unclassified-dotnet-minesweeper-masquerade: c59a535b — .NET Framework Minesweeper game with Microsoft-themed version-info masquerade

Executive Summary

A PE32 .NET Framework 4.0 WinForms executable distributed as AWB_411744484099.exe (airway-bill social-engineering lure). Static analysis reveals a fully functional Minesweeper game with no observable malicious payload: no network APIs, no persistence, no process injection, no reflective loading. OpenCTI's remcosrat label is a false positive; the binary shares zero build artefacts or TTPs with the Remcos RAT family. Threat is purely social-engineering masquerade. ^[file.txt] ^[pefile.txt]

What It Is

Build / RE

Toolchain

• Language: C# targeting .NET Framework 4.0 (CLR v4.0.30319) ^[dotnet-metadata:dump_dotnet.py]
• Compiler: Microsoft C# compiler (csc.exe / MSBuild), standard WinForms designer-generated code
• Linker version: 48.0 (Visual Studio 2010-era toolchain) ^[pefile.txt:45-46]
• Sections: .text (code, entropy 7.76), .rsrc (manifest + version info, entropy 3.47), .reloc (base relocations) ^[pefile.txt:79-136]

Packing / Obfuscation

• None. No packer, no obfuscator, no anti-debug, no VM detection. Entropy on .text is high (7.76) because the section contains the entire .NET IL bytecode + metadata, not because of encryption. ^[pefile.txt:92]

Anti-Analysis

• Capa flags T1620 (Reflective Code Loading) and B0013.001 (Analysis Tool Discovery) — these are benign .NET runtime artefacts (JIT compilation, DebuggerNonUserCodeAttribute) and should be treated as false positives in this context. ^[capa.txt]
• No sandbox evasion, no timing checks, no process enumeration for analysis tools.

Embedded Resources

• RT_VERSION: Fabricated Microsoft Corporation. identity with product name Primitive Queue. ^[pefile.txt:190-244]
• RT_MANIFEST: Standard Windows Vista-compatible execution-level asInvoker manifest. ^[binwalk.txt:11]
• Bitmap/PNG assets: A 121×121×32 PC bitmap at RVA 0x28E4C and a 584×584 RGBA PNG at RVA 0x373E9 — game board and UI graphics. ^[binwalk.txt:7-8]
• No RT_RCDATA payload. No encrypted config blob, no second-stage PE, no shellcode.

Notable .NET Metadata

• Namespace ADWRBWWQNJ with a DataSet-derived class containing 16 nested DataTable types named DataTable1, DataTable11, DataTable111, … DataTable11111. These are auto-generated TypedDataSet classes produced by Visual Studio's dataset designer. ^[dotnet-metadata:#Strings]
• Form classes: MainForm, Form2, customForm — standard WinForms event handlers (Form2_Load, MainForm_Load, timer1_Tick, button1_Click, etc.). ^[strings.txt:112-128]
• Game logic strings: IsMine, GetSafeIsland, GetNeighbors, CountMines, mineBox, colBox, rowBox, first_click_x, first_click_y. ^[strings.txt:520-752]
• UI strings from #US heap: "Congratulations {0}! You discovered all safe squares in {1} seconds!", "Game Over! You clicked on a mine!", difficulty levels "Easy", "Medium", "Expert", "Extreme". ^[dotnet-metadata:dump_us.py]

Deploy / ATT&CK

Static-only inference (no CAPE detonation available).

No MITRE ATT&CK techniques apply. The binary contains:

• No System.Net.Sockets, System.Net.WebClient, HttpWebRequest, or mail APIs
• No Process.Start, Registry writes, TaskScheduler, or WMI calls
• No Assembly.Load, InvokeMember, or reflective execution with non-system assemblies
• No cryptographic APIs beyond what the .NET runtime itself imports

Why This Is NOT RemcosRAT

The remcosrat label is a textbook false positive from OpenCTI's automated tagging pipeline, likely triggered by the exe + malware-bazaar tags without static family confirmation.

C2 Infrastructure

None. No hardcoded IPs, domains, URLs, mutexes, named pipes, or registry keys. All network-related strings are absent from both #Strings and #US metadata heaps.

