11 minhigh
Inside a TrickBot Variant Using DNS Tunneling for C2
FortiGuard Labs identified a TrickBot variant that uses DNS tunneling for C2 communication instead of HTTP, embedding XOR-encrypted data in DNS queries and encoding response payloads within IPv4 address octets. The malware establishes persistence via Windows Task Scheduler disguised as software updates, stores configuration in NTFS Alternate Data Streams, and employs runtime string decryption and hash-based API resolution to evade analysis. Its modular architecture supports process injection (hollowing, doppelgänging), DLL execution via rundll32, PowerShell execution, and raw shellcode execution, retaining the full capability set of the TrickBot family.
Sens:▲ 24h
Showing defanged values
- domainwesturn[.]inC2 domain used for DNS tunneling; encrypted hex-encoded payloads are prepended as subdomains to this domain in malformed DNS queries
- md516efec8d78f9105d9285f6af93327ee3TrickBot DNS tunneling variant sample
- md54d99f6b0e27c9bc29a909a8830082d05TrickBot DNS tunneling variant executable; 64-bit Windows GUI subsystem, entry point 000352A8
- md58d5b3a0512744efc132afa6fc75c64d8TrickBot DNS tunneling variant sample
- md5d2ac351cb04dca722610c1b21e41c216TrickBot DNS tunneling variant sample
- md5e0e4df7e239ccec982e512c6533d84e8TrickBot DNS tunneling variant sample
- md5e14edfa1871deb30208828523164bd4eTrickBot DNS tunneling variant sample
- sha256105f652e6b8f31c371f2385877e43b6772aff5d3168d5d4635f8a1fcbb321421TrickBot variant sample using DNS tunneling for C2 communication
- sha25633c331ededbf8ee9829895424423ce3fd17e359d2e784fcbce396aacff458cf5TrickBot variant sample using DNS tunneling for C2 communication
- sha2563b19a82e1354ac14a3da7c840cbdd0ce50db38432d78e767b36f08e45024c23dTrickBot variant sample using DNS tunneling for C2 communication
- sha2566c677eb2b3ffd288083c59a13d7bb712d4754af61a5563873f76c440962346f4TrickBot variant sample using DNS tunneling for C2 communication
- sha256bf80245ba792992fbfe24abac33f8fd66f24cdeb5f0f21cfdf45a29d107c8d3bTrickBot variant sample using DNS tunneling for C2 communication
- sha256df527a5c2fbde43816cd02f4cd49eee4bb82fb4a3c7045021360888c7d504c98TrickBot variant sample using DNS tunneling for C2 communication
Detection / Hunteropenrouter
What Happened
Security researchers discovered a new version of a well-known malicious software called TrickBot that communicates with its controllers in an unusual way—by hiding data inside ordinary-looking web address lookups (DNS queries) instead of using regular web traffic. This makes the malicious activity much harder to detect with standard network security tools. The malware keeps itself running on infected computers by creating fake scheduled tasks that look like legitimate software updates (for example, pretending to be a Wireshark update). Once installed, it can download additional malicious tools, execute commands, inject code into legitimate programs, and run scripts—all while disguising its communications as normal DNS traffic. Organizations using Windows systems should ensure their security tools can detect DNS tunneling patterns, block the known malicious domain (westurn.in), and hunt for suspicious scheduled tasks with names containing 'autoupdate' combined with random numbers.
