# TrickBot injectDLL Module: Man-in-the-Browser Web Injection Against Certificate Transparency

> Kryptos Logic's technical analysis of TrickBot's injectDLL module documents a man-in-the-browser technique: the trojan opens a localhost SOCKS proxy on 127.0.0.1:15733, hooks browser networking and certificate-validation APIs to redirect and decrypt browser traffic, and rewrites Expect-CT/HPKP headers plus disables HTTP/2 and SPDY to defeat Certificate Transparency and pinning protections before delivering multistage JavaScript web injects.

- **Published:** 2026-08-24T00:00:00Z
- **Last reviewed:** 2026-08-24T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2133
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-trickbot-injectdll-module-tl-2026-2133.webp?v=f6053c94 (Threadlinqs threat intel: TrickBot injectDLL Web Injection Module: Detection & IOCs (TL-2026-2133) — High severity, 22 IOCs, 9 detection rules.)
- **ID:** TL-2026-2133
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Periwinkle Tempest (Russia)
- **Detections:** 9 (1 shown free below) · **IOCs:** 22 (3 shown free below)

## Description

TrickBot's injectDLL module performs reflective DLL injection into Internet Explorer, Firefox, Chrome, and Microsoft Edge (excluding Tor Browser's firefox.exe process) to establish a man-in-the-browser (MITB) position. Once injected, the module hooks Connect, ConnectEx, and WSAIoctl to silently redirect all outbound browser traffic through a locally bound SOCKS4/SOCKS5 proxy on 127.0.0.1:15733, and hooks CertGetCertificateChain and CertVerifyCertificateChainPolicy to strip TLS validation errors so a self-signed, malware-generated certificate (CN=localhost, sha256WithRSAEncryption, 10-year validity) is silently trusted. To specifically defeat Certificate Transparency and HTTP Public Key Pinning, the module rewrites the Expect-CT header to X-pect-XX and Public-Key-Pins / Public-Key-Pins-Report-Only to X-blic-Key-Pins variants before they reach the browser's security stack. Because HTTP/2 and SPDY complicate stream-level interception, the module disables both: for Internet Explorer via the EnableHTTP2 and TabProcGrowth registry values, for Firefox via pref.js overrides (browser.tabs.remote.autostart, network.http.spdy.enabled.http2), and for Chrome by terminating and relaunching the browser with --disable-http2 --use-spdy=off --disable-quic. For Chrome specifically, the module also rewrites the NotBefore timestamp on its spoofed certificate (resetting years after 2017 and months after September) to predate Chrome's Certificate Transparency enforcement cutoff, defeating CT checks at the certificate-issuance-date level rather than only the header level. Firefox injection additionally overwrites the BaseThreadInitThunk address before injecting to evade Firefox's own remote-thread detection. Once the browser trusts the proxy's TLS termination, TrickBot delivers a first-stage JavaScript loader that beacons to s1.deadseaproductions.com/api.js (identifying itself via X-Client-Id/X-Client-Origin headers containing the bot ID), which in turn pulls a second, page-specific web-inject only when the victim browses a targeted site — corroborated by Check Point Research, which found the module actively targeting customers of roughly 60 high-profile US banking, cryptocurrency, e-commerce, and technology brands (including major banks, Blockchain.com, Amazon, and large brokerages). Second-stage scripts, disguised with filenames like jquery-3.5.1.min.js, are served from myca.adprimblox.fun and seq.mediaimg23.monster, are XOR-encrypted, and include anti-analysis logic that crashes the tab process if it detects deobfuscation tooling. Captured credentials and form submissions are exfiltrated over a separate DPOST channel (https://<c2>:<port>/<gtag>/<botid>/<command>/) to a large rotating pool of HTTPS C2 servers. TrickBot itself is a modular, Malware-as-a-Service banking trojan first observed in 2016 as a believed derivative of Dyre; it is primarily operated by the Russia-based Wizard Spider group (aka UNC1878, GOLD BLACKBURN, TEMP.MixMaster), which has historically used TrickBot-compromised networks as an initial-access foothold for deploying Ryuk and Conti ransomware.

## MITRE ATT&CK

- T1055.001 Process Injection: Dynamic-link Library Injection
- T1185 Browser Session Hijacking
- T1553.004 Subvert Trust Controls: Install Root Certificate
- T1685 Disable or Modify Tools
- T1112 Modify Registry
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1071.001 Application Layer Protocol: Web Protocols
- T1056.004 Input Capture: Credential API Hooking

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**TrickBot injectDLL Reflective Browser Injection + Loopback SOCKS Proxy (SPL)** (`TL-2026-2133-SPL-001`)

Detects reflective DLL injection (CreateRemoteThread / cross-process access) into Internet Explorer, Firefox, Chrome, or Edge (excluding Tor Browser's firefox.exe) combined with a locally-bound SOCKS4/SOCKS5 proxy handshake on TCP/15733 — the establishment signature of TrickBot's injectDLL man-in-the-browser module, which hooks Connect/ConnectEx/WSAIoctl and CertGetCertificateChain/CertVerifyCertificateChainPolicy to hijack and decrypt browser traffic.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1055.001, T1185, T1056.004
- **Data sources:** sysmon, windows_security, edr_process_events, microsoft_defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=8 OR EventCode=3)
| eval proc=lower(coalesce(TargetImage, Image))
| eval src=lower(SourceImage)
| eval is_remote_thread=if(EventCode=8 AND match(proc, "(iexplore|firefox|chrome|msedge)\.exe$") AND NOT match(src, "tor"), 1, 0)
| eval is_loopback_proxy=if(EventCode=3 AND DestinationIp="127.0.0.1" AND DestinationPort=15733 AND match(proc, "(iexplore|firefox|chrome|msedge)\.exe$"), 1, 0)
| where is_remote_thread=1 OR is_loopback_proxy=1
| eval technique=if(is_remote_thread=1, "T1055.001,T1185", "T1056.004")
| stats earliest(_time) as first_seen, latest(_time) as last_seen, count, values(technique) as techniques by ComputerName, User, proc, src, DestinationIp, DestinationPort
| where count > 0
```

### Microsoft KQL

