TrickGate

We monitor the packed samples spreading mainly via phishing emails with malicious attachments, but also via malicious links.

We monitor the packed samples spreading mainly via phishing emails with malicious attachments...

...but also via malicious links.

We noticed 3 different types of code language used for the shellcode loader. NSIS script, AutoIT script and C all implement similar functionality.

We noticed 3 different types of code language used for the shellcode loader. NSIS script, AutoIT script and C all implement similar functionality.

Injection using direct kernel calls... Dynamically retrieve the kernel syscall numbers. Invoke the desired syscalls. | The loader utilizes many native API calls which take a memory address as an argument of a callback function.

FEB 24, 2022 Figure 4 – LNK flow RAR: ... LNK: ... URL: jardinaix[.]fr/w.exe EXE ...

Of particular interest was the presence of CreateProcessW, VirtualAlloc and ReadProcessMemory, as well as GetThreadContext and SetThreadContext. These APIs are commonly associated with process injection... | Based on the presence of VirtualProtect and DllCallAddress, we made the safe assumption that it was executable code, likely in the form of shellcode.

After decrypting the payload, the shellcode then injects it into a newly created process. After the process is created using the create_suspended flag... NtUnmapViewOfSection NtWriteVirtualMemory NtResumeThread

FEB 24, 2022 Figure 4 – LNK flow RAR: ... LNK: ... URL: jardinaix[.]fr/w.exe EXE ...

The packer... makes it harder for antivirus programs to detect the malicious code... TrickGate always changes the way the payload is decrypted... Most of the samples use a custom decryption method...

Initially observed in July 2016, TrickGate is a shellcode-based packer offered as a service to hide malware from EDRs and antivirus programs.

When we analyzed the TrickGate code, no constant strings can be found... To hide the needed strings and its intentions, TrickGate uses a common technique called API hashing...

The first stage mainly comes in the form of an archived executable, but we monitored many file types and delivery permutations... Executable : BAT * CMD * COM * EXE * LNK * PIF * SCR. Document : DOC * DOCX * PDF * XLL * XLS * XLSX * RTF.

Of particular interest was the presence of CreateProcessW, VirtualAlloc and ReadProcessMemory, as well as GetThreadContext and SetThreadContext. These APIs are commonly associated with process injection... | Based on the presence of VirtualProtect and DllCallAddress, we made the safe assumption that it was executable code, likely in the form of shellcode.

After decrypting the payload, the shellcode then injects it into a newly created process. After the process is created using the create_suspended flag... NtUnmapViewOfSection NtWriteVirtualMemory NtResumeThread

The Shellcode loader usually contains a single function which is responsible for decrypting and loading the shellcode into memory... Decrypt the shellcode.

In the more recent versions of TrickGate, the shellcode loader abuses the “Callback Functions” mechanism... Instead of the Callback Function, the loader passes on the address of the newly allocated memory which holds the shellcode.

Speakeasy confirmed that the code would execute, but it terminated immediately after calling GetTickCount and Sleep. This is a common anti-analysis trick used by malware to defeat emulators and sandboxes.

Allocate memory for the shellcode, usually by calling VirtualAlloc. Decrypt the shellcode. Trigger the shellcode.

Speakeasy confirmed that the code would execute, but it terminated immediately after calling GetTickCount and Sleep. This is a common anti-analysis trick used by malware to defeat emulators and sandboxes.