Granted Patent B2

US 12,554,852 · App. 18/536,826 · Granted Feb 17, 2026

Inventors: Ilya Konstantinovich Sachkov (Moscow, RU); Yury Alekseevich Tretyakov (Moscow, RU)

Assignee: GROUP-IB GLOBAL PRIVATE LIMITED

G06F21/566G06F21/54G06F21/568

Abstract

Claims (66)

1 . A computer-implemented method for detecting malware activity in a .NET platform, the method comprising:

during a preparation stage:

determining an architecture of the .NET platform, the determining comprising:

identifying a plurality of libraries in the .NET platform;

determining, for each version of each library of the plurality of libraries, a respective class from a set of predetermined classes;

determining, for each class of the predetermined set of classes, a respective .NET method of a set of predetermined .NET methods;

modifying contents of a given .NET method of the set of predetermined .NET methods by adding thereto an executable payload, thereby generating a respective modified .NET method;

storing the respective modified .NET method in the .NET platform;

in response to determining, in a native image directory of the architecture of the .NET platform, at least one native image library of one of the predetermined set of classes, hiding the at least one native image library in the native image directory;

generating, for each one of the at least one native image library, a respective modified native image library having the executable payload,

the executable payload being configured for logging and storing data of current activities in the .NET platform;

the logging comprising: (i) logging input parameters of the at least one of the respective modified .NET method and a respective modified native image library .NET method of the respective modified native image library; and (ii) logging metainformation of a respective process having caused execution of the executable payload; and

adding respective modified native image libraries to the native image directory to be used instead of the at least one native image library; and

during an operation stage, following the preparation stage:

in response to calling, by a .NET application, at least one of: the respective modified .NET method and the respective modified native image library .NET method of the respective modified native image library in the .NET platform:

executing the executable payload to cause the logging the current activity in the .NET platform to generate an activity log,

the activity log including: (i) the input parameters of the at least one of the respective modified .NET method and the respective modified native image library NET method of the respective modified native image library; and (ii) metainformation of a process of the .NET application having caused the execution of the executable payload; and

transmitting the activity log for analysis to determine presence of the malware activity in the .NET platform.

2 . The computer-implemented method of claim 1 , wherein the set of predetermined classes comprises:

Assembly;

Process; and

WebRequest.

3 . The computer-implemented method of claim 1 , wherein the set of predetermined .NET methods comprises:

Load;

GetProcesses; and

Create.

4 . The computer-implemented method of claim 1 , wherein, prior to the modifying the contents of the given .NET method, the method further comprises accessing the respective class of the given .NET method.

5 . The computer-implemented method of claim 4 , wherein the accessing the respective class comprises executing a takeown utility.

6 . The method of claim 1 , wherein, the modifying the contents of the given .NET method comprises modifying a behavior thereof.

7 . The computer-implemented method of claim 1 , wherein, prior to the hiding the at least one native image library in the native image directory, the method further comprises accessing the at least one native image library.

8 . The computer-implemented method of claim 7 , wherein the accessing the at least one native image library comprises executing a takeown utility.

9 . The computer-implemented method of claim 1 , wherein the generating the respective modified native image library comprises executing an ngen.exe utility.

10 . A system for detecting malware activity in a .NET platform, the system comprising:

at least one hardware processor; and

at least one non-transitory computer-readable medium storing executable instructions, which, when executed by the at least one hardware processor, cause the system to:

during a preparation stage:

determine an architecture of the .NET platform, by:

identifying a plurality of libraries in the .NET platform;

determining, for each version of each library of the plurality of libraries, a respective class from a set of predetermined classes;

determining, for each class of the predetermined set of classes, a respective .NET method of a set of predetermined .NET methods;

modify contents of a given .NET method of the set of predetermined .NET methods by adding thereto an executable payload, thereby generating a respective modified .NET method;

store the respective modified .NET method in the .NET platform;

in response to determining, in a native image directory of the architecture of the .NET platform, at least one native image library of one of the predetermined set of classes, hide the at least one native image library in the native image directory;

generate, for each one of the at least one native image library, a respective modified native image library having the executable payload,

the executable payload being configured for logging and storing data of current activities in the .NET platform;

the logging comprising: (i) logging input parameters of the at least one of the respective modified .NET method and a respective modified native image library .NET method of the respective modified native image library; and (ii) logging metainformation of a respective process having caused execution of the executable payload; and

add respective modified native image libraries to the native image directory to be used instead of the at least one native image library; and

during an operation stage, following the preparation stage:

in response to calling, by a .NET application, at least one of: the respective modified .NET method and the respective modified native image library .NET method of the respective modified native image library in the .NET platform:

execute the executable payload to cause the logging the current activity in the .NET platform to generate an activity log,

the activity log including: (i) the input parameters of the at least one of the respective modified .NET method and the respective modified native image library .NET method of the respective modified native image library; and (ii) metainformation of a process of the .NET application having caused the execution of the executable payload; and

transmit the activity log for analysis to determine presence of the malware activity in the .NET platform.

11 . The system of claim 10 , wherein the set of predetermined classes comprises:

Assembly;

Process; and

WebRequest.

12 . The system of claim 10 , wherein the set of predetermined .NET methods comprises:

Load;

GetProcesses; and

Create.

13 . The system of claim 10 , wherein, prior to modifying the contents of the given .NET method, the at least one hardware processor further causes the system to access the respective class of the given .NET method.

14 . The system of claim 13 , wherein to access the respective class comprises, the at least one hardware processor causes the system to execute a takeown utility.

15 . The system of claim 10 , wherein, by modifying the contents of the given .NET method, the at least one hardware processor causes the system to modify a behavior of the given .NET method.

16 . The system of claim 10 , wherein, prior to hiding the at least one native image library in the native image directory, the at least one hardware processor causes the system to access the at least one native image library.

17 . The system of claim 16 , wherein to access the at least one native image library, the at least one hardware processor causes the system to execute a takeown utility.

18 . The system of claim 10 , wherein to generate the respective modified native image library, the at least one hardware processor causes the system to execute an ngen.exe utility.

Assignments (3)

Priority Claims (1)

Continuity (1)

References Cited (24)