unclassified-dotnet-minesweeper-masquerade
Overview
A .NET Framework 4.0 WinForms executable presenting a fully functional Minesweeper game, distributed under business-document filenames (AWB_411744484099.exe). The binary contains auto-generated TypedDataSet classes, game board bitmap assets, and standard WinForms event handlers. No malicious behavior is observable statically. OpenCTI's remcosrat label for the first observed sample (c59a535b) is a confirmed false positive.
Build Stack
- Language / runtime: C# targeting .NET Framework 4.0 (CLR v4.0.30319)
- Compiler: Microsoft C# compiler (csc.exe / MSBuild) with Visual Studio dataset designer
- Packaging: Plain PE32, 3 sections (
.text,.rsrc,.reloc); no packer, no obfuscator - Anti-analysis: None (no debugger checks, no VM detection, no sandbox evasion)
- Embedded resources: PNG game board graphics, RT_VERSION with fabricated
Microsoft Corporation.identity, RT_MANIFEST
Deploy / TTPs
- ATT&CK: None confirmed statically. Capa flags
T1620andB0013.001are benign .NET runtime artefacts. - Persistence: None observed
- C2 / exfiltration: None observed — no
System.Net,Socket,WebClient, or mail APIs - Lateral movement: None observed
- Masquerade technique: Airway-bill filename (
AWB_*) +Microsoft Corporation.version-info mismatch against a Minesweeper game
Variants / Aliases
Primitive Queue(product name from version info)SpQF.exe(internal name / PDB)- OpenCTI false label:
remcosrat
Notable Analyses
c59a535b— Full static deep-dive with .NET metadata extraction, false-positive family attribution analysis, and YARA rule. No CAPE detonation (no Windows guest). ^[/intel/analyses/c59a535b1a8525c8f5714034085bfa0008e5c4bb55f0c39183c07ac3828a7cdd.html]
Capabilities
- dotnet-winforms-gui-masquerade
- microsoft-version-info-forgery
- airway-bill-filename-social-engineering
- typeddataset-auto-generated-bloat
- no-network-api-surface
- no-persistence-mechanism
- no-packing-no-obfuscation
Related
- unclassified-dotnet-game — sibling cluster of .NET game masquerades (AvalancheRunner)
- version-info-masquerade — broader concept of VS_VERSIONINFO abuse
- social-engineering-filename-lure — filename-based social engineering
- remcos — Remcos RAT entity page;
c59a535bis a confirmed false-positive co-label