Anatomy of a .NET Loader: Reflection and Assembly Loading
· 14:28 · Watch on YouTube ↗
Summary
A workshop demonstrates a sample .NET loader that uses reflection to load and invoke an embedded assembly in memory, then shows anti-analysis checks and debugging techniques for examining the payload.
Key points
- The sample loader embeds a second .NET assembly, loads it with reflection, and invokes its entry-point method.
- The example checks for an attached debugger and analysis-related processes; it also demonstrates a VMware check that the presenter disabled for the lab.
- A mutex prevents simultaneous instances of the sample from running.
- The sample gathers the username, operating system, hostname, and timestamp, then sends the data as JSON over HTTP to a lab URL handled by FakeNet.
- The workshop shows how to locate an Assembly.Load transition and capture the loaded assembly from memory while debugging.
- The presenter notes that obfuscation can complicate analysis and introduces ConfuserEx as the focus of the next video.
Article Details
- Topics
- [00:02] .NET obfuscation and ConfuserEx
- [00:57] Loader design: embedding and invoking a next-stage assembly
- [02:24] Lab check-in behavior and HTTP transmission of host metadata
- [03:39] Anti-analysis checks, process enumeration, and mutex use
- [06:06] In-memory reflective assembly loading
- [11:54] Debugging and extracting the loaded assembly from memory
- [14:18] ConfuserEx and obfuscation in the next video
MITRE ATT&CK
T1057 · Process DiscoveryThe sample enumerates processes and compares their names against a block list to detect analysis tools.T1071.001 · Web ProtocolsThe illustrative sample sends host metadata as JSON over HTTP to a lab URL; the transcript does not identify live command-and-control infrastructure.T1497.001 · System ChecksThe presenter describes a WMI check for VMware as a virtual-machine detection example, noting it was disabled in the demonstration.T1620 · Reflective Code LoadingThe sample loads embedded .NET assembly bytes into memory and invokes a method through reflection.T1622 · Debugger EvasionThe sample checks whether a debugger is attached and checks for analysis-related processes, including dnSpy.