Key Takeaways
- TrickBot variant uses DNS tunneling for C2 communication instead of HTTP, embedding encrypted data in DNS queries and response IP addresses to bypass network security controls
- Persistence is achieved via Windows Task Scheduler with disguised task names (e.g., 'Wireshark autoupdate #72784') and configuration stored in NTFS Alternate Data Streams ($TASK, $FILE)
- Malware uses runtime string decryption (SUB/XOR), hash-based API resolution, and XOR encryption (key 0xB9) for DNS tunnel payloads to evade static analysis
- DNS tunneling encodes data as hex subdomains prepended to C2 domain westurn.in, with packet types 0x30 (request), 0x31 (size query), and 0x32 (response data carrying payload in IP address octets)
- Modular architecture supports 12 response commands including process hollowing, process doppelgänging, rundll32 execution, PowerShell execution, and raw shellcode execution
Affected Systems
- Microsoft Windows (64-bit)
- Windows 8 x64
- Windows 10 (misidentified by malware as Windows 8)
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: TrickBot executable launched on victim machine (delivery vector not described in article)
- Persistence: Creates scheduled task disguised as 'Wireshark autoupdate #<random>' via COM ITaskService, triggering every 5 minutes at startup; stores config in NTFS ADS streams $TASK and $FILE
- Obfuscation: Decrypts constant strings at runtime via SUB/XOR; resolves Windows APIs via hash-based lookup function Get_API_By_Hash()
- C2 Communication: When launched with '-u' flag, sends XOR-encrypted (key 0xB9) hex-encoded data as subdomains of westurn.in via DNS queries to 8.8.8.8; receives response data encoded in IPv4 address octets of DNS responses
- Module Execution: Downloads additional modules via command '5'; executes via rundll32 (Control_RunDLL), process hollowing, process doppelgänging, PowerShell through anonymous pipes, or raw shellcode in memory
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
- Platforms: FortiGuard IPS, FortiGuard AntiVirus, FortiGuard Web Filtering, FortiGuard Botnet Domain DB
Fortinet provides IPS signature 'Trick.Botnet' for DNS tunneling detection on FortiGate and FortiNDR, AV signature 'W64/TrickBot.WC!tr' for sample detection, and Web Filtering/Botnet Domain DB coverage for the C2 domain westurn.in. No YARA, Sigma, Snort, Suricata, KQL, SPL, or EQL rules are provided in the article.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | EDR can observe scheduled task creation via COM, rundll32 execution with Control_RunDLL, process injection activities, and NTFS ADS access. However, the DNS tunneling itself occurs at the network layer and may not be fully visible from EDR telemetry alone. Hash-based API resolution and runtime string decryption reduce static indicator visibility. |
| Network Visibility | Medium | DNS queries to westurn.in with long hex-encoded subdomains are visible in DNS logs and network captures. However, the traffic uses standard DNS protocol to a public resolver (8.8.8.8), which may blend in with legitimate DNS traffic. Organizations without DNS query logging or deep packet inspection of DNS responses would miss the encoded payload in response IP addresses. |
| Detection Difficulty | Hard | DNS tunneling is inherently stealthy as it uses standard DNS protocol to public resolvers. The hex-encoded subdomains are long but could be missed without DNS query length monitoring. Response data hidden in IP address octets requires custom parsing logic. Scheduled task names are randomized with legitimate-looking patterns. Runtime API resolution and string encryption defeat static analysis. Process injection techniques (hollowing, doppelgänging) are well-known but still challenging to detect reliably. |
Required Log Sources
- DNS query logs (full query and response with all A records)
- Windows Task Scheduler operational logs (Event ID 4698)
- Process creation logs (Sysmon Event ID 1)
- File stream creation logs (Sysmon Event ID 15 for ADS)
- COM object instantiation logs
- rundll32.exe execution with command-line arguments
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for DNS queries with unusually long subdomain labels (63-char hex strings) sent to the westurn.in domain or similar patterns of hex-encoded subdomains | DNS query logs, passive DNS, full packet capture | C2 Communication (T1071.004, T1572) | Low - legitimate DNS queries rarely use 63-character hex-encoded subdomains; some legitimate services use similar patterns but to different domains |
| Consider hunting for scheduled tasks with names containing 'autoupdate' followed by a '#' and numeric value, particularly those with actions executing executables from non-standard paths with a '-u' parameter | Windows Task Scheduler logs (Event ID 4698), EDR process telemetry, scheduled task command-line logging | Persistence (T1053.005) | Medium - legitimate software update tasks may use similar naming conventions; verify the executable path and signing status |
| Consider hunting for NTFS Alternate Data Streams named $TASK and $FILE on executable files, particularly in user-writable directories | Sysmon Event ID 15 (FileStreamCreated), filesystem auditing, EDR file stream monitoring | Persistence / Defense Evasion (T1564.003) | Low - ADS usage on executables is uncommon in normal operations |
| Consider hunting for rundll32.exe executions invoking the Control_RunDLL export function on DLLs in temporary or user-writable paths | Process creation logs with command-line (Sysmon Event ID 1), EDR process telemetry | Execution (T1218.011) | Medium - some legitimate installers use rundll32 with Control_RunDLL; focus on DLLs in temp/appdata paths |
| Consider hunting for DNS responses containing an unusually high number of A records (60+ IP addresses) in a single response, which may indicate encoded payload delivery via DNS tunneling | Full packet capture, DNS response logging with record counts, network IDS with DNS anomaly detection | C2 Communication (T1071.004) | Low to Medium - some legitimate CDN or round-robin DNS configurations return multiple A records but rarely 60+ |
Control Gaps
- Standard DNS firewall rules allowing queries to public resolvers (e.g., 8.8.8.8) would not block this traffic
- Signature-based AV may miss samples due to runtime string decryption and hash-based API resolution
- Network firewalls allowing outbound DNS (port 53) would not inspect or block the tunneled C2 data
- DNS response inspection is rarely performed by standard security controls, allowing payload delivery via IP address octets to go undetected
Key Behavioral Indicators
- Scheduled task creation via COM object with ProgID 'Schedule.Service.1' from a non-system process
- Task names matching pattern '<foldername> autoupdate #<digits>' with 5-minute repeat triggers
- NTFS ADS streams named $TASK and $FILE created on executable files
- rundll32.exe executing DLLs from temporary paths with Control_RunDLL export
- DNS queries with subdomains exceeding 60 characters of hex-encoded data
- DNS responses containing 60+ A records in a single response packet
- Process ancestry showing TrickBot executable launched with '-u' parameter followed by DNS query activity
- Executable files named with 8-character hex prefixes (e.g., 4d99f6b.exe) in non-standard drive paths
False Positive Assessment
Low - The combination of DNS tunneling to westurn.in, scheduled tasks named with 'autoupdate #<digits>', NTFS ADS streams named $TASK/$FILE, and rundll32 executing DLLs from temp paths creates a highly specific detection profile. Individual indicators may have moderate FP risk, but the composite pattern is unlikely to appear in legitimate activity.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider blocking the domain westurn.in at DNS resolver/firewall level and hunting for DNS tunneling patterns in your environment.
