Multi-Stage Cobalt Strike Loader Deploys Stageless Beacon via Anti-Sandbox .NET Chain

Key facts for Cobalt Strike .NET reflective loader

Detection coverage for Cobalt Strike .NET reflective loader

As of 2026-09-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2457 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Process Hollowing Injection Into iexplore.exe via NtMapViewOfSection

Detects a non-standard parent process opening a high-access handle to iexplore.exe and mapping a section into it, consistent with the Stage 1 .NET loader's process-hollowing technique used to inject the decrypted Stage 2 payload documented in Joe Security's multi-stage Cobalt Strike loader analysis.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1055.012, T1620, T1497.001
• Data sources: sysmon, microsoft_defender_for_endpoint
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=10 TargetImage="*\\iexplore.exe"
| search GrantedAccess IN ("0x1F3FFF","0x1FFFFF","0x1F0FFF","0x1410","0x143A")
| eval src_is_legit=if(match(SourceImage,"(?i)\\\\(explorer|iexplore|svchost)\\.exe$"),1,0)
| where src_is_legit=0
| join type=inner ComputerName, TargetProcessId [
    search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 Image="*\\iexplore.exe"
    | rename ProcessId as TargetProcessId
    | table ComputerName, TargetProcessId, ParentImage, CommandLine
]
| stats count min(_time) as first_seen max(_time) as last_seen by ComputerName, SourceImage, TargetImage, GrantedAccess, ParentImage
| where count > 0

Microsoft KQL

DeviceEvents
| where Timestamp > ago(24h)
| where ActionType == "ProcessAccessed" or ActionType == "CreateRemoteThreadApiCall"
| where FileName =~ "iexplore.exe" or RemoteProcessFileName =~ "iexplore.exe"
| where InitiatingProcessFileName !in~ ("explorer.exe","iexplore.exe","svchost.exe")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, RemoteProcessFileName, ActionType
| order by Timestamp desc

Sigma

title: Process Hollowing Injection Into iexplore.exe via NtMapViewOfSection
id: 7a2c1e34-9f3b-4c1a-8b6e-1d2f3a4b5c6d
status: experimental
description: Detects a non-standard process opening a high-privilege handle to iexplore.exe and mapping a section into it, matching the Cobalt Strike loader's Stage 1 process-hollowing injection documented by Joe Security.
references:
    - https://www.joesecurity.org/blog/621128515416801396
    - https://attack.mitre.org/techniques/T1055/012/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-12
tags:
    - attack.defense-evasion
    - attack.t1055.012
    - attack.t1620
    - attack.t1497.001
    - attack.tool.cobalt_strike
logsource:
    category: process_access
    product: windows
detection:
    selection_access:
        TargetImage|endswith: '\iexplore.exe'
        GrantedAccess:
            - '0x1F3FFF'
            - '0x1FFFFF'
            - '0x1F0FFF'
    filter_legit:
        SourceImage|endswith:
            - '\explorer.exe'
            - '\iexplore.exe'
            - '\svchost.exe'
    condition: selection_access and not filter_legit
falsepositives:
    - Security or EDR agents legitimately opening handles to iexplore.exe for scanning purposes
level: high

Known false positives:

• Security/EDR agents or debuggers legitimately opening high-access handles into iexplore.exe for inspection or scanning

Tuning notes: Tighten GrantedAccess to the exact rights pair used by NtMapViewOfSection-based hollowing (PROCESS_VM_WRITE|PROCESS_VM_OPERATION) in your environment and add an allow-list for known EDR/AV process names that legitimately touch browser processes.

• 🔒 Unsigned .NET Assembly From User-Writable Path Spawning iexplore.exe · unlock with TL Creds
• 🔒 Token Impersonation Privilege Use by Injected iexplore.exe or WerFault.exe · unlock with TL Creds
• 🔒 Periodic Low-Jitter Beaconing to Known Cobalt Strike C2 Domains · unlock with TL Creds
• 🔒 .NET Assembly-Execution Host Followed by Remote Thread Creation Into iexplore.exe · unlock with TL Creds
• 🔒 Interactive Shell or Desktop-Capture Activity Spawned From Injected iexplore.exe/WerFault.exe · unlock with TL Creds
• 🔒 Discovery Command Execution From Injected iexplore.exe/WerFault.exe (CS Beacon Recon) · unlock with TL Creds
• 🔒 WerFault.exe Spawned Without Legitimate Crash-Reporting Context (CS Masquerade) · unlock with TL Creds
• 🔒 Cobalt Strike Stageless Beacon C2 Check-in (Legacy UA / Known URIs / Domains) · unlock with TL Creds

Indicators of compromise for Cobalt Strike .NET reflective loader

As of 2026-09-12, Threadlinqs Intelligence tracks 8 indicators of compromise for TL-2026-2457.

