TW / Independent
← Research audits

Malware Analysis / Artefact: 3LXJyAv6Gf.exe · SHA-256 7d75244449fb…

Truebot: loader telemetry across Netwrix, tasks and injection

Government-source reconstruction of a multi-stage intrusion with alternate initial access, registry staging, process injection and bounded signatures.

Scope
Joint government advisory AA23-187A and linked Malware Analysis Report on Truebot activity in the United States and Canada.
Method
Static source and architecture review; no malware obtained, built or executed.
Evidence
CISA-published sample identity; binary not present in the local evidence set.
Finding

The intrusion chain, YARA/Snort detection and ATT&CK mapping are documented; rules and IOCs are campaign-bound.

No independent sample, runtime, C2 or campaign verification.

Analyst note

What the evidence actually supports.

Truebot is easily conflated with the entire intrusion chain around it. We keep the downloader, its published sample identity and follow-on tooling separate—the point where attribution errors otherwise begin.

Evidence anchorpublished identity
Artefact
3LXJyAv6Gf.exe
SHA-256
7d75244449fb5c25d8f196a43a6eb9e453652b2185392376e7d44c21bd8431e7
Analysis basis
CISA-published sample identity; binary not present in the local evidence set.
Malware / Evidence Atlas

Initial access → Follow-on payload

The analysis path for this report. Every node shows what is supported, where detection can start and where the claim stops.

5flow nodes 2detection artefacts 2rule formats
Claim

Initial access

The report separates upstream delivery from the TrueBot payload.

Detection focus

Capture delivery artefact and payload hash separately.

Bound to primary research
Config Surface

Configuration fingerprint

Review pivots derived from the report — not a live configuration or universal family indicator.

01
Placementuser-path DLL
core
02
Launchrundll32
core
03
Beaconprocess-bound
support
04
Follow-on payloadseparate attribution
boundary
MODEL / A5F18B1ECore, support and boundary — not risk scores
Detection Pack

Defensive artefacts

Source, validation and limits accompany every rule.

SourceOriginal derivation from the reported behaviour chain.ValidationParsed by pySigma; synthetic truth table 3/3.LimitTask and process patterns approximate the chain; injection requires EDR telemetry.
SigmaOpen rule
Defensive model
title: Truebot follow-on task candidate
status: experimental
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith: '\\schtasks.exe'
    ParentImage|endswith:
      - '\\msiexec.exe'
      - '\\spoolsv.exe'
    CommandLine|contains: '/create'
  condition: selection
falsepositives:
  - Legitimate administrative or software activity with the same isolated pattern
level: medium

Evidence status Supported by review evidenceBound to primary researchBounded or unresolved

Scope, snapshot and evidence boundary

Joint government advisory AA23-187A and linked Malware Analysis Report on Truebot activity in the United States and Canada. The bounded question is: which architecture and behaviour claims does this specific evidence set support, and which remain attributable only to the source?

What is supported — and what is missing

Primary sources, statically inspectable code and runtime observations carry different evidentiary weight. The map keeps those layers separate; missing first-party observation is not replaced by plausibility.

FILE / EVIDENCE MAP

Evidence chain and open runtime gap

The map separates primary source, reproducible source snapshots and runtime evidence not collected here.

A file reference does not establish runtime behaviour. Recorded processing is not a new execution.

SourceToolDerivedEvidenceMissingVerified referenceRecordedUnresolved

Evidence

Traceable source with an explicit sample gap.

Primary source

Published analysis or pinned upstream snapshot.

  • Primary source → Documented observationsdocumented by source · Recorded

    Not independently replayed against a sample here.

Related report section →
Documented observations

Sample, sandbox or telemetry claims made by the source.

  • Primary source → Documented observationsdocumented by source · Recorded

    Not independently replayed against a sample here.

  • Documented observations → No local malware sampleruntime unresolved · Unresolved

    The review remains static or source-bound.

Related report section →
No local malware sample

No first-party runtime, C2 or campaign telemetry.

  • Documented observations → No local malware sampleruntime unresolved · Unresolved

    The review remains static or source-bound.

Related report section →

Limit: A published observation is not an independent reproduction.

Entry and delivery chain

The advisory separates phishing from exploitation of Netwrix vulnerability CVE-2022-31199. Both can lead to Truebot, but they are alternatives and must not be merged into an artificial single chain in telemetry or incident timelines.

