Study guide
12.5 .NET Managed Malware Analysis & the GOOTLOADER Fileless Infection Chain
Computer Hacking Forensic Investigator CHFI 312-49
Track your progress as you read
Finished sections get a check mark.
1 Chapter 1: Foundations of Digital Forensics & Cybercrime Investigation
1.1 Cybercrime Classifications, Forensic Science Principles & Legal Admissibility 1.2 RFC 3227 Order of Volatility, Live vs. Dead Acquisition & Forensic Readiness 1.3 Indicators of Compromise (IoCs), Cyber Attribution & Threat Intelligence 1.4 AI-Assisted Forensics, GitOps, Automation/Orchestration & Forensics-as-a-Service (FaaS)
2 Chapter 2: Modern Forensic Environments & Emerging Threats
2.1 Fileless Malware, In-Memory Execution & Living-off-the-Land (LotL) 2.2 IoT & Operational Technology (OT/SCADA) Forensic Fundamentals 2.3 Dark Web, Tor Network, Onion Routing & Hidden Services Forensics 2.4 Blockchain Transactions, Cryptocurrency Tracing & Digital Asset Investigations
3 Chapter 3: Legal Frameworks, Search Warrants & Evidence Rules
3.1 Federal Rules of Evidence (FRE 702, 901, 902, 1001-1003) & Daubert/Frye Standards 3.2 Fourth Amendment, Warrant Exceptions, Workplace Search & Consent Protocols 3.3 International Standards: ISO/IEC 27037, ACPO Principles & ENFSI Guidelines 3.4 Cybercrime Statutes, Privacy Compliance, CAN-SPAM & International Cooperation
4 Chapter 4: eDiscovery, Chain of Custody & Professional Ethics
4.1 Electronic Discovery Reference Model (EDRM) & Legal Spoliation Holds 4.2 Chain of Custody Documentation, Evidence Packaging & Tamper-Evident Handling 4.3 Expert Witness Testimony, Report Writing Standards & EC-Council Code of Ethics
5 Chapter 5: Storage Architecture, Boot Sequences & Media Forensics
5.1 Storage Media Architecture: Sectors, Clusters, RAM/File Slack & Unallocated Space 5.2 Partition Tables & Boot Structures: MBR, GPT, VBR, BIOS vs. UEFI Secure Boot 5.3 RAID Reconstruction (RAID 0, 1, 5, 6, 10) & SSD Forensic Challenges (TRIM, Wear Leveling)
6 Chapter 6: Windows File Systems: NTFS & FAT
6.1 NTFS Architecture: Master File Table ($MFT) Record Structure & Attribute Headers 6.2 NTFS Artifacts: Alternate Data Streams (ADS), Volume Shadow Copies (VSS) & $LogFile 6.3 FAT12/16/32 and exFAT Architecture, Directory Entries & File Deletion Mechanics
7 Chapter 7: Non-Windows File Systems & File Signatures
7.1 Linux File Systems: ext2/ext3/ext4 Inode Architecture, Superblocks & Journaling Forensics 7.2 macOS File Systems: HFS+ and Apple File System (APFS) Architecture & Snapshots 7.3 File Signatures, Magic Bytes, Hex Headers/Footers & File Carving Techniques
8 Chapter 8: Investigation Lifecycle, Lab Setup & First Response
8.1 Forensic Laboratory Accreditation: ISO/IEC 17025 Standards & Hardware/Software Controls 8.2 First Responder Duties: Crime Scene Containment, Electronic Triage & Volatile Triage 8.3 Physical Evidence Packaging, Anti-Static/Faraday Protection & Transport Security
9 Chapter 9: Forensic Acquisition & Verification Methodology
9.1 Hardware and Software Write-Blockers: Operational Validation & Bridge Verification 9.2 Bit-Stream Disk Imaging, Physical vs. Logical vs. Targeted Acquisition Methodology 9.3 Forensic Image Formats (RAW/DD, E01, AFF) & Cryptographic Hashing Verification (MD5, SHA-256)
10 Chapter 10: Anti-Forensics Techniques & Countermeasures
10.1 Steganography Detection: Spatial/Frequency Domain Steganalysis & Hidden Carrier Extraction 10.2 Timestomping Countermeasures: Comparing $STANDARD_INFORMATION vs $FILE_NAME Timestamps 10.3 Secure Wiping, Degaussing, File Shredding Countermeasures & Residual Artifact Recovery
11 Chapter 11: Windows Operating System Forensics
