TrickBot Loader - Fragmented Memory Analysis

---

🧩 Overview

This repository documents the in-depth reverse engineering of a Go-based TrickBot loader. The analysis reveals that instead of unpacking into a single PE, the loader fragments its payload across multiple memory regions and system DLLs (e.g., powrprof.dll, apphelp.dll, umpdc.dll), leveraging anti-analysis and hooking techniques.

All research was conducted in an isolated environment with no network exposure.

---

🧰 Tools Used

Procmon · Process Explorer · Sysmon · Wireshark/FakeNet · x64dbg · Scylla · PE-bear · DIE · HxD · Strings

---

🧠 Key Findings

1. Fragmented Runtime

• No single "final PE" file was found - memory regions across .rdata/.idata and private RWX blocks each held portions of the runtime.
• Key Go runtime artifacts: pclntab, runtime.main, and packages like gorilla/websocket, crypto/tls, gopsutil.

Memory fragmentation

---

2. Anti-Analysis & Hooking

• Hooked APIs: NtQuerySystemInformation, NtWriteVirtualMemory, NtCreateThreadEx, etc.
• Detected tools: x64dbg, IDA, Scylla, Procmon, WinDbg, OllyDbg.
• Demonstrates an advanced anti-RE shield using API patching and tool scanning.

Hooked functions

---

3. Networking & C2

• Outbound TCP SYN_SENT to EC2 host on port 8080 (blocked in lab).
• Memory contained Go networking and IP discovery references (gorilla/websocket, api.ipify.org).

C2 attempt

---

4. DLL & Telemetry Interaction

• AppHelp.dll: indicates possible Application Compatibility abuse (shimming persistence).
• Powrprof.dll / Umpdc.dll: contain power/telemetry strings, likely for timing or sandbox evasion.

AppHelp region
Powrprof access

---

Author: Ben Rubin
Environment: (Windows 10, isolated lab)
Scope: Static, Dynamic & Memory Analysis

---

5. Registry Reconnaissance

The loader accessed multiple registry keys:

Registry

---

MITRE ATT&CK Mapping (observed)

Tactic	Technique (ID)	Evidence
Defense Evasion	Hooking / API Patching (T1055/T1562-like)	Hook lists; tool detection strings
Persistence / Evasion	Application Shimming (T1546.011)	apphelp .rdata/.rsrc indicators
Privilege/Evasion	Memory protection changes (T1055-like)	Private RWX regions; VirtualProtect calls
Credential Access	Registry reconnaissance (T1003-family evidence)	LSA/Winlogon/RPC registry touches
Command & Control	App Layer Protocol (T1071)	Go net libs; outbound EC2:8080 SYN_SENT

---