.NET Malware Hides Its Payload in an Embedded Image

Summary

Huntress analysts traced a suspicious .NET executable that compiled and loaded a DLL, extracted a payload disguised as an embedded image, and concealed malware capabilities including password theft and keylogging.

Key points

A suspicious Internet Shortcut in a user’s startup directory pointed to an executable with a misleading filename; its hash had no VirusTotal hits.
The .NET executable XOR-decoded embedded C# source code, compiled it into a DLL, and injected the DLL into a thread.
The DLL processed an embedded resource that appeared to be a PNG but contained another payload.
Analysts extracted the resource and used dnSpy and de4dot to examine successive layers of obfuscation.
The final code exposed capabilities including disabling antivirus applications, stealing passwords, logging keystrokes, and controlling a victim’s webcam.

Article Details

Attack Vectors: A suspicious Internet Shortcut in a user's startup directory pointed to a locally stored executable named doc06421,pdf.exe.
The executable used XOR obfuscation to conceal C# source code, compiled that code into a DLL, and injected the DLL into a new thread.
The DLL loaded and processed an embedded resource disguised as a PNG image, extracting and executing a further payload.
Defensive Notes: Inspect suspicious Internet Shortcut files in user startup directories and investigate unexpected local executable targets.
Analyze obfuscated .NET samples by decoding their embedded source and resources; the article used dnSpy, Resource Hacker, and de4dot.

MITRE ATT&CK

T1027 · Obfuscated Files or InformationThe executable used XOR obfuscation and multiple layers of code and resource obfuscation to conceal its functionality.T1036 · MasqueradingThe payload was embedded in a resource presented as a PNG image, although the article describes it as a fake PNG.T1055 · Process InjectionThe executable compiled a DLL and injected it into a thread.T1056.001 · KeyloggingThe malware's capabilities included logging keystrokes.T1115 · Clipboard DataThe malware was reported to control a victim's webcam.T1140 · Deobfuscate/Decode Files or InformationThe executable XOR-decoded embedded C# source code and processed an embedded resource to extract the payload.T1547.001 · Registry Run Keys / Startup FolderA suspicious Internet Shortcut file was found in a user's startup directory and pointed to the executable.T1555 · Credentials from Password StoresThe malware's capabilities included stealing passwords.T1562.001 · Disable or Modify ToolsThe malware had capabilities to disable antivirus applications.

Products

Microsoft WindowsNeedless to say, .NET malware can pose a significant risk to Windows laptops, workstations, servers, etc. Although antivirus and other preventive security products do their best to stop every attack, this sample

Tools

de4dotFortunately, there are tools to deal with obfuscated .NET files. After running the binary through de4dot, we ended up with something a bit more comprehensible.dnSpythe file utility to identify the executable type, which was a .NET application. Next, we loaded it into dnSpy (a .NET debugger and assembly editor) and discovered three functions: Compile(), Main() and XorEncrypt().Resource HackerNow it was time to see if we could find the referenced resource. Using Resource Hacker, we examined the original executable. Sure enough, it has an HTML resource with the ID 130.