9d2ca3: 2bf8e65c — .NET Framework 4.0 dropper with AES + Base64 resource decryption and WMI-driven process hollowing

Executive Summary

A freshly compiled .NET Framework 4.0 x64 PE (May 22 2026) tagged 9d2ca3 / dropped-by-amadey. It is structurally unlike the MinGW or Go siblings in the same OpenCTI label: pure CIL with a massive .text section carrying IL, P/Invoke imports for hollow-loader APIs, AES+RijndaelManaged + Base64 payload decryption, and WMI process enumeration. No CAPE detonation. Static inference suggests a resource-staged dropper that decrypts an embedded payload, enumerates a victim process via Win32_Process, and injects via CreateProcess/VirtualAllocEx/WriteProcessMemory/ZwUnmapViewOfSection hollowing. No network IOCs in static.

What It Is

Unlike every other 9d2ca3 sample in the corpus (MinGW-w64 encrypted droppers and Go 1.25.4 infostealers), this is a .NET Framework 4.0 x64 assembly with a near-maximum-entropy .text section typical of compiled IL metadata and method bodies. There is no embedded PE payload in .rsrc or overlay, and binwalk found only the manifest XML. ^[binwalk.txt]

How It Works

1. Decrypt / load embedded payload

The binary references a full AES decryption suite:

• System.Security.Cryptography.RijndaelManaged ^[strings.txt:4070]
• Rfc2898DeriveBytes ^[strings.txt:4069]
• CryptoStream + CryptoStreamMode ^[strings.txt:4079-4080]
• Convert.FromBase64String ^[strings.txt:4060]

These are complemented by MemoryStream, System.IO.Compression.ZipArchive, ZipArchiveEntry, and ReadOnlyCollection ^[strings.txt:4037-4045], indicating that the inner payload is delivered as a Base64-encoded, AES-encrypted ZIP that is decrypted in-memory and its contents extracted for execution. No hardcoded key is visible in static strings, meaning the key material is either computed at runtime (e.g., from host attributes) or supplied via command-line / resource.

The .rsrc section contains only the standard manifest and version info ^[pefile.txt]; the actual encrypted payload therefore resides inside the .NET metadata or as a raw data blob in the .text IL stream, decrypted via the AES pipeline above.

2. Process enumeration via WMI

The binary imports System.Management classes in full:

• ManagementScope, ConnectionOptions, ImpersonationLevel
• ObjectQuery, ManagementObjectSearcher
• Win32_Process query pattern: "Select CommandLine, ProcessID from Win32_Process" (recovered from #US blob via XOR 0x20 decoding) ^[strings.txt]

It also reads System.Environment.SpecialFolder ^[strings.txt] to discover common paths, and checks WindowsIdentity.GetCurrent / IsInRole(WindowsBuiltInRole.Administrator) ^[strings.txt:3990-3995] before proceeding.

3. Process hollowing (inferred)

Exact P/Invoke API names are imported via System.Runtime.InteropServices.DllImport:

• kernel32.dll: CreateProcess, VirtualAllocEx, WriteProcessMemory, ResumeThread, CloseHandle ^[strings.txt:3955-3962]
• ntdll.dll: ZwUnmapViewOfSection ^[strings.txt:3958]
• Plus SetThreadContext / GetThreadContext ^[strings.txt:3959-3960]

This is the textbook process hollowing sequence ^process-hollowing: create a suspended host (likely svchost.exe or similar system binary selected via the WMI query), unmap its image, allocate RWX memory, write the decrypted payload, set thread context, and resume. capa flags use process replacement (T1055.012) and allocate or change RWX memory ^[capa.txt].

4. Anti-analysis / Evasion

• Admin elevation: manifest requests requireAdministrator ^[strings.txt:4106]
• TLS 1.2 enforcement: ServicePointManager.set_SecurityProtocol(SecurityProtocolType.Tls12) ^[strings.txt:4013-4016]; implies network comms (payload download or C2 beacon) after injection.
• No static C2: no URLs, IPs, or domains recovered from strings. C2/runtime config is encrypted.
• Garbage type / field names: flecduep, knzhwyemdmfotslhxivggphauaduuuzem, etc. ^[strings.txt:3950-3972] — obfuscated identifiers to hinder reverse engineering and signature generation.

Decompiled Behavior

Not applicable. pyghidra / dnfile are not available in this environment. The static analysis above is derived from pefile/metadata parsing, strings/capa, and manual #US blob extraction. No disassembly or IL decompilation was performed. For a full IL decompilation, use ILSpy / dnSpy on a Windows analysis VM.

C2 Infrastructure

No network indicators recovered in static output. C2 is runtime-decrypted and likely contacted by the second-stage payload after hollowing.

Potential persistence vectors (not confirmed statically):

• Registry Run key via the hollowed child process.
• No observed schtasks, reg add, or cmd.exe strings in the outer binary.

Interesting Tidbits

• The popit.exe internal name is unique in the 9d2ca3 cluster; all prior siblings are unnamed or carry randomized Go module paths. ^[exiftool.json]
• Compilation date (May 22 2026) makes this one of the most recently built samples in the corpus, suggesting active campaign deployment.
• 2.1 MB is massive for a .NET dropper. The .text section is almost entirely IL + metadata; the encrypted payload magazine is likely embedded in the method bodies or a #US / #Blob stream, explaining the absence of a secondary .rsrc blob.
• The capa fingerprint strongly matches known commodity loaders (Base64 > AES > ZIP > process hollowing), but the specific combination of WMI targeting + hollowing is more characteristic of a multi-stage downloader/dropper than a simple stealer. ^[capa.txt]
• yara.txt is silent beyond generic PE detection, indicating no known packer or family signature matches the outer shell.