```kql
let BrowserProcs = dynamic(["iexplore.exe","firefox.exe","chrome.exe","msedge.exe"]);
DeviceEvents
| where Timestamp > ago(24h)
| where ActionType in ("CreateRemoteThreadApiCall","ProcessAccess","ReflectiveDllLoad")
| where (InitiatingProcessFileName has_any (BrowserProcs) or FileName has_any (BrowserProcs))
| where InitiatingProcessFolderPath !has "Tor Browser"
| project Timestamp, DeviceName, ActionType, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, AccountName
| union (
    DeviceNetworkEvents
    | where Timestamp > ago(24h)
    | where RemoteIP == "127.0.0.1" and RemotePort == 15733
    | where InitiatingProcessFileName has_any (BrowserProcs)
    | project Timestamp, DeviceName, ActionType="LoopbackSocksProxyConnection", InitiatingProcessFileName, InitiatingProcessCommandLine, FileName=InitiatingProcessFileName, AccountName=InitiatingProcessAccountName
)
```

### Sigma

```yaml
title: TrickBot injectDLL Reflective Browser Injection
id: e3a1b2c4-1234-4a1b-9c3d-000000000001
status: experimental
description: Detects reflective DLL / remote-thread injection into Internet Explorer, Firefox, Chrome, or Edge, consistent with TrickBot injectDLL establishing a man-in-the-browser position. Corroborate with a loopback SOCKS proxy connection on TCP/15733 from the same process for higher fidelity.
references:
    - https://www.kryptoslogic.com/blog/2022/01/deep-dive-into-trickbots-web-injection/
    - https://attack.mitre.org/software/S0266/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-24
tags:
    - attack.defense-evasion
    - attack.collection
    - attack.credential-access
    - attack.t1055.001
    - attack.t1185
    - attack.t1056.004
    - attack.tool.trickbot
logsource:
    category: process_access
    product: windows
detection:
    selection_inject:
        TargetImage|endswith:
            - '\iexplore.exe'
            - '\firefox.exe'
            - '\chrome.exe'
            - '\msedge.exe'
    filter_tor:
        SourceImage|contains: 'Tor Browser'
    condition: selection_inject and not filter_tor
falsepositives:
    - EDR/AV agents or accessibility software performing legitimate process introspection into browser processes
    - Enterprise browser automation/testing frameworks (e.g. Selenium WebDriver extensions) that inject into browser processes
level: high
```

**Known false positives:**

- EDR/AV agents or accessibility software performing legitimate process introspection/injection into browser processes
- Enterprise browser automation/testing frameworks (e.g. Selenium WebDriver extensions) that inject into browser processes

**Tuning notes:** Baseline legitimate injectors (EDR agents, accessibility tools, enterprise browser extensions) by SourceImage hash/signer and suppress known-good signed binaries; narrow the loopback-proxy correlation to unsigned or unknown parent processes if the standalone injection alert is noisy.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- TrickBot injectDLL Reflective Browser Injection + Loopback SOCKS Proxy (KQL) (locked: unlock with TL Creds)
- TrickBot injectDLL HTTP/2 Downgrade, Root Certificate Staging & Registry Tampering (KQL) (locked: unlock with TL Creds)
- TrickBot injectDLL Web-Inject C2 Beaconing and DPOST Credential Exfiltration (KQL) (locked: unlock with TL Creds)
- TrickBot injectDLL Reflective Browser Injection + Loopback SOCKS Proxy (Sigma) (locked: unlock with TL Creds)
- TrickBot injectDLL HTTP/2 Downgrade, Root Certificate Staging & Registry Tampering (Sigma) (locked: unlock with TL Creds)
- TrickBot injectDLL Web-Inject C2 Beaconing and DPOST Credential Exfiltration (Sigma) (locked: unlock with TL Creds)
- TrickBot injectDLL HTTP/2 Downgrade, Root Certificate Staging & Registry Tampering (SPL) (locked: unlock with TL Creds)
- TrickBot injectDLL Web-Inject C2 Beaconing and DPOST Credential Exfiltration (SPL) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 22)

Defanged, TLP:CLEAR.

- IP address: `175.184.232[.]234`
- Domain: `s1[.]deadseaproductions[.]com`
- File hash: `6a75c212b49093517e6c29dcb2644df57a931194cf5cbd58e39e649c4a2b84ba`

Full set of 22 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Deep Dive into TrickBot's Web Injection](https://www.kryptoslogic.com/blog/2022/01/deep-dive-into-trickbots-web-injection/)
- [A Modern Ninja: Evasive Trickbot Attacks Customers of 60 High-Profile Companies](https://research.checkpoint.com/2022/a-modern-ninja-evasive-trickbot-attacks-customers-of-60-high-profile-companies/)
- [TrickBot, Software S0266](https://attack.mitre.org/software/S0266/)
- [TrickBot (Malware Family)](https://malpedia.caad.fkie.fraunhofer.de/details/win.trickbot)
- [What is TrickBot Malware?](https://www.crowdstrike.com/en-us/cybersecurity-101/malware/trickbots/)
- [Wizard Spider](https://en.wikipedia.org/wiki/Wizard_Spider)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2133