NetamLoader Attacks Custom Government Windows 10 Builds via .NET Injection

Security researchers revealed details this week regarding a sophisticated cyber-espionage campaign deploying a novel malware framework dubbed NetamLoader. The attack targets a custom Windows 10 build used exclusively by government organizations in Asia, leveraging AppDomainManager injection to stealthily execute payloads within trusted administrative tools. Evidence indicates the threat actors likely gained access via a supply chain compromise of a trusted third-party vendor, allowing them to stage malicious cabinet (CAB) archives directly within standard Windows operating system update directories.

Delivery and AppDomain Injection Mechanics

The intrusion chain begins when a malicious CAB archive is dropped into C:\Windows\SoftwareDistribution\Download\e4537a1762fcafd2fd96bfc825bad34f9db9a24 and its contents are extracted into C:\Windows\SoftwareDistribution\Download\Install\. The archive contains seven files, four of which are legitimate, signed components of Patch My PC, an endpoint management utility commonly used in enterprise and public-sector environments.

To achieve stealthy execution, NetamLoader abuses AppDomainManager injection—a design technique in the .NET Framework that hijacking application domain initialization. When the legitimate executable PatchMyPC-ScriptRunner.exe starts, the .NET Common Language Runtime (CLR) parses its corresponding configuration file, PatchMyPC-ScriptRunner.exe.config. The threat actor modified this .config file to force the application to instantiate a custom domain manager, redirecting execution to a malicious assembly named Microsoft.HostIntegration.Connectors.dll.

Because application domain managers execute early in the process lifecycle before main application logic runs, this technique functions similarly to DLL side-loading. Security controls that trust signed administrative utilities like Patch My PC fail to flag the process, allowing the untrusted code to run within a trusted process memory space.

Multi-Stage Payload Execution Architecture

Once Microsoft.HostIntegration.Connectors.dll is loaded into memory, it initiates a complex, multi-stage loading pipeline designed to evade signature-based endpoint detection:

1. Resource Extraction: The hijacked DLL locates fabric.config in the install directory and parses it to load Resources.resx. This file acts as a container for multiple layers of encoded XAML templates, .NET assemblies, and JSON data.
2. AMSI Bypass & Intermediate Loader: Decoding Resources.resx executes XAML-2, which drops two Base64-encoded payloads: XAML-2-1 and XAML-2-2. The XAML-2-1 component immediately patched the Antimalware Scan Interface (AMSI) in memory to block downstream detection. XAML-2-2 then unpacks .NET 1 Loader and a JSON structure designated JSON-1.
3. C2 Configuration Parsing: JSON-1 splits into JSON-1-c (containing command-and-control server configurations) and JSON-1-p (containing the final .NET 2 Plugin and XAML templates needed to construct XAML-3).
4. Process Injection into COM Surrogate: .NET 1 Loader dynamically builds XAML-3 and launches it inside dllhost.exe, the standard Windows COM surrogate process.
5. Final Plugin Execution & Polling: Within dllhost.exe, XAML-3 loads .NET 2 Plugin. This final module queries system configuration details from the Windows Registry, verifies it is running under dllhost.exe, and sleeps for a random jitter window of 20 to 40 minutes. It then sends an initial beacon to its C2 domain (openaigpt4v[.]com).

If the C2 server returns a valid response, the plugin pauses for 5 to 6 minutes before polling again for new XAML commands to run in an isolated AppDomain. If the C2 connection fails, the malware enters a long-term dormant loop, sleeping for 22 to 28 hours while checking every 10 minutes to verify if the delay window has expired.

Anti-Analysis and Forensic Evasion

NetamLoader is explicitly engineered to impede post-incident forensic investigations. During the execution of stage two, .NET 1 Loader actively purges evidence from the compromised endpoint. After loading the final payload into dllhost.exe, it deletes:

• The extracted files originating from the initial CAB archive in C:\Windows\SoftwareDistribution\Download\Install\.
• Common Language Runtime (CLR) usage log files that record .NET assembly loading behavior.
• Windows Prefetch cache files (.pf) associated with the execution of the administrative binaries.

By removing these artifacts, the malware leaves minimal disk-based evidence, complicating root-cause analysis for security operations teams.

Targeted Environment and Strategic Impact

Telemetry collected by Kaspersky identified an infected endpoint running a custom Windows 10 distribution built specifically for government use in Asia. While researchers did not officially disclose the target country, contextual indicators point to China, where Microsoft historically provided Windows 10 China Government Edition to state departments and state-owned enterprises.

Custom operating system builds create unique security challenges. While bespoke software stacks reduce reliance on generic commercial codebases, they force operating organizations to assume complete responsibility for defending a niche ecosystem. When threat actors discover injection vectors like AppDomainManager hijacking within administrative software deployed on these platforms, traditional commercial endpoint protection products may lack tailored detection coverage.

Required Mitigations and Detection

Organizations managing specialized Windows 10 deployments or utilizing third-party deployment tools should implement the following targeted controls:

• Network Indicators: Block all inbound and outbound traffic to the known C2 infrastructure domain openaigpt4v[.]com at the perimeter firewall and DNS resolver levels.
• AppDomain Injection Monitoring: Implement Endpoint Detection and Response (EDR) rules to monitor .config file creation or modification alongside executable files. Specifically flag XML configuration files containing appDomainManagerAssembly or appDomainManagerType nodes referencing unexpected binaries such as Microsoft.HostIntegration.Connectors.dll.
• Directory Auditing: Monitor process execution originating from C:\Windows\SoftwareDistribution\Download\Install\ and restrict non-SYSTEM execution privileges within Windows Update staging paths.
• Memory Inspection: Query dllhost.exe instances for suspicious unmapped memory regions containing inline XAML definitions or abnormal .NET runtime initialization log gaps.