Full Report
TrickBot has unleashed yet another module in its growing arsenal specifically targeting firmware vulnerabilities, named TrickBoot.
Analysis Summary
# Tool/Technique: TrickBoot
## Overview
TrickBoot is a specialized reconnaissance and exploitation module within the **TrickBot** malware ecosystem. Its primary purpose is to target the Unified Extensible Firmware Interface (UEFI) and BIOS of a host. By interacting with the firmware, it allows attackers to achieve extreme persistence that survives operating system reinstalls and hard drive replacements, or potentially "brick" the device by erasing the firmware.
## Technical Details
- **Type:** Malware Module (part of the TrickBot family)
- **Platform:** Windows-based systems (targeting UEFI/BIOS firmware)
- **Capabilities:** Firmware vulnerability scanning, SPI controller interaction, reading/writing/erasing firmware.
- **First Seen:** Approximately October 2020 (identified/reported December 2020)
## MITRE ATT&CK Mapping
- **TA0003 - Persistence**
- T1542.001 - Pre-OS Boot: System Firmware
- **TA0007 - Discovery**
- T1518 - Software Discovery
- **TA0040 - Impact**
- T1495 - Firmware Corruption
- T1485 - Data Destruction
## Functionality
### Core Capabilities
- **Firmware Reconnaissance:** Uses the `RwDrv.sys` driver (from the RWEverything tool) to interact with the SPI controller to check if the BIOS control register is write-protected.
- **Vulnerability Identification:** Specifically looks for misconfigured or unprotected UEFI/BIOS firmware that allows unauthorized writes.
- **Data Exfiltration:** Identifies the specific hardware and firmware versions to report back to the Command and Control (C2) server.
### Advanced Features
- **Persistence for Persistence:** By targeting the firmware, the malware can reinstall itself or maintain access even if the OS is reinstalled or the physical drive is replaced.
- **Destructive Potential:** The module has the capability to erase firmware (SPI flash), effectively "bricking" the hardware and rendering the physical asset useless until manually reflashed by hardware tools.
- **Subversion of Security:** By running at the firmware level, it can execute code before the OS boots, allowing it to bypass or disable higher-level security controls (EDR/Antivirus).
## Indicators of Compromise
- **File Hashes (RwDrv.sys):**
- SHA256: `65243c3d25807908b98165b45281896740623f990a424a7375a0cf0757a3e639` (Common for RWEverything driver)
- **File Names:**
- `RwDrv.sys`
- `injectDll32` / `injectDll64` (Standard TrickBot modules)
- **Service/Task Names:**
- `AdvancedLocTechnic`
- `SystemTechGatService`
- **Behavioral Indicators:**
- Unexpected loading of the RWEverything driver.
- Presence of randomly named scheduled tasks in `%APPDATA%` subdirectories.
## Associated Threat Actors
- **Wizard Spider** (The primary group behind TrickBot)
- Often delivered via **Emotet** (Mummy Spider)
## Detection Methods
- **Signature-based detection:** Monitoring for the specific hash of `RwDrv.sys` and TrickBot's statically named modules.
- **Behavioral detection:** Monitoring for unauthorized attempts to access the SPI controller or BIOS control registers.
- **Firmware Integrity Monitoring:** Using tools like CHIPSEC to verify the integrity of the UEFI/BIOS and check for unexpected modifications.
## Mitigation Strategies
- **Firmware Hardening:** Ensure BIOS/UEFI write protection is enabled (BIOS Lock Enable and BIOS Write Enable configurations).
- **Patching:** Keep system firmware and UEFI/BIOS updated to the latest versions provided by the manufacturer.
- **Privilege Management:** Minimize administrative permissions to prevent the installation of the drivers necessary to interface with hardware.
- **Defense in Depth:** Use email filtering and user awareness training to block the initial Emotet/TrickBot infection vector.
## Related Tools/Techniques
- **RWEverything (Read Write Everything):** A legitimate utility whose driver is abused by TrickBoot to access hardware registers.
- **LoJax:** The first known UEFI rootkit used in the wild by Sednit (APT28).
- **MosaicRegressor:** Another UEFI-based malware framework.