Full Report
Hackers always try to cover up their tracks. In this blog, we step through layers of obfuscation to uncover the real intent of a .NET malware sample.
Analysis Summary
# Tool/Technique: Multi-Layered .NET Loader (Steganographic Loader)
## Overview
This technique involves a sophisticated, multi-stage .NET malware delivery system designed to evade detection through layered obfuscation, dynamic code compilation, and steganography. The primary purpose is to deliver a final payload (typically a RAT or C2 agent) by hiding it within a seemingly harmless image file (PNG) embedded as an HTML resource.
## Technical Details
- **Type:** Malware Loader / Obfuscator
- **Platform:** Windows (.NET Framework)
- **Capabilities:** XOR-based deobfuscation, dynamic DLL compilation in memory, reflective assembly loading, and steganographic payload extraction.
- **First Seen:** March 9, 2021 (Blog publication date)
## MITRE ATT&CK Mapping
- **[TA0005 - Defense Evasion]**
- **[T1027 - Obfuscated Files or Information]**: Uses XOR encryption and heavy .NET obfuscation.
- **[T1027.003 - Steganography]**: Hides the payload inside a PNG image file embedded in the resources.
- **[T1027.004 - Compile After Delivery]**: The initial stage compiles C# source code into a DLL on the fly using .NET's internal compilers.
- **[TA0002 - Execution]**
- **[T1619 - Native API]**: Uses `FindResource`, `LoadLibrary`, and thread injection.
- **[TA0003 - Persistence]**
- **[T1547.001 - Registry Run Keys / Startup Folder]**: Initially discovered via a `.url` file in the user's startup directory.
## Functionality
### Core Capabilities
- **Dynamic Compilation:** The dropper contains an encrypted string representing C# source code. It decrypts this code via XOR and compiles it into a functional DLL in memory.
- **Reflective Loading:** Loads the newly compiled DLL without writing it to disk to minimize the forensic footprint.
- **Resource Extraction:** The loader identifies an HTML resource (ID 130) which masquerades as a PNG image but contains the encrypted next-stage payload.
### Advanced Features
- **Self-Modification:** The final stage uses `GetExecutingAssembly()` to access its own binary data, modifying its execution flow or variables (e.g., `xnnXVZCo`) dynamically at runtime.
- **Environment Camouflage:** Uses suspicious naming conventions (e.g., `doc06421,pdf.exe`) to trick users while bypassing basic filename filters.
## Indicators of Compromise
- **File Names:**
- `ijrhojllknmbkq4p.url` (Startup directory)
- `doc06421,pdf.exe` (Local executable)
- **Behavioral Indicators:**
- An Internet Shortcut (.url) file pointing to a local executable instead of a URL.
- Spawning of C# compiler processes (`csc.exe`) by an unknown user executable.
- Unusual memory allocation and thread injection within a .NET process.
## Associated Threat Actors
- The specific actor is not named in the article, but the techniques (steganography and .NET reflective loading) are commonly associated with sophisticated e-crime groups and APTs.
## Detection Methods
- **Signature-based detection:** Scanning for the specific XOR routine used in the `XorEncrypt()` function.
- **Behavioral detection:** Monitoring for `.url` files in startup folders that point to local file paths (especially `.exe` files).
- **Tool-based Analysis:**
- Use **dnSpy** to decompile and debug the .NET assembly.
- Use **de4dot** to remove common .NET obfuscation layers.
- Use **Resource Hacker** to inspect embedded HTML/Image resources for hidden headers.
## Mitigation Strategies
- **Endpoint Protection:** Use EDR solutions that monitor for suspicious child processes of .NET applications (like `csc.exe` or `cvtres.exe`).
- **Persistence Monitoring:** Audit the `%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup` directory and registry Run keys for unauthorized `.url` or `.lnk` files.
- **Application Whitelisting:** Implement policies to prevent execution from user-writable directories (e.g., `AppData\Local`).
## Related Tools/Techniques
- **Cobalt Strike:** Often uses similar reflective loading techniques for its "Beacon" payload.
- **Process Hollowing:** Similar intent of hiding malicious code within a legitimate process context.
- **PixelLib / Steganography Tools:** Similar to other malware that hides payloads in BMP or JPG files.