# Multi-Stage Cobalt Strike Loader Deploys Stageless Beacon via Anti-Sandbox .NET Chain

> Joe Security documents a three-stage infection chain in which a .NET loader uses a domain-join check to evade sandboxes before decrypting and reflectively loading a stageless Cobalt Strike beacon (protocol version 0x56) that uses RSA-1024/AES-CBC/HMAC-SHA256 for C2 and supports in-memory execution, desktop takeover, and token impersonation.

- **Published:** 2026-09-12T00:00:00Z
- **Last reviewed:** 2026-09-12T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2457
- **ID:** TL-2026-2457
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 8 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Joe Security's technical analysis walks a three-stage infection chain recovered from the sample G1kkgNRuTw.dll (SHA-256 4e791c25ea3e6fe490e9b53a1b13eaafef56d9cfc75930b380fc49fb843212b9). Stage 1 is a .NET loader that checks System.Environment.UserDomainName to confirm the host is domain-joined before proceeding -- an anti-sandbox gate that the researchers bypassed only by running the sample in Joe Sandbox Cloud Pro. Once the check passes, the loader extracts an embedded payload from the final line of the file, reverses the string, Base64-decodes it, and applies an XOR decryption pass. It then suspends iexplore.exe and injects the decrypted Stage 2 payload into it via NtMapViewOfSection (process hollowing).

Stage 2 is a small in-memory loader; the researchers reconstructed it from a memory dump using x64dbg, mapping sections, fixing relocations, and rebuilding the import table before it transfers execution to Stage 3: a stageless Cobalt Strike Beacon, protocol/build version 0x56, with its full configuration embedded rather than staged from the network.

The beacon authenticates and exchanges an AES session key with its controller using RSA-1024 (PKCS#1 v1.5), then encrypts command/response traffic with AES-CBC and authenticates it with a 16-byte HMAC-SHA256 tag. Check-ins are HTTP GET requests to /rest/funcStatus carrying RSA-encrypted host/session metadata, with tasking retrieval over a POST endpoint at /rest/policy/3/; both paths ride a hardcoded legacy Internet Explorer User-Agent. C2 was configured to microsoft.otp[.]lu and analytics.green-it[.]lu, with a 10-second sleep interval (adjustable up to 98 seconds via tasking) and 42% jitter. The extracted configuration carries license watermark 1802994334, and beacon network packets embed a 0x0000BEEF magic marker used to identify traffic. When the beacon spawns helper processes for injection it masquerades them as %windir%\syswow64\WerFault.exe (x86) or %windir%\sysnative\WerFault.exe (x64) -- Windows Error Reporting's legitimate binary name and path, chosen to blend into normal process trees.

The recovered beacon configuration exposes the full standard Cobalt Strike Beacon command set (37+ commands): interactive shell and process management, in-memory PE execution, file read/write/delete/list, socket/tunneling primitives, screenshot capture and desktop enumeration/switching for GUI takeover, process enumeration/termination, and access-token manipulation for impersonation. Two additional VirusTotal-linked samples (dff61a394c14f23537b490f7ea1530a456c57bca24bfc317691ce118aa34ee6a and 8bf7886775bfd69b6867b44a6bad2ee06df4243d814c6245975e78bb1ca2f4ab) were identified as related via the same loader/config family. No CVE or software vulnerability is involved -- this is an abuse of the legitimate Cobalt Strike red-team framework via a custom anti-analysis loader, and no named threat actor or campaign is attributed in the source reporting.

## MITRE ATT&CK

- T1497.001 System Checks
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1055.012 Process Hollowing
- T1036.005 Match Legitimate Resource Name or Location
- T1620 Reflective Code Loading
- T1134.003 Make and Impersonate Token
- T1113 Screen Capture
- T1059.003 Windows Command Shell
- T1106 Native API
- T1071.001 Web Protocols
- T1573.001 Symmetric Cryptography
- T1573.002 Asymmetric Cryptography
- T1572 Protocol Tunneling
- T1057 Process Discovery
- T1049 System Network Connections Discovery
- T1046 Network Service Discovery

## Sources

- [Deep Malware Analysis of a Multi-Stage Cobalt Strike Loader](https://www.joesecurity.org/blog/621128515416801396)
- [Cobalt Strike, Software S0154](https://attack.mitre.org/software/S0154/)
- [Reflective Code Loading, Technique T1620](https://attack.mitre.org/techniques/T1620/)
- [Virtualization/Sandbox Evasion: System Checks, Technique T1497.001](https://attack.mitre.org/techniques/T1497/001/)
- [Process Injection: Process Hollowing, Technique T1055.012](https://attack.mitre.org/techniques/T1055/012/)
- [Mining data from Cobalt Strike beacons](https://www.nccgroup.com/research/mining-data-from-cobalt-strike-beacons/)
- [Cobalt Strike Beacon | Cobalt Strike Features](https://www.cobaltstrike.com/product/features/beacon)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2457