# Reversing Csharp And DotNET Framework
## Sample Details
***
Sample Name-Malware.cryptlib64.dll\
Malware Type- C2 Dropper
## Analysis
***
Upon running floss we see some interesting strings-
`mscorelib` is a part of a C# binary. Thus this is a C# binary and a part of the .NET framework.
### Note-
C# is part of the .NET framework. C# binaries don't interact directly with the OS but with the .NET framework. C# is executed by the CLR(common Language Runtime).\
After C# is compiled, it is converted to IL(Intermediary Language) which is further run by the CLR.
Turn on inetsim on REMnux and use DNSspy on flare-vm
On dnspy we get-
The dll has two classes - `Cryptor` and `Program`
`Cryptor`-
`Program`-
We see a base64 string in `Program` function.
Also a xml and a vbs file is being created.\
Now we run the dll using rundll32 and the main method of the dll - `embed`.
```
rundll32.exe .\Malware.cryptlib64.dll,embed
```
After running, we find the xml file -
Also a registry key has been created by the dll pointing to the vbs file-
The xml file is using MSBuild to execute malware. Running it-
It is requesting for something off of -`http://ocsp.digicert.com` and `srv.masterchiefsgruntemporium.local`.
## Conclusion
***
This is a C2 dropper from the Covenant C2 framework. When run, a grunt from the c2 framework will deliver the malware to the system.