Architecture and data flow

After entry, Truebot performs system and process discovery and can deploy FlawedGrace. Documented follow-on stages store encrypted data in the registry, manipulate the Print Spooler, use scheduled tasks and inject into msiexec or svchost; Cobalt Strike can initially remain dormant.

Analysis resistance and persistence

The MAR describes high entropy and junk code as analysis barriers. Process injection and registry staging move relevant evidence away from the file system. These traits are common; their sequence and affected process context increase confidence.

Capabilities, objective and impact

The agencies connect observed Truebot activity with data collection and exfiltration and note use by actors associated with CL0P. This establishes priority, but a Truebot finding alone proves neither operator identity nor ransomware execution.

Telemetry plan and evidence chain

CISA’s YARA and Snort rules provide historical starting points. More robust detection correlates Netwrix child processes or phishing execution, scheduled-task creation, registry staging, spooler changes and injection indicators in msiexec/svchost. A defensible investigation preserves process GUID and full ancestry, user and session, command line, signer and hash state, file and registry changes, DNS/connection destinations and follow-on access to sensitive data in one timeline. Temporal proximity is an evidence parameter, not mere visualization. Missing sensor coverage is marked per stage so that an unseen event is not falsely treated as an event that did not occur.

Detection engineering and countertesting

CISA’s YARA and Snort rules provide historical starting points. More robust detection correlates Netwrix child processes or phishing execution, scheduled-task creation, registry staging, spooler changes and injection indicators in msiexec/svchost. The following model is deliberately narrow, not engine-validated and must be tested against legitimate administration and software paths.

yamlDefensive model, not engine-validatedDefensive model
title: Truebot follow-on task candidate
status: experimental
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith: '\\schtasks.exe'
    ParentImage|endswith:
      - '\\msiexec.exe'
      - '\\spoolsv.exe'
    CommandLine|contains: '/create'
  condition: selection
falsepositives:
  - Legitimate administrative or software activity with the same isolated pattern
level: medium
Read the code

Alternative hypotheses and negative tests

Before assigning the family, each signal used by the model is tested independently against software deployment, administration tools, installers, browser or backup software and known internal scripts. At least one structural anchor and one temporally consistent behaviour chain must align. The official rules are tailored to analyzed samples and a 2023 campaign. Strings, domains and exploit paths age; without a sample, present-day coverage was not remeasured. A negative countercheck rejects only the tested hypothesis; it is not a general all-clear.

Attribution and variant risk

The official rules are tailored to analyzed samples and a 2023 campaign. Strings, domains and exploit paths age; without a sample, present-day coverage was not remeasured.

Final assessment

The review provides a defensible architecture and detection baseline for the named snapshot. It is not proof of current activity, complete variant coverage or a specific operator.

Findings at a glance

  • Phishing and Netwrix exploitation are alternate initial-access paths.
  • Registry staging, tasks and injection distribute evidence across several telemetry sources.
  • Historical YARA/Snort rules are starting points, not permanent family proof.

Review limits

  • No independent sample, runtime, C2 or campaign verification.
  • The official rules are tailored to analyzed samples and a 2023 campaign. Strings, domains and exploit paths age; without a sample, present-day coverage was not remeasured.
  • Defensive models were not validated with a target engine.

Context, not evidence

The Evidence Anchor at the start identifies the binary, file or revision actually used. These links provide context and reported observations; they do not substitute for local sample analysis.

CISA — AA23-187A Truebot activity ↗CISA — MAR-10445155-1.v1 ↗
Final assessment

Conclusion

Conclusion: structure before signature

The greatest defensive value comes from connecting entry, internal architecture, persistence, impact and telemetry. Individual names, hashes or IOCs remain supporting evidence, not the conclusion.

Next steps

  • Test models against synthetic positives and legitimate negatives.
  • Rebind version and evidence snapshot with every update.
  • Extend runtime claims only after first-party, lawfully available telemetry.
Basis of this judgmentHigh for directly inspectable structure; limited for runtime and campaign claims not independently reproduced.
Joint government advisory AA23-187A and linked Malware Analysis Report on Truebot activity in the United States and Canada.
← All research audits

Start a conversation

Discuss your project.

Start a conversation