Sample indicators (3 of 8)

• Domain: microsoft[.]otp[.]lu
• File hash: 4e791c25ea3e6fe490e9b53a1b13eaafef56d9cfc75930b380fc49fb843212b9
• Domain: analytics[.]green-it[.]lu

Defanged, TLP:CLEAR. Full set of 8 indicators: unlock with TL Creds.

How Cobalt Strike .NET reflective loader works

Joe Security's technical analysis walks a three-stage infection chain recovered from the sample G1kkgNRuTw.dll (SHA-256 4e791c25ea3e6fe490e9b53a1b13eaafef56d9cfc75930b380fc49fb843212b9). Stage 1 is a .NET loader that checks System.Environment.UserDomainName to confirm the host is domain-joined before proceeding -- an anti-sandbox gate that the researchers bypassed only by running the sample in Joe Sandbox Cloud Pro. Once the check passes, the loader extracts an embedded payload from the final line of the file, reverses the string, Base64-decodes it, and applies an XOR decryption pass. It then suspends iexplore.exe and injects the decrypted Stage 2 payload into it via NtMapViewOfSection (process hollowing).

Stage 2 is a small in-memory loader; the researchers reconstructed it from a memory dump using x64dbg, mapping sections, fixing relocations, and rebuilding the import table before it transfers execution to Stage 3: a stageless Cobalt Strike Beacon, protocol/build version 0x56, with its full configuration embedded rather than staged from the network.

The beacon authenticates and exchanges an AES session key with its controller using RSA-1024 (PKCS#1 v1.5), then encrypts command/response traffic with AES-CBC and authenticates it with a 16-byte HMAC-SHA256 tag. Check-ins are HTTP GET requests to /rest/funcStatus carrying RSA-encrypted host/session metadata, with tasking retrieval over a POST endpoint at /rest/policy/3/; both paths ride a hardcoded legacy Internet Explorer User-Agent. C2 was configured to microsoft.otp[.]lu and analytics.green-it[.]lu, with a 10-second sleep interval (adjustable up to 98 seconds via tasking) and 42% jitter. The extracted configuration carries license watermark 1802994334, and beacon network packets embed a 0x0000BEEF magic marker used to identify traffic. When the beacon spawns helper processes for injection it masquerades them as %windir%\syswow64\WerFault.exe (x86) or %windir%\sysnative\WerFault.exe (x64) -- Windows Error Reporting's legitimate binary name and path, chosen to blend into normal process trees.

The recovered beacon configuration exposes the full standard Cobalt Strike Beacon command set (37+ commands): interactive shell and process management, in-memory PE execution, file read/write/delete/list, socket/tunneling primitives, screenshot capture and desktop enumeration/switching for GUI takeover, process enumeration/termination, and access-token manipulation for impersonation. Two additional VirusTotal-linked samples (dff61a394c14f23537b490f7ea1530a456c57bca24bfc317691ce118aa34ee6a and 8bf7886775bfd69b6867b44a6bad2ee06df4243d814c6245975e78bb1ca2f4ab) were identified as related via the same loader/config family. No CVE or software vulnerability is involved -- this is an abuse of the legitimate Cobalt Strike red-team framework via a custom anti-analysis loader, and no named threat actor or campaign is attributed in the source reporting.

MITRE ATT&CK techniques by tactic:

Stealth

T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1055.012 Process Hollowing; T1140 Deobfuscate/Decode Files or Information; T1497.001 System Checks; T1620 Reflective Code Loading

Discovery

T1046 Network Service Discovery; T1049 System Network Connections Discovery; T1057 Process Discovery

Execution

T1059.003 Windows Command Shell; T1106 Native API

Command and Control

T1071.001 Web Protocols; T1572 Protocol Tunneling; T1573.001 Symmetric Cryptography; T1573.002 Asymmetric Cryptography

Collection

T1113 Screen Capture

Privilege Escalation

T1134.003 Make and Impersonate Token

Remediation for Cobalt Strike .NET reflective loader

Immediate actions

• Block C2 domains microsoft.otp.lu and analytics.green-it.lu (and their resolved IPs) at DNS, proxy, and perimeter firewall
• Hunt for and isolate hosts with SHA-256 4e791c25ea3e6fe490e9b53a1b13eaafef56d9cfc75930b380fc49fb843212b9 (G1kkgNRuTw.dll) or the two related VirusTotal-linked hashes
• Alert on outbound HTTP requests to /rest/funcStatus or /rest/policy/3/ paired with the legacy MSIE 7.0/.NET CLR 2.0.50727 User-Agent string

