Adhoc TrickBot Analysis - 1000238

As discussed previously, while TrickBot issues configurations (mcconf) for different campaigns (group tags) under each version number, the command and control (C2) server lists for these campaigns are usually the same for a particular version.

There have been times when multiple server lists have been seen for a particular version number of mcconf, with such occurrences having one of two explanations:

1. One reason is that the distinct lists are from distinct botnets. While there is a core TrickBot botnet (iteration A through the version numbers), so far several others have been seen active for periods of time. 
2. However, in some cases the TrickBot operators have simply, presumably unintentionally, created discrepancies in configs - I refer to these as 'fumbles'.

Version 1000238, from 26th July 2018 may have seen just such a fumble.

While the test 'tt0002' gtag for this version was distributed with a distinct C2 server list compared to 1000237 (thanks to @JR0driguez for the share), one researcher (@James_inthe_box) shared a 'ser0726us' gtag for version 1000238 that had a C2 server list matching that of 1000237. In contrast, two other 1000238 mcconfs shared since had the 'tt0002' C2 server list - and one of these was a second copy of 'ser0726us' (shared by @MalHunters). The other was for gtag 'sat25' and was shared by @James_inthe_box.

Figure 1 illustrates the differences, most notably with the additional entry present in the 'tt0002', second 'ser0726us', and 'sat25' gtag 1000238 configs. I've highlighted key entries to aid a more detailed review.

Figure 1 - C2 Server Lists for Versions 1000237 and 1000238

At this time, the initial 'ser0726us' looks to have been a fumble - a premature release without updates to the C2 server list.

However, I shall monitor for subsequent distinct versions indicative of a new botnet.

Adhoc TrickBot Analysis - 1000160

As discussed previously, while TrickBot issues configurations (mcconf) for different campaigns (group tags) under each version number, the command and control (C2) server lists for these campaigns are usually the same for a particular version. In December 2017 a version 1000105 was seen with two different C2 server lists. However, as I discussed the variations looked to be typographical in nature.

Version 1000160, from 28th March 2018, is the only other time (so far shared) that two different C2 server lists have been seen for a single version of mcconf (within a single iteration of the version numbers - see below). However, in this case the two server lists are dramatically different. The test list (and an exact copy used for gtag 'ser0329a') look to continue the iteration A sequence of versions, with C2 servers which share a good number of entries with those from versions 1000159 and 1000161 (as seen in the image below). The config shared by @Ring0x0 for gtag 'uk03-1', however, contains very different servers; and only one of these, 185.146.156.247:443, has been seen at any time before. (The other configs were shared by @JR0driguezB - thanks, as always.)

This variant C2 server list is obviously not a typographical error, and further demonstrates that the threat actors behind TrickBot have the ability (if not normally the need) to distribute custom C2 server lists for individual campaigns, and possibly infections.

Now, the threat actors behind TrickBot already operate two distinct 'botnets' of infections. With the primary iteration of version updates (which I call iteration A) having begun at version 1000002 (if there was a 1000001 then it has never been shared publicly) and continued through 1000160 up to the current latest version of 1000169. In the week commencing 18th December 2017 I identified a second iteration (iteration B) in shared mcconfs, and have since been shared data for 1000013 through 1000068, as shown in the following graph.

It is unlikely that this second version 1000160 config relates to the iteration B botnet. Firstly, iteration B has not been updated since the change to 1000068 on 28th February 2018. Secondly, the jump from 1000068 to 1000160 would skip a large number of version numbers for no obvious reason (although it feasibly could be done in error). Whether it indicates the start of a new iteration is unclear at this time.

***
Update: In fact this second 1000160 config did identify the start of a third infection network; the tracking of this third botnet (iteration C) begins here.
***

Adhoc TrickBot Analysis - 1000105

If you've studied TrickBot at all then you'll know that instances of the Banking Trojan get their tier 1 command and control (C2) server list from an encrypted configuration which is packed into the resource section of an MS-DOS MZ executable file. Once decrypted, for example using @hasherezade's useful Python script (as shown in their unpacking demo), the configuration is XML with an outermost <mcconf> tag -- hence the name 'mcconf' is frequently used to refer to TrickBot's configurations.

The mcconf contains the configuration version and the group tag (which identifies the campaign), along with a list of C2 servers.

• <ver>[0-9]{7}</ver>
• <gtag>[a-z]{2,8}[0-9]{0,4}[a-z]?</gtag>

Multiple campaigns (i.e., gtags) may employ mcconf with the same version number, and in so doing (usually) employ the same list of C2 servers. However, recently several researchers (@JR0driguezB and @Techhelplistcom) shared two campaign mcconfs for version 1000105; these contained two server differences which look like typographical errors. 

Apart from the fact that the two servers had one digit different off the first quad of the IP address, the likelihood of these being typos is increased by the following observations:

1. No other occurrences of 2.x.y.z or 7.x.y.z subnets are present amongst the 1,111 server IP addresses in shared mcconfs;
2. The 7.x.y.z subnet is registered to the DoD Network Information Center (DNIC) and the IP address 7[.]46.133.10 is not found amongst BGP routes.

As with much malware analysis, the actual cause may never be clear to anyone other than the threat actors themselves. It is highly likely that those behind TrickBot employ some automation to produce their components, given the rate at which new versions of configuration are produced and deployed. However, it is also clear that some operator decisions and actions are involved. One only has to review the progression of gtag campaign identifiers to see numbering changes indicative of manual processing.

Adhoc TrickBot Analysis - Discovery rate 1000032 to 1000076

The following graph shows the rate of discovery of TrickBot Banking Trojan versions in the wild, based on shared mcconfs. This graph covers versions 1000032 (04-Aug-2017) to 1000076 (25-Oct-2017).

Note: The flatter the line, the more frequently versions are discovered.

Thanks to @mpvillafranca94, @VK_Intel, @K_N1kolenko, @hasherezade, @ArnaudDlms, @StackGazer, @0bscureC0de, @voidm4p, @James_inthe_box, @MakFLwana, @spalomaresg, and @virsoz, for sharing the mcconfs.

Adhoc TrickBot Analysis - to 1000062

Following on from my initial adhoc analysis, the following graph shows the number of server entries using ports 443 and 449 across 43 versions of the TrickBot Banking Trojan, up to 1000062.

In addition, the following table shows the breakdown of detected TrickBot campaign 'gtag' (group tags) values used in the 83 mcconfs analysed. (Note: I've analysed multiple mcconfs with the same version number, and in each case the server list is the same for a particular version.)

The following table shows the IP usage across the 43 TrickBot versions.

Lastly, the following table shows the top 25 servers used within the 43 versions.

Thanks to @VK_Intel, @mpvillafranca94, @ArnaudDlms, and @James_inthe_box for providing the configurations.

Initial Adhoc TrickBot Analysis - SRV port usage

Here's some initial analysis of the TrickBot Banking Trojan's command and control (C2) server entries in its 'mcconf'. The graph shows the number of server entries using ports 443 and 449 across 26 version, up to 1000062.

Thanks to @VK_Intel for providing the configurations.