Cyberreason Anchor December 2019

TrickBot can use secondary C2 servers for communication after establishing connectivity and relaying victim information to primary C2 servers.

Anchor can use secondary C2 servers for communication after establishing connectivity and relaying victim information to primary C2 servers.

Cobalt Strike can determine the NetBios name and the IP addresses of targets machines including domain controllers.

TrickBot obtains the IP address, location, and other relevant network information from the victim’s machine.

TrickBot can enumerate computers and network devices.

Anchor has obfuscated code with stack strings and string encryption.

Anchor has come with a packed payload.

TrickBot can identify the user and groups the user belongs to on a compromised host.

The TrickBot downloader has used an icon to appear as a Microsoft Word document.

TrickBot can send information about the compromised host and upload data to a hardcoded C2 server.

Anchor can create a scheduled task for persistence.

TrickBot injects into the svchost.exe process.

Cobalt Strike can execute a payload on a remote host with PowerShell. This technique does not write any data to disk. Cobalt Strike can also use PowerSploit and other scripting frameworks to perform execution.

Anchor has used cmd.exe to run its self deletion routine.

TrickBot can identify the groups the user on a compromised host belongs to.

Anchor can self delete its dropper after the malware is successfully deployed.

Anchor has used HTTP and HTTPS in C2 communications.

TrickBot uses HTTPS to communicate with its C2 servers, to get malware updates, modules that perform most of the malware logic and various configuration files.

Variants of Anchor can use DNS tunneling to communicate with C2.

TrickBot gathers the OS version, machine name, CPU type, amount of RAM available, and UEFI/BIOS firmware information from the victim’s machine.

Cobalt Strike can determine if the user on an infected machine is in the admin or domain admin group.

Anchor has used ICMP in C2 communications.

Anchor can download additional payloads.

TrickBot can Base64-encode C2 commands.

TrickBot decodes the configuration data and modules.

TrickBot has attempted to get users to launch malicious documents to deliver its payload.

Anchor can terminate itself if specific execution flags are not present.

TrickBot can gather information about domain trusts by utilizing Nltest.

Anchor can establish persistence by creating a service.

TrickBot can obtain passwords stored in files from several applications such as Outlook, Filezilla, OpenSSH, OpenVPN and WinSCP. Additionally, it searches for the ".vnc.lnk" affix to steal VNC credentials.

Anchor has been signed with valid certificates to evade detection by security tools.

TrickBot has come with a signed downloader component.

TrickBot can obtain passwords stored in files from web browsers such as Chrome, Firefox, Internet Explorer, and Microsoft Edge, sometimes using esentutl.

TrickBot can steal passwords from the KeePass open source password manager.

Anchor has used NTFS to hide files.

TrickBot has been delivered via malicious links in phishing e-mails.

Anchor can create and execute services to load its payload.