickBot | TrickBot collects email addresses from Outlook. |
| T1112 Modify Registry |
MalwareTrickBot | TrickBot can modify registry entries. |
| T1185 Browser Session Hijacking |
MalwareTrickBot | TrickBot uses web injects and browser redirection to trick the user into providing their login credentials on a fake or modified web page. |
| T1543.003 Windows Service |
MalwareTrickBot | TrickBot establishes persistence by creating an autostart service that allows it to run whenever the machine boots. |
| T1552.001 Credentials In Files |
MalwareTrickBot | TrickBot can obtain passwords stored in files from several applications such as Outlook, Filezilla, OpenSSH, OpenVPN and WinSCP. Additionally, it searches for the ".vnc.lnk" affix to steal VNC credentials. |
| T1555.003 Credentials from Web Browsers |
MalwareTrickBot | TrickBot can obtain passwords stored in files from web browsers such as Chrome, Firefox, Internet Explorer, and Microsoft Edge, sometimes using esentutl. |
| T1685 Disable or Modify Tools |
MalwareTrickBot | TrickBot can disable Windows Defender. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
