.NET Workflow: A Short Example

Typical triage of a suspected .NET sample:

# 1. Confirm it is managed (look for the CLR header / mscoree)
file sample.exe
# "PE32 executable ... Mono/.Net assembly"

# 2. Deobfuscate first (cleaner decompilation)
de4dot sample.exe -o sample-clean.exe

# 3. Open in dnSpyEx: read Main(), follow the logic
#    - locate string-decryption routine
#    - find where a byte[] is Assembly.Load()-ed  <-- in-memory stage 2

# 4. Debug: breakpoint AFTER decryption, dump the
#    decrypted byte[] to disk, then analyze stage 2.

• Key move: let the malware decrypt its own next stage, then grab it from memory at the breakpoint.