Workarounds

• Enforce application allow-listing to block unsigned .NET binaries executing from user-writable directories
• Restrict outbound endpoint connectivity to required destinations only, to blunt beacon C2 callbacks even if a host is compromised

Longer-term hardening

• Deploy EDR/YARA coverage for stageless Cobalt Strike beacon indicators, including license watermark 1802994334 and the 0x0000BEEF packet marker
• Detect process hollowing and NtMapViewOfSection-based injection into iexplore.exe, and flag WerFault.exe processes spawned outside the normal crash-reporting path
• Forward Sysmon/ETW telemetry centrally to catch reflective, disk-less loading of unsigned code and unexpected token-impersonation activity

Affected and fixed versions

• Microsoft — Windows (domain-joined endpoints)
  Vulnerable versions: Domain-joined Windows hosts targeted by the .NET loader; injection observed against iexplore.exe with WerFault.exe used as an x86/x64 masquerade/spawn target

Timeline of Cobalt Strike .NET reflective loader

• 2026-04-21 Joe Security publishes "Deep Malware Analysis of a Multi-Stage locked-ioc-8 Loader," documenting the full infection chain and IOCs.
• 2026-04-21 Two additional related samples are identified on VirusTotal via loader/configuration similarity to locked-ioc-7.
• 2026-04-21 Joe Security extracts the full beacon configuration, recovering license watermark 1802994334, a 10-second sleep interval, and 42% jitter.
• 2026-04-21 The beacon initiates RSA-1024/AES-CBC encrypted C2 check-ins to locked-ioc-6 and locked-ioc-4 over /rest/funcStatus.
• 2026-04-21 Stage 2 transfers execution to the embedded Stage 3 payload, a stageless locked-ioc-5 at protocol/build version 0x56.
• 2026-04-21 Researchers dump and reconstruct the in-memory Stage 2 loader as a PE file using x64dbg, mapping sections, fixing relocations, and rebuilding imports.
• 2026-04-21 Stage 1 suspends iexplore.exe and injects the decrypted Stage 2 payload into it via NtMapViewOfSection.
• 2026-04-21 Stage 1 is observed extracting the embedded payload from the file's final line, reversing the string, Base64-decoding it, and applying XOR decryption.
• 2026-04-21 Analysts identify Stage 1's domain-join check via System.Environment.UserDomainName, which gates execution and is bypassed only under Joe Sandbox Cloud Pro.
• 2026-04-21 The .NET loader sample locked-ioc-7 is submitted for analysis and detonated in Joe Sandbox Cloud.

Sources cited for Cobalt Strike .NET reflective loader

• Cobalt Strike, Software S0154 MITRE · Research · 2026-09-12
• Reflective Code Loading, Technique T1620 MITRE · Research · 2026-09-12
• Virtualization/Sandbox Evasion: System Checks, Technique T1497.001 MITRE · Research · 2026-09-12
• Process Injection: Process Hollowing, Technique T1055.012 MITRE · Research · 2026-09-12
• Mining data from Cobalt Strike beacons nccgroup.com · Research · 2026-09-12
• Cobalt Strike Beacon | Cobalt Strike Features cobaltstrike.com · Vendor report · 2026-09-12
• Deep Malware Analysis of a Multi-Stage Cobalt Strike Loader joesecurity.org · Blog · 2026-04-21

More in malware

• Evolution of C2 Infrastructure: Blockchain-Based (On-Chain) C2 and EtherHiding Adoption by UNC5142, UNC5342 and Commodity Malware (Tsundere, SleepyDuck, SharkStealer)
• ClickFix: Fake CAPTCHA/Verification Prompts Deliver Stealers, Loaders and RATs (DeerStealer, HijackLoader, AMOS, NetSupport RAT, WeaselStore)
• Certified Bad: Abuse of Extended Validation Code-Signing Certificates Shared Across Malware Families (SolarMarker et al.)
• Impostor Certificates: Threat Actors Impersonating Businesses to Obtain Code-Signing Certificates for SolarMarker and Other Malware
• SolarMarker: Actions-On-Target — On-Device Fraud via Custom VNC (Saturn) and Browser Data Theft