# Inside .NET Loader Analysis: From Malspam to In-Memory Loader

Malspam HTML lure routed via DoubleClick delivered a JScript/PowerShell chain that reflectively loaded a .NET stager, giving attackers C2 control of the host.

- Payout: Real-world hack
- Program: Huntress SOC incident
- Analysis by: Huntress
- Disclosed: 2026-06-03
- Write-up quality: 8/10
- Original: https://www.huntress.com/blog/malspam-to-loader-delivery-chain-analysis
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-malspam-to-loader-delivery-chain-analysis
- Tags: area:os domain:desktop impact:internal-access impact:rce kind:incident platform:threat-intel tech:email tech:windows technique:chained technique:source-review vuln:misconfiguration vuln:rce

**Target:** Windows endpoint via malspam HTML attachment and .NET loader
**Root cause:** A zero-second meta-refresh HTML attachment abused high-reputation DoubleClick as a redirector to a personalized malspam kit; the delivered ZIP's JScript loader relocated itself to C:\Users\Public, dropped obfuscated PowerShell, and reflectively loaded a .NET stager that disabled defenses and injected payloads via RunPE.
**Steps:**
1. Victim opens `Bestellung_2026.html` containing a zero-second meta-refresh to `ad.doubleclick[.]net/ddm/trackclk/N4892.5020.4774291382421/B23999293.271539123` with `dc_trk_aid=466016770&dc_trk_cid=131101292`
2. DoubleClick forwards to `fostercareintheus.optimizationprime[.]com/b#<base64-email>`, which decodes and forwards to `hxxps://bth.startthewave[.]org/a/#<plaintext-email>`
3. Clicking `PDF herunterladen` calls `downloadFile()`, POSTing `email=<address>` to `hxxps://pengajian.muliastudy[.]com/images/edu/u.php`, which returns `A021185521S210008-11521.zip`
4. Extracted `A021185521S210008-11521.js` runs via WScript, copies itself to `C:\Users\Public\ktncm.js`, relaunches with `wscript.exe //nologo`
5. Script repairs base64 blob via `vjwNvhDoHz()`, writes `C:\Users\Public\nlbzl.ps1`, runs `powershell -ExecutionPolicy Bypass -file`
6. nlbzl.ps1 checks connectivity, sweeps for analysis tools (reboots on hit), downloads `03.txt` via WebClient, splits on `%x%`, writes `C:\Users\Public\zkrbx.txt`, builds `shmvg_01.ps1`
7. shmvg_01.ps1 reflectively loads `ClassLibrary3.Class1.prFVI` with `InstallUtil.exe` path and URLs `PeNo` and `bl.txt` as args to `prFVI`
8. txt stager performs anti-VM/debugger checks, disables Defender, downloads `01.txt`/`02.txt`/`bl.txt`, sets Run/RunOnce and Startup persistence, then RunPE-injects into InstallUtil.exe or MSBuild.exe
**How found:** SOC process-execution signal for WScript.exe running a suspicious .js, followed by heavily encoded PowerShell; analysts deobfuscated the chain and reverse-engineered each stage.
**Exploitation:** End-to-end: phishing lure → DoubleClick redirect → personalized kit → ZIP with JScript loader → PowerShell dropper → .NET stager → RunPE injection into signed Microsoft binaries (InstallUtil.exe/MSBuild.exe) → C2 over AES/protobuf TCP with RSA key exchange and pinned certs, giving full remote control.
**Escalation:** Stager elevates via UAC (`cmd /k START "" "<self>" & EXIT` with runas), adds Defender exclusions, patches AMSI/ETW, and installs repeating scheduled tasks (PT{8-11}M) for persistence.
**Insight:** High-reputation ad/tracking domains (DoubleClick) are effective redirector fronts because email gateways rarely block them; also, kits that personalize via URL fragment email can be fingerprinted by stripping the fragment to see the fallback redirect.

## Proof of concept (copied exactly from the original report)

**TripleDES key/IV and cipher parameters for unpacking**

```
The TripleDES parameters:

- Key: lHxoBf+5Ft6YrDx4FyDWwg==
 
- IV: nFukcUaa5h0=

The decrypted payload is a .NET assembly that is itself protected by another instance of the same XOR/LZX encryption
```

**Hardcoded C2 certificate pin hashes and AES password**

```
The AES key is derived from the P@55w0rd! password using Rfc2898DeriveBytes (PBKDF2). RSA is used for the initial key exchange, and the loader pins the server's identity using five embedded SHA-256 certificate hashes:

- D5B7247C497788CF0031CEB06E3DF77A45FEF59F1E49633DC7159816D64759B5
 
- C61B1941CF756EB7551F7C661743802362728B785ADC22E860D269713DFB01A6
 
- C356AFF1A01C2B0DA472E584C8E3C8F875B9A24280435D42836A77B19F5A8C18
 
- F1C3EBE78BD8C38559BF3CFCC9A9FA37D221E31780774A3787E26160A61F5348
 
- E91FB249AA97BE5C7931E430781167EDFE7BA804720B5F643E6AB70B7E6E74DD
```

**AMSI/ETW patch byte sequences**

```
it resolves NtManageHotPatch from ntdll.dll and overwrites its prologue with a stub that returns STATUS_NOT_SUPPORTED (0xC00000BB). On 64-bit systems, the patch is mov eax, 0xC00000BB; ret; on 32-bit, mov eax, 0xC00000BB; ret 0x10. Before writing, it verifies the function prologue is intact by checking for 0x4C 0x8B (64-bit) or 0xB8 (32-bit) as the first bytes. This targets the hot-patch-based AMSI loading mechanism introduced in Windows 11 24H2.

Separately, on 64-bit systems, the loader patches EtwEventWrite by pattern-scanning ntdll.dll for its function prologue signature (with wildcard bytes for relocatable offsets) and overwriting the entry point with xor rax, rax; ret, making all ETW event logging a no-op.
```