Interesting Tidbits

• Filename social engineering: AWB_ prefix = Air Way Bill, a common logistics/shipping phishing lure. The numeric suffix (411744484099) mimics a real tracking number format.
• Version-info masquerade: Claims Microsoft Corporation. copyright and product name Primitive Queue with internal name SpQF.exe. The .pdb path SpQF.pdb confirms the developer's original project name was SpQF (possibly "Single-Player Queue Framework" or similar). ^[pefile.txt:353]
• Caesar-shift red herring: The string FuhdwhLqvwdqfh in the #US heap decodes with Caesar+3 to CreateInstance. This is not obfuscation — it's a leftover from the dataset designer or a developer's test string. No other encoded strings follow this pattern.
• TypedDataSet bloat: The 16 auto-generated DataTable classes inflate the binary size. This is typical of Visual Studio's "Add New Data Source" wizard, not a malicious technique.
• Future-dated PE timestamp: 2074-12-06 is almost certainly a linker default or intentional fabrication; it does not correlate with any known campaign.

How To Mess With It (Homelab Replication)

Build a comparable .NET game masquerade:

1. Open Visual Studio 2010+ → New Project → Windows Forms Application (.NET Framework 4.0).
2. Add a DataSet via Project → Add New Item → DataSet. Name it ADWRBWWQNJ (or anything).
3. Add DataTable objects via the designer. Visual Studio auto-generates DataTable1, DataTable11, etc.
4. Implement a simple Minesweeper grid using Button[,] or PictureBox controls.
5. In AssemblyInfo.cs, set:

   [assembly: AssemblyCompany("Microsoft Corporation.")]
   [assembly: AssemblyProduct("Primitive Queue")]
   [assembly: AssemblyFileVersion("1.0.0.0")]
   

6. Build Release. Observe the resulting PE has the same 3-section layout, similar entropy, and comparable capa fingerprint (false-positive T1620 from JIT loading).

Verification: Run capa <your.exe> — expect compiled to the .NET platform, access .NET resource, display service notification message box. No network or persistence capabilities should surface.

Deployable Signatures

YARA Rule

rule dotnet_minesweeper_masquerade
{
    meta:
        description = "Detects .NET Minesweeper game binaries masquerading as business documents"
        author = "PacketPursuit SOC"
        date = "2026-06-22"
        reference = "/intel/analyses/c59a535b1a8525c8f5714034085bfa0008e5c4bb55f0c39183c07ac3828a7cdd.html"
    strings:
        $dt1 = "DataTable1" ascii wide
        $dt11 = "DataTable11" ascii wide
        $dt111 = "DataTable111" ascii wide
        $dt1111 = "DataTable1111" ascii wide
        $dt11111 = "DataTable11111" ascii wide
        $adw = "ADWRBWWQNJ" ascii wide
        $mine = "IsMine" ascii wide
        $safe = "GetSafeIsland" ascii wide
        $form2 = "Form2_Load" ascii wide
        $main = "MainForm_Load" ascii wide
        $congrats = "Congratulations {0}! You discovered all safe squares in {1} seconds!" ascii wide
        $gameover = "Game Over! You clicked on a mine!" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        (uint32(uint32(0x3C) + 0x14) & 0x2000) == 0 and  // PE32 (not PE32+)
        dotnet.is_dotnet and
        5 of ($dt*) and
        $adw and
        any of ($mine, $safe) and
        any of ($form2, $main)
}

Behavioral Fingerprint

PE32 .NET Framework 4.0 WinForms executable presenting a functional Minesweeper game. Contains auto-generated TypedDataSet classes (DataTable1 through DataTable11111) under namespace ADWRBWWQNJ. No System.Net socket or HTTP APIs are imported. Version info claims Microsoft Corporation. / Primitive Queue / SpQF.exe. High .text section entropy (~7.76) is due to IL bytecode density, not packing. Capa's T1620 and B0013.001 hits are benign .NET runtime artefacts. No persistence, no C2, no payload staging.

IOC List

Detection Signatures

Capa static analysis results (all benign in this context):

ATT&CK mapping from capa (static-only, not confirmed dynamically):

• T1620 — Reflective Code Loading (benign .NET JIT)

References

• Artifact ID: dd8d0962-48a8-4905-8954-7997b9afa9d1
• Source: OpenCTI / MalwareBazaar
• Related entity: unclassified-dotnet-game — umbrella for .NET game masquerades (AvalancheRunner sibling)
• Related concept: version-info-masquerade
• Related concept: social-engineering-filename-lure

Provenance

Analysis based on static artefacts in raw/analyses/c59a535b.../: file.txt, pefile.txt, strings.txt, capa.txt, binwalk.txt, rabin2-info.txt, metadata.json, triage.json. .NET metadata extracted via custom Python parser (dump_dotnet.py, dump_tables.py, dump_us.py) reading the PE CLR header, #~, #Strings, and #US streams directly. No CAPE detonation available (no Windows guest). No decompiler (dnSpy/ILSpy) installed on analysis host.