{
  "family": "hptrickbot",
  "sample_count": 1,
  "category": "ransomware",
  "description": "Trojan:Win32/Hptrickbot is a heuristic detection associated with Trickbot, one of the most prolific and dangerous banking trojans and botnets in history. Originally designed to steal financial credentials via web injects, Trickbot evolved into a highly modular, enterprise-level Initial Access Broker (IAB). It is infamous for breaching corporate networks, moving laterally, and ultimately deploying devastating ransomware like Ryuk or Conti.<br><br><b>Understanding Hptrickbot (Trickbot)</b><br>To an end-user, the initial infection is invisible. For a SOC analyst, a Trickbot detection is a 'Drop Everything' tier-one incident. If Trickbot is on a host, it means the attackers are actively mapping the network and preparing for domain-wide ransomware deployment.<br><br><b>Execution and Lateral Movement Mechanics</b><br>Trickbot typically arrives via malspam (often delivered by Emotet) containing malicious macros (`T1566.001`). Upon execution, it disables Windows Defender (`T1562.001`) and drops its main payload into `%AppData%`. Trickbot is heavily modular. It downloads modules to steal credentials from browsers (`T1552`), scrape active directory using LDAP queries (`T1087.002`), and harvest emails. Crucially, it uses the stolen credentials and tools like PsExec or WMI (`T1047`) to move laterally across the network (`T1021.002`), infecting other hosts and domain controllers.<br><br><b>Indicators of Compromise & Impact</b><br>The impact ranges from massive credential theft to total domain compromise and ransomware. Host-based IoCs include the presence of a scheduled task named after a random string, the execution of `svchost.exe` without command-line arguments (process hollowing), and the presence of modular DLLs in the `%AppData%` folder. Network IoCs involve DNS queries for known Trickbot C2 infrastructure and sudden, anomalous SMB traffic (lateral movement) originating from the infected host.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1552",
    "T1021.002",
    "T1055"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1055",
      "name": "Process Injection (Trickbot relies heavily on injecting into svchost.exe)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1021.002",
      "name": "Remote Services: SMB/Windows Admin Shares (Moving laterally to other hosts)",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1552",
      "name": "Credentials In Files (Stealing passwords to enable lateral movement)",
      "tactic": "Credential Access"
    }
  ],
  "containment_steps": [
    "Isolate the infected endpoint IMMEDIATELY; do not wait to analyze it, as Trickbot moves laterally very quickly.",
    "Initiate a domain-wide password reset for any user who logged into the infected host, particularly domain administrators.",
    "Hunt across the network for signs of lateral movement (e.g., suspicious PsExec usage or WMI execution) originating from the patient zero.",
    "Verify that no ransomware payload (like Ryuk) has been staged on domain controllers or file servers."
  ],
  "what_to_avoid": [
    "Do not assume containing one host stops the attack; Trickbot is designed to spread, and you must assume the network is compromised until proven otherwise.",
    "Avoid relying solely on traditional AV to clean Trickbot; it often leaves persistence mechanisms that require forensic removal."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}