NetamLoader: Multi-stage .NET injection malware targeting Windows 10

NetamLoader is a sophisticated, previously undocumented .NET assembly-loading framework identified by Kaspersky. The malware targets custom Windows 10 builds (likely Windows 10 China Government Edition) used by government entities in Asia. It achieves code execution through AppDomainManager injection, hijacking the initialization process of legitimate applications. The malware was observed packaged within Windows cabinet (CAB) archives placed in system update directories, suggesting a potential supply chain compromise of trusted third-party software.

Attack Chain

1. Delivery of a malicious CAB archive to the victim machine, specifically within 'C:\Windows\SoftwareDistribution\Download' paths.
2. Extraction of contents into 'C:\Windows\SoftwareDistribution\Download\Install'.
3. Execution of the legitimate process 'PatchMyPC-ScriptRunner.exe', which parses a malicious 'PatchMyPC-ScriptRunner.exe.config' file.
4. Initiation of AppDomainManager injection to load 'Microsoft.HostIntegration.Connectors.dll'.
5. Parsing of 'fabric.config' by the DLL to load the 'Resources.resx' file containing encoded and encrypted payloads.
6. Multi-stage decryption and loading of XAML and .NET modules, including XAML-2-1 for AMSI bypass.
7. Execution of XAML-3 within 'dllhost.exe' and final loading of the .NET 2 Plugin.
8. Deployment of a periodic C2 polling loop to 'openaigpt4v.com' for further payload retrieval and execution in isolated AppDomains.

Recommendation

• Inventory systems containing Windows 10 China Government Edition or specialized government Windows builds.
• Monitor directory paths 'C:\Windows\SoftwareDistribution\Download' for the presence of unexpected CAB archives or unauthorized file extractions into 'Install' subdirectories.
• Implement strict process execution policies for 'PatchMyPC-ScriptRunner.exe' and ensure hashes match known legitimate versions from the vendor.
• Block communication with 'openaigpt4v.com' at the network perimeter.
• Audit .NET configuration files (.config) in sensitive directories for unexpected 'AppDomainManager' settings.