Skip to content

Back to the catalog

Inside .NET Loader Analysis: From Malspam to In-Memory Loader
huntress.comwriteup

Inside .NET Loader Analysis: From Malspam to In-Memory Loader

Huntress SOC dissects a multi-stage infection chain that begins with a malspam HTML attachment routed through a legitimate Google DoubleClick tracking link to evade reputation filters, before landing on a self-personalizing phishing kit and dropping a ZIP with a heavily obfuscated JScript loader. The chain cascades through PowerShell droppers into a .NET stager that performs extensive anti-analysis/anti-sandbox checks, disables Windows Defender, patches AMSI (via NtManageHotPatch on Windows 11 24H2) and ETW at the native API level, and uses RunPE process hollowing into InstallUtil.exe or MSBuild.exe to run a final loader that communicates over AES/RSA-encrypted, protobuf-serialized TCP C2 with certificate pinning. The writeup includes GPU-fingerprinting behavior, persistence via registry Run keys and randomized scheduled tasks, and concrete detection/hardening recommendations.

TL;DR Huntress tears down a DoubleClick-abusing malspam chain that drops a heavily-packed .NET RunPE loader which disables Defender, patches AMSI/ETW, and phones home over encrypted C2.
Open original ↗
Document

What it is

An unidentified multi-stage .NET loader delivered via malspam, analyzed by Huntress SOC (May 2026 incident). Note the correction: Huntress originally attributed this to DesckVB RAT and retracted that on June 5 — do not tag this activity as DesckVB. The value here beyond the catalog summary is the concrete indicators and the full URL chain.

How it works

The lure is an HTML attachment (Bestellung_2026.html, German for "order") containing only a zero-second meta-refresh. The chain crosses three attacker-relevant hops before the payload:

flowchart TD
  A[HTML attachment<br/>meta-refresh] --> B[ad.doubleclick.net<br/>trackclk — allowlisted front]
  B --> C[optimizationprime.com/b<br/>redirector, decodes base64 email]
  C --> D[bth.startthewave.org/a/<br/>personalized kit]
  D -->|POST email=| E[muliastudy.com/images/edu/u.php<br/>returns ZIP]
  E --> F[JScript → PowerShell → .NET<br/>in-memory loader → C2]

The DoubleClick front carries the recipient email base64-encoded in the URL fragment; the redirector decodes it and forwards it as plaintext to the kit. The kit reads the email from window.location.hash, extracts the domain, and rewrites title/logo/footer to impersonate the employer. Logos are fetched live at runtime through a fallback chain: Clearbit → logo.dev → Google favicons → favicone → DuckDuckGo → the company's own /favicon.ico. Clicking "PDF herunterladen" runs downloadFile(), which POSTs email=<address> to the u.php endpoint, which returns the ZIP.

Indicators

  • Attachment: Bestellung_2026.html
  • ZIP payload: A021185521S210008-11521.zip
  • ad.doubleclick[.]net/ddm/trackclk/N4892.5020.4774291382421/B23999293.271539123 (dc_trk_aid=466016770, dc_trk_cid=131101292)
  • Redirector: fostercareintheus.optimizationprime[.]com/b
  • Kit host: bth.startthewave[.]org/a/
  • Payload delivery: pengajian.muliastudy[.]com/images/edu/u.php

What to do

  • Alert on WScript.exe executing .js, followed by encoded/obfuscated PowerShell (the two signals that opened this investigation).
  • Do not rely on domain reputation at the email front — the visible domain is doubleclick.net, which gateways allowlist. Inspect the redirect target and fragment instead.
  • Detect the loader's host profiling: WMI enumeration of installed AV on first beacon, plus WMI and direct registry reads probing for NVIDIA (GTX/RTX) and AMD (Radeon) GPUs.
  • Flag outbound POSTs of email=<address> to unfamiliar u.php-style endpoints, and runtime logo lookups against Clearbit/logo.dev from a browser rendering a local HTML attachment.

Caveats

The malware is explicitly unidentified — the page names no family. The GPU-detection purpose is unconfirmed: Huntress offers crypto-mining follow-on or masquerading as possibilities, not a conclusion.

Organisations named here

  • NtManageHotPatch

Technologies named here

  • Huntress SOC
  • WScript.exe / JScript
  • Microsoft Defender
  • PowerShell
  • Microsoft .NET Framework v4.0.30319
  • MSBuild.exe
  • InstallUtil.exe
  • WMI
  • schtasks
  • Rfc2898DeriveBytes
  • protobuf-net
  • Group Policy Object / Active Directory
  • DMARC, DKIM, SPF
  • Email security gateway
  • Safe Links / Safe Attachments
  • Huntress GitHub IOC repository
  • .NET
  • Windows Defender
  • Windows

Techniques named here

  • Malspam initial access
  • Redirector/reputation evasion via DoubleClick
  • Dynamic lure personalization
  • Multi-stage script relocation
  • Static evasion via junk code and obfuscation
  • Reflective .NET assembly loading
  • Signed binary proxy execution / process hollowing
  • Anti-analysis / anti-sandbox checks
  • Anti-analysis connectivity/offline check
  • Defender/AV tampering
  • AMSI bypass via hot-patch API abuse
  • ETW patching/no-op
  • API name obfuscation
  • Custom stream cipher payload decryption
  • TripleDES + GZip resource decryption
  • Protobuf-serialized configuration blob
  • Hardware/AV fingerprinting
  • UAC bypass via elevation prompt
  • Persistence via registry Run/RunOnce and scheduled tasks
  • NVIDIA-themed masquerading
  • In-memory/fileless payload delivery
  • Self-cleanup and anti-forensics
  • Mutex-based single instance enforcement

Threat actors named here

  • Unidentified .NET loader

Related in Malware & RE