TrickBot¶
Open Target Process (OpenProcess)
Allocate memory (VirtualAllocEx)
Copy function into allocated memory (WriteProcessMemory)
Copy shellcode into allocated memory (WriteProcessMemory)
Flush cache to commit changes (FlushInstructionCache)
Create a remote thread (CreateRemoteThread)
Resume the thread or fallback to create a new user thread (ResumeThread or RtlCreateUserThread)
Resources¶
Most recent first:
Trickbot¶
VB2017: Turning Trickbot: decoding an encrypted command-and-control channel
Sentinel:How TrickBot Malware Hooking Engine Targets Windows 10 Browsers