11.1 Windows Registry Forensics: SYSTEM, SOFTWARE, SAM & NTUSER.DAT Hive Analysis 11.2 Execution Artifacts: Prefetch (.pf), Shimcache (AppCompatCache), Amcache.hve & UserAssist 11.3 User Activity Artifacts: ShellBags, LNK Shortcut Files, Jump Lists & Recycle Bin ($I/$R) 11.4 Windows Event Log Forensics: Security Audit IDs (4624, 4625, 4688, 4720, 7045) & EVTX Parsing
12 Chapter 12: Memory Forensics & Malware Analysis
12.1 Volatile Memory Acquisition: RAM Capture, Crash Dumps, Hiberfil.sys & Pagefile.sys 12.2 Memory Analysis with Volatility 3: pslist, pstree, malfind, netscan & Vadinfo 12.3 Static Malware Triage: Strings, PE Headers, Import Tables, Hashes & YARA Rule Matching 12.4 Dynamic Malware Analysis: Sandboxing, Process Monitor (Procmon), Regshot & Network Callouts 12.5 .NET Managed Malware Analysis & the GOOTLOADER Fileless Infection Chain
13 Chapter 13: Network, Web Application & Email Forensics
13.1 Network Forensics: PCAP Analysis, Protocol Dissection, Snort/Suricata & Flow Analysis 13.2 Web Server Forensics: Apache/IIS Access Logs, SQL Injection, XSS & Web Shell Detection 13.3 Email Forensics: RFC 5322 Headers, Authentication (SPF, DKIM, DMARC) & Mbox/PST Extraction 13.4 SIEM Event Correlation, Cross-Source Timeline Analysis & Super-Timeline Construction 13.5 Investigating Directory Traversal, Command Injection, Parameter Tampering, XXE, Cookie Poisoning & Brute Force 13.6 Network Device & Service Log Forensics: Firewall, IDS, Honeypot, Router, DHCP, Switch, VPN, DNS & SSH 13.7 Wireless Network Forensics: Rogue APs, Evil Twins, MAC Spoofing, Deauthentication & Jamming
14 Chapter 14: Mobile, Cloud & IoT Forensics
14.1 Mobile Device Forensics: Manual, Logical, File System & Physical Extraction (Android/iOS) 14.2 Mobile Artifact Analysis: Call Logs, SMS/Chat SQLite Databases, Location Data & Plists 14.3 Cloud Forensics: AWS CloudTrail, Azure Activity Logs & Multi-Tenant Evidence Collection 14.4 IoT Forensics: UART/JTAG Physical Interfaces, Firmware Extraction & Sensor Telemetry
15 Chapter 15: Commercial & Open-Source Forensic Suites
15.1 Commercial Forensic Platforms: EnCase Forensic, FTK (Forensic Toolkit) & FTK Imager 15.2 Open-Source Forensic Platforms: Autopsy, The Sleuth Kit (TSK) & SIFT/CAINE Workstations 15.3 Specialized DFIR Utilities: Eric Zimmerman Tools (EZ Tools) & Sysinternals Forensic Suite
16 Chapter 16: Analysis Toolkits, Python Scripting & Tool Validation
16.1 Reverse Engineering & Password Cracking: Ghidra, IDA Pro, Hashcat & John the Ripper 16.2 Python for Digital Forensics: Parsing Raw Artifacts, Custom Scapy Scripts & Evidence Automation 16.3 Forensic Tool Testing & Validation: NIST CFTT Methodology, ISO/IEC 17025 Standards & Daubert Compliance
17 Chapter 17: Database Forensics & Web Application Firewalls
17.1 MySQL Forensics: Internal Architecture, Data Directory, Information Schema & Utility Programs 17.2 SQL Server Forensics: SSMS, ApexSQL, SQLCMD Transaction-Log Collection, Plan Cache & Trace Files 17.3 Web Application Firewall (WAF) Architecture, Audit Logs, Benefits & Limitations
18 Chapter 18: Social, Virtualized, Multimedia & Browser Investigations
18.1 Social Media, Social Engineering, Insider Threat & Identity Theft Forensics 18.2 Virtualization, Container & Microservices Forensics, Bluetooth and Electron Chat Applications 18.3 Multimedia Forensics: Image, Audio & Video Authentication, EXIF, PRNU and Deepfake Detection 18.4 Browser Artifact Recovery, Private Browsing, USB Enumeration, Partition Recovery & Packer Unpacking Tools
12.5 .NET Managed Malware Analysis & the GOOTLOADER Fileless Infection Chain
Key Takeaways Explain This Topic AI
A .NET assembly is identified by the CLR header in Data Directory entry 14 (COM Descriptor) of the PE optional header plus a single imported function, mscoree.dll!_CorExeMain, so the PE is managed even though native disassembly of it is meaningless.