How To Mess With It (Homelab Replication)

Reproduce the static fingerprint with a minimal .NET Framework 4.0 console app in C#:

using System;
using System.IO;
using System.IO.Compression;
using System.Security.Cryptography;
using System.Text;

class PopItReplica
{
    static void Main(string[] args)
    {
        // In a real sample the key is derived at runtime or pulled from resources.
        string b64Payload = "..."; // Base64-encoded AES-encrypted ZIP
        byte[] cipher = Convert.FromBase64String(b64Payload);

        using (RijndaelManaged aes = new RijndaelManaged())
        {
            aes.KeySize = 256;
            aes.Mode = CipherMode.CBC;
            // Key/IV derivation via Rfc2898DeriveBytes mimics the sample.
            using (var ms = new MemoryStream(cipher))
            using (var cs = new CryptoStream(ms, aes.CreateDecryptor(), CryptoStreamMode.Read))
            using (var zip = new ZipArchive(cs, ZipArchiveMode.Read))
            {
                foreach (var entry in zip.Entries)
                {
                    byte[] payload;
                    using (var es = entry.Open())
                    using (var ms2 = new MemoryStream())
                    {
                        es.CopyTo(ms2);
                        payload = ms2.ToArray();
                    }
                    // Hollow into a suspended notepad.exe here
                    // (omitted for safety; use a test VM)
                }
            }
        }
    }
}

Verification: compile with csc.exe /target:winexe PopItReplica.cs. Run capa against the output — should hit encrypt data using AES, decode data using Base64, and access .NET resource.

Deployable Signatures

YARA rule

rule PopIt_Dropper_9d2ca3_NET40_AESHollow
{
    meta:
        description = ".NET Framework 4.0 dropper with AES+Base64 payload and hollowing API imports"
        author = "PacketPursuit"
        date = "2026-06-08"
        sha256 = "2bf8e65cde6c51c07492255eb11f9ef2d7f02c5bd0337c1e7b1c9266d73843ce"
    strings:
        $aes1 = "RijndaelManaged" ascii wide
        $aes2 = "Rfc2898DeriveBytes" ascii wide
        $aes3 = "CryptoStream" ascii wide
        $b64 = "FromBase64String" ascii wide
        $zip1 = "ZipArchive" ascii wide
        $zip2 = "ZipArchiveEntry" ascii wide
        $wmi1 = "ManagementObjectSearcher" ascii wide
        $wmi2 = "Win32_Process" ascii wide
        $hollow1 = "VirtualAllocEx" ascii wide
        $hollow2 = "WriteProcessMemory" ascii wide
        $hollow3 = "ZwUnmapViewOfSection" ascii wide
        $hollow4 = "SetThreadContext" ascii wide
        $hollow5 = "ResumeThread" ascii wide
        $manifest = "requireAdministrator" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        filesize > 1MB and
        (3 of ($aes*)) and
        $b64 and
        (1 of ($zip*)) and
        (1 of ($wmi*)) and
        (3 of ($hollow*)) and
        $manifest
}

Behavioral hunt query (Sigma-like pseudo-YAML)

title: .NET AES Base64 Dropper with WMI Process Hollowing
detection:
    selection:
        - ImageLoaded|contains:
            - 'System.Management.dll'
            - 'System.IO.Compression.dll'
        - CommandLine|contains|all:
            - 'RijndaelManaged'
            - 'FromBase64String'
            - 'ZipArchive'
    process_creation:
        - ParentImage|endswith: 'popit.exe'
        - CommandLine|contains|all:
            - 'CreateProcess'
            - 'VirtualAllocEx'
            - 'WriteProcessMemory'
            - 'ResumeThread'
    selection_wmi:
        - CommandLine|contains: 'Win32_Process'
    condition: selection and process_creation and selection_wmi

(Note: true process-hollowing telemetry is child-process image mismatch, not command-line strings. Use ETW or EDR for real detection.)

IOC List

Behavioral fingerprint statement

This binary is a .NET Framework 4.0 x64 PE compiled in May 2026, with a 2.1 MB .text IL section. It decrypts a Base64 + AES-encrypted ZIP payload in-memory using RijndaelManaged and Rfc2898DeriveBytes, enumerates victim processes via WMI (Win32_Process), and injects the decrypted payload into a suspended child process via CreateProcess → VirtualAllocEx → WriteProcessMemory → ZwUnmapViewOfSection → SetThreadContext → ResumeThread. It enforces TLS 1.2 and demands admin elevation. No static C2 strings are present; network behavior is payload-dependent and likely runtime-decrypted. The outer shell is unsigned and has no obfuscation beyond garbled symbol names.

Detection Signatures

References

• Entity page: 9d2ca3
• Technique: process-hollowing
• Concept: dotnet-manifest-resource-decryption
• Amadey downloader (external, Malpedia win.amadey — upstream delivery mechanism)
• CAPE detonation: skipped — no Windows guest available ^[dynamic-analysis.md]

Provenance

• file.txt, exiftool.json, pefile.txt, rabin2-info.txt, strings.txt, capa.txt, binwalk.txt, yara.txt, triage.json, dynamic-analysis.md — standard triage battery, 2026-06-08.
• Manual CLR metadata and #US blob extraction via pefile + struct.
• Radare2 analysis: opened but CIL plugin yielded no named functions; zero-shot decompilation not attempted due to tool-chain absence.