- If your EDR supports it, consider searching for scheduled tasks with names matching 'autoupdate #' patterns and validating the associated executable paths.
- Consider searching DNS logs for queries to westurn.in or queries with subdomains containing long hex-encoded strings (63-char segments separated by periods).
- If applicable, consider deploying the FortiGuard IPS signature 'Trick.Botnet' or equivalent DNS tunneling detection rules on your network IDS/IPS.
Infrastructure Hardening
- Consider implementing DNS tunneling detection on your recursive DNS resolvers or DNS firewall (e.g., monitoring for high-entropy subdomains, unusually long query names, or excessive A records in responses).
- Evaluate whether restricting outbound DNS to only approved internal resolvers would be feasible, preventing direct queries to public resolvers like 8.8.8.8 from endpoints.
- Consider enabling DNS response inspection to flag responses with abnormally high A record counts (60+ IP addresses).
- If supported by your SIEM or DNS monitoring tool, consider alerting on DNS queries with subdomain labels exceeding 50 characters.
User Protection
- Consider deploying endpoint detection rules for NTFS Alternate Data Stream creation on executable files, particularly streams named $TASK or $FILE.
- If your EDR supports behavioral detection, consider enabling or tuning rules for scheduled task creation via COM objects from non-system processes.
- Consider blocking or alerting on rundll32.exe executions that invoke Control_RunDLL on DLLs located in temporary or user-writable directories.
Security Awareness
- Consider incorporating DNS tunneling awareness into existing security operations training, emphasizing that DNS is not inherently safe just because it uses a standard protocol.
- If your organization has a threat intelligence subscription, consider adding westurn.in and TrickBot DNS tunneling indicators to watchlists.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping10 techniques
Tactic
Privilege Escalation
Tactic
Stealth
Tactic
Command and Control
Additional IOCs
- File Hashes:
4d99f6b0e27c9bc29a909a8830082d05(MD5) - TrickBot DNS tunneling variant executable; 64-bit Windows GUI subsystem, entry point 000352A88d5b3a0512744efc132afa6fc75c64d8(MD5) - TrickBot DNS tunneling variant sample16efec8d78f9105d9285f6af93327ee3(MD5) - TrickBot DNS tunneling variant sampled2ac351cb04dca722610c1b21e41c216(MD5) - TrickBot DNS tunneling variant samplee0e4df7e239ccec982e512c6533d84e8(MD5) - TrickBot DNS tunneling variant samplee14edfa1871deb30208828523164bd4e(MD5) - TrickBot DNS tunneling variant sample
- File Paths:
E:\4d99f6b.exe- TrickBot executable path used in scheduled task action; filename derived from MD5 hash prefix
- Command Lines:
- Purpose: Persistence via scheduled task creation disguised as software update | Tools:
COM ITaskService,CoCreateInstance,Schedule.Service.1| Stage: Persistence |schtasks /create /tn <taskname> /tr <exe path> -u - Purpose: Execute downloaded DLL module via rundll32 invoking Control_RunDLL export | Tools:
rundll32.exe,CreateProcessW| Stage: Execution |rundll32.exe <dll_path>,Control_RunDLL - Purpose: Trigger DNS tunneling C2 communication mode | Tools:
TrickBot executable| Stage: C2 |<exe_path> -u
- Purpose: Persistence via scheduled task creation disguised as software update | Tools:
- Other:
$TASK- NTFS Alternate Data Stream name used by TrickBot to store Base64-encoded scheduled task name on its own executable$FILE- NTFS Alternate Data Stream name used by TrickBot to store Base64-encoded full executable path on its own executabletcp469A.dll- Downloaded malicious DLL module executed via rundll32.exe; attacker-chosen filenameanchor_dns- Campaign or group identifier embedded in TrickBot C2 command packet structure