.NET binaries decompile to near-original C# with dnSpyEx or ILSpy, and de4dot reverses common obfuscators such as ConfuserEx, making managed malware far cheaper to reverse than native code.
Reflective loading via Assembly.Load(byte[]) executes a payload entirely from memory with no file written to disk, which is why .NET is the dominant stager format for fileless attacks.
GOOTLOADER arrives by SEO poisoning of compromised WordPress sites, delivers a ZIP containing one heavily obfuscated JScript file, and is executed by wscript.exe from the user's Downloads or AppData path.
GOOTLOADER stages its next-stage payload as hex-like encoded values under HKCU\SOFTWARE\Microsoft\Phone keyed on the username, reassembles the chunks with PowerShell, and persists through a scheduled task named after the user that runs at logon.
Last updated: September 2026
12.5 .NET Managed Malware Analysis & the GOOTLOADER Fileless Infection Chain
Quick Answer: Blueprint v4 names both the infection chain of .NET malware / analyzing .NET malware (Domain 1) and fileless malware analysis: GOOTLOADER (Domain 5). A .NET assembly is a managed PE: it carries a CLR header at Data Directory index 14 and typically imports exactly one function, mscoree.dll!_CorExeMain . Because it compiles to MSIL rather than machine code, it decompiles back to near-source C# with dnSpyEx or ILSpy , and de4dot strips common obfuscators. GOOTLOADER is the canonical fileless chain: SEO-poisoned WordPress pages serve a ZIP containing a single obfuscated .js file , wscript.exe executes it, encoded payload chunks are written under HKCU\SOFTWARE\Microsoft\Phone , PowerShell reassembles and reflectively loads them, and a scheduled task named after the user provides logon persistence.
Recognizing a Managed (.NET) Portable Executable
Native triage techniques mislead on managed binaries. A .NET sample disassembled in a native disassembler shows a tiny, meaningless stub, and its import table looks almost empty — analysts new to managed malware often conclude the file is packed when it is simply compiled to intermediate language.
The Three Reliable Identification Signals
Signal Where to look Value
CLR / COM Descriptor directory PE Optional Header, Data Directory entry 14 Non-zero RVA and size = managed assembly
- Single import Import Address Table mscoree.dll importing _CorExeMain (EXE) or _CorDllMain (DLL)
- Metadata signature Metadata root inside the .text section ASCII BSJB ( 42 53 4A 42 )
Additional confirmations: the entry-point stub is a 6-byte jmp thunk into mscoree , the section layout is dominated by .text with little .data , and the #Strings and #US metadata heaps contain readable identifier and user-string data that native strings will surface as clean class and method names.
The Managed Analysis Toolchain
- Tool Function
- dnSpyEx Decompile MSIL to C#, edit assemblies, and set breakpoints for managed debugging — the workhorse
- ILSpy Read-only decompiler; scriptable and cross-platform via ilspycmd
- de4dot Automated deobfuscator that recovers names and removes control-flow flattening from known obfuscators
- dotPeek JetBrains decompiler with symbol-server export
- monodis / ikdasm Command-line IL disassembly for scripted triage
Obfuscation you will meet: ConfuserEx (control-flow flattening, constant encryption, anti-tamper, and anti-debug), .NET Reactor , SmartAssembly , and Eazfuscator . de4dot detects the obfuscator from its watermark and reverses the common transforms; what remains after de4dot is usually readable enough to extract configuration, C2 URLs, and mutex names directly.
Why Attackers Choose .NET for Fileless Staging
The decisive capability is reflective assembly loading : byte[] payload = Convert.FromBase64String(encodedBlob);
- Assembly asm = Assembly.Load(payload); // never touches disk
- MethodInfo entry = asm.EntryPoint;
- entry.Invoke(null, new object[] { new string[] {} });
Assembly.Load(byte[]) maps and executes an entire program from a byte array in memory . No file is written, so file-based antivirus scanning and application allow-listing that gate on disk paths are both bypassed. The same primitive is exposed in PowerShell as [Reflection.Assembly]::Load($bytes) , which is why so many PowerShell droppers are really .NET loaders.
Forensic consequence: the payload exists only in the process address space of a legitimate host ( powershell.exe , wscript.exe , msbuild.exe , regsvr32.exe ). It is recoverable from a memory image — windows.malfind locates the injected private-committed regions, and windows.dumpfiles or a Volatility 3 VAD dump extracts the assembly, whose BSJB signature confirms it is managed.
