DnsSystem

Executive Summary

DnsSystem is a .NET DNS backdoor used by Hexane that hijacks standard DNS traffic for covert command-and-control operations. It embeds encrypted instructions in TXT records and can deliver additional payloads or execute commands on Windows victims. The malware’s use of common .NET tools and persistence mechanisms makes it both hard to spot and highly adaptable.

DnsSystem is a .NET‑based DNS backdoor that functions as a custom Domain Name System server designed for stealthy command and control (C&C) communications. The codebase is derived from the open‑source tool DIG.net, with modifications tailored by the threat actor Hexane to obscure traffic, alter query patterns, and embed encrypted instructions in TXT records. Once deployed on a victim machine, DnsSystem listens for DNS queries made against its internal server; responses contain payloads that can download additional malware or provide execution commands. By leveraging standard DNS infrastructure, the backdoor avoids typical outbound network restrictions and blends malicious traffic with legitimate service requests. Operationally, the malware establishes persistence through registry run keys and scheduled tasks under common names to evade initial discovery. On receipt of a query from the attacker’s control IP, it can trigger reverse shell sockets, transmit collected system data, or upload exfiltration files encoded in DNS payloads. The use of encryption for command strings and the ability to change DNS response TTL values further complicate detection. Because DnsSystem runs the full .NET runtime on Windows platforms, it also enjoys compatibility with PowerShell for deeper lateral movement if needed. In the June 2022 Zscaler Lyceum report, Hexane was identified executing multiple campaigns over the open‑source framework, suggesting that DnsSystem may be a modular component within a larger toolkit. Its reliance on DNS means defenders must watch for anomalously large or repeated TXT record queries and uncharacteristic DNS traffic to internal IPs. Continued monitoring of .NET process signatures, especially those matching the dig.net binary hash, is critical to early detection.

Key Capabilities

• Sets up a custom DNS server for C&C
• Embeds encrypted commands in TXT record responses
• Downloads/executes supplemental payloads via DNS
• Exfiltrates data using DNS tunneling
• Establishes persistence through registry run keys and scheduled tasks
• Implements stealth techniques such as dynamic TTL manipulation

ATT&CK Techniques

Recommended Actions

• Block outbound DNS traffic to known malicious IP ranges associated with DnsSystem
• Implement DNS analytics rules for unusually large or frequent TXT record queries
• Enforce strict firewall controls on internal DNS server ports
• Deploy .NET process monitoring that flags unknown dig.net executables
• Use endpoint detection solutions that detect encrypted command payloads in network traffic
• Maintain an up-to-date whitelist of legitimate DNS server processes

Suggested Tags