GOOTLOADER: The Blueprint's Named Fileless Case Study
GOOTLOADER (tracked with the GootKit family and by Mandiant as UNC2565) is the exam's reference fileless chain because every stage exercises a different artifact class.
Stage 1 — SEO Poisoning as Initial Access
The operators compromise legitimate WordPress sites at scale and inject a conditional content system. A visitor arriving from a search engine on a narrow query — characteristically legal and business document phrasing such as " non-disclosure agreement template [jurisdiction] " — is served a fake forum thread in which a helpful "administrator" posts a direct download link. Direct visitors and non-matching referrers receive the site's genuine content, which is why the malicious page is invisible to casual verification and to many crawlers.
Artifacts: browser history and download records showing a search-engine referrer, a forum-styled URL on an unrelated legitimate domain, and a downloaded ZIP whose name matches the searched document topic.
Stage 2 — The ZIP and the Lone JScript File
The archive contains a single .js file , typically named for the document the victim was seeking. Windows executes .js through wscript.exe on double-click. The script is heavily obfuscated with large volumes of junk code and string-splitting, and later variants have concatenated the malicious logic into legitimate open-source JavaScript libraries so that a reviewer skimming the file sees recognizable framework code.
Artifacts: %UserProfile%\Downloads\*.zip , the extracted .js under Downloads or %AppData%\Roaming , WSCRIPT.EXE-*.pf Prefetch entries, and a .js file path recorded in RecentDocs and Jump Lists.
Stage 3 — Registry Payload Staging
Rather than write an executable to disk, the script writes its next stage into the registry as encoded values:
Payload blobs are created under HKCU\SOFTWARE\Microsoft\Phone , in keys named after the current username (commonly <username> and <username>0 ).
The blob is split across multiple values — frequently around seven — that must be concatenated in order.
A custom substitution encoding maps letters to hexadecimal nibbles, so the values look like innocuous alphabetic data rather than obvious hex or Base64.
The FONELAUNCH .NET loader stage reads those values, decodes them, and reflectively loads the final payload — historically Cobalt Strike, GootKit, IcedID, or ransomware precursors — into memory.
Important
This is the whole point of "fileless." The executable payload never exists as a file. It lives in NTUSER.DAT as data, is reassembled by an interpreter that Windows ships and trusts, and executes inside a signed Microsoft process. Disk-only antivirus scanning, file-hash blocklists, and path-based allow-listing all fail against it. The registry hive is therefore primary evidence , not supporting metadata.
Stage 4 — Persistence and Execution
wscript.exe spawns PowerShell, which creates a scheduled task named after the current account configured to run at user logon , re-executing the PowerShell that queries the registry, reassembles the chunks, and reflectively loads the payload. Long sleep intervals and staged beaconing spread the activity over hours to defeat sandbox timeouts and burst-based detection.
The GOOTLOADER Artifact Checklist
Artifact source What to look for
Browser history / downloads Search-engine referrer into an unrelated WordPress domain; ZIP download matching a document-template query
Filesystem Single .js in Downloads or %AppData%\Roaming ; $MFT and $UsnJrnl entries for creation and later deletion
- Prefetch WSCRIPT.EXE-*.pf and POWERSHELL.EXE-*.pf with execution timestamps bracketing the infection
- Registry Encoded value blobs under HKCU\SOFTWARE\Microsoft\Phone\<username> and <username>0 in NTUSER.DAT
- Scheduled tasks Task named for the user in C:\Windows\System32\Tasks\ ; Task Scheduler operational log
Event logs 4688 process creation showing wscript.exe → powershell.exe ; 4104 PowerShell ScriptBlock logging capturing the decoder; 4103 module logging
Memory Injected private-commit regions in powershell.exe ; BSJB -signed managed assemblies recoverable with windows.malfind and VAD dumps
Reconstructing the Chain
Acquire memory first — the reflectively loaded assembly exists nowhere else.
Export NTUSER.DAT and parse the Software\Microsoft\Phone subkeys; carve the value blobs in order.
Reverse the substitution encoding to recover the encoded assembly, then confirm BSJB and decompile with dnSpyEx to extract C2 configuration.
Correlate 4688 parent-child chains and 4104 script blocks against Prefetch and scheduled-task creation timestamps to fix the infection time.
Pivot on the recovered C2 indicators through proxy and DNS logs to scope lateral movement and identify other infected hosts.