NetamLoader: XAML and AppDomainManager Loader Targeting Custom Government Windows Builds

1. Basic Information

• Article Title: Unknown APT uses NetamLoader to attack a Win10 OS customized for governments in Asia
• Publisher: Kaspersky Securelist
• Publication Date: 2026-10-29
• Original: Kaspersky Securelist
• Related Source: The Record
• Related Source: Kaspersky press release
• Associated Malware: NetamLoader
• Associated Threat Group: None specified
• Associated CVE: None specified
• Associated Products: customized Windows 10, Patch My PC components, .NET, XAML
• Severity: high

2. Quick Summary

Kaspersky identified NetamLoader on a single victim in Asia and assesses that it targets a custom Windows 10 build restricted to government entities. The attack chains signed components, AppDomainManager injection, XAML, and local COM processing.

3. Attack Flow

Multi-Stage Loader Using Signed Components

The COM "remote host process" mentioned here is dllhost.exe, a separate process on the same endpoint. It does not mean lateral movement to another host was observed.

1. Legitimate Patch My PC components and a crafted .config file are extracted from a CAB file within the Windows update directory.

2. AppDomainManager injection loads a Microsoft-signed assembly and Resources.resx to deploy XAML. In a 64-bit process, it also redirects the AMSI Scan function pointer.

3. The .NET 1 Loader deletes or modifies update/.NET logs and caches. It also checks whether the current user is an administrator and raises an exception if not.

4. It sets COMPlus_ETWEnabled to 0, and uses COM object deserialization and TypeConfuseDelegate to transfer the execution of XAML to a separate process, dllhost.exe, on the same endpoint.

5. The dllhost.exe process waits 20 to 40 minutes before connecting to the C2 server. While it has the capability to receive and execute additional XAML, the contents of the final payload remain unknown.

4. Attacker Position and Execution Location

• Inference: The initial delivery vector is unknown, but access to the custom Windows update package directory is suspected.
• After execution, the loader blends in with legitimate processes and signed components on the victim endpoint.

5. Visibility for Victims and Administrators

Victims

• The activity appears as a standard OS update or patch component, with no prominent UI reported.

Administrators

• Indicators include a hash-named CAB file in SoftwareDistribution, an AppDomainManager .config file, XAML execution within dllhost.exe, suppressed .NET ETW provider registration, long C2 intervals, and modified logs.

6. Success and Failure Conditions

Success Conditions

• The crafted .config file and associated files reach the target system, and the vulnerable or exploitable execution chain functions correctly.
• The analyzed .NET 1 loader checks if the current user is an administrator and throws an exception if not. The corresponding .NET components and configuration are also required.

Failure Conditions and Countermeasures

• Verify update package signatures, content provenance, and hash allowlists, isolating unexpected .config or CAB files.
• Block or alert on anomalies involving AppDomainManager, COMPlus_ETWEnabled=0, XAML execution in dllhost, COM object creation, and execution transfer to a separate process.

7. Impact Upon Success

• Execution of a stealthy loader and retrieval of additional payloads.
• Evasion of EDR and logging, along with the deletion of forensic evidence.
• Espionage risks against government information.

8. Observable Logs

• Email: None specified
• Proxy / SWG / DNS: Initial 20-40 minute delay before connecting to C2, followed by retries 22-28 hours after failure.
• Endpoint / EDR: Hash-named CAB in SoftwareDistribution, AppDomainManager .config, XAML, dllhost.exe, COMPlus_ETWEnabled=0, CmitUpdateAgent log modifications, and registry GUID deletions.
• Identity / IdP: None specified
• SaaS / Cloud: None specified
• Network: Low-frequency C2 with long sleep intervals and encrypted, Base64-encoded reports.

9. Attack Success Assessment

• Malware Execution or Authentication Success Confirmed: Public information: Kaspersky telemetry confirmed the loader chain on a single victim. The objective and final impact of additional payloads remain unknown in public sources. (Scope: a single victim in Asia; government targeting is assessed by Kaspersky)

10. Investigation Playbook

• Trigger: AppDomainManager .config, suspicious CAB files in SoftwareDistribution, dllhost XAML, and suppressed .NET ETW provider registration.
• Initial checks: Verify file hashes, paths, signatures, package provenance, custom OS builds, and time synchronization.
• Endpoint: Preserve CAB files, .config files, assemblies, memory, dllhost, registry states, and CmitUpdateAgent/.NET logs.
• Identity / Cloud: Verify admin accounts, service accounts, and token usage on the endpoint.
• Follow-on: Track C2 communications, downloaded assemblies, lateral movement, and data access.
• Containment: Consider network isolation, gold image comparisons, halting update paths, and rebuilding from trusted media.
• Classification: Do not assume signed files are safe solely based on their existence; judge based on config-driven loading and process behavior.

11. Defense and Detection Ideas

• Single Event: Detect AppDomainManager configurations, COMPlus_ETWEnabled=0, and suspicious loading of signed assemblies.
• Sequential Correlation: Correlate CAB extraction -> AppDomainManager -> log/cache deletion or modification in the original process -> execution transfer to dllhost -> long sleep interval -> C2 connection.
• Hunting: Search all custom builds for hash-named CAB files in SoftwareDistribution and CmitUpdateAgent log modifications.
• Logging Gap: Because malware deletes logs, remote immutable telemetry is required.
• Priority Controls: Prioritize update provenance, EDR memory visibility, central logging, and egress baselining.

12. Facts, Inference, and Hypothesis

Facts

• XAML bypasses scanning in 64-bit processes by redirecting the AMSI Scan function pointer. Later stages set COMPlus_ETWEnabled=0 to suppress .NET ETW provider registration.
• Kaspersky identified a single victim in Asia via KSN telemetry in the first half of 2026. Based on designs tailored to government-only Windows 10 builds, it assesses the target as an Asian government organization.
• CAB files in the Windows update package directory primarily contained legitimate Patch My PC components and Microsoft-signed .NET assemblies, loading arbitrary assemblies via AppDomainManager injection driven by a .config file.
• COMPlus_ETWEnabled=0 was set to suppress .NET ETW provider registration, and COM objects along with TypeConfuseDelegate were used to transfer the XAML payload to dllhost.exe.
• It pauses for 20 to 40 minutes before connecting to C2, and 22 to 28 hours after failure, while deleting or modifying custom update logs, .NET usage logs, registry states, and caches.
• Kaspersky notes that while the findings strongly suggest a supply-chain attack, it has not observed the initial delivery and explicitly stated there is no evidence of a compromise of Patch My PC or its distribution systems.
• There is no attribution to known APT groups.

Inference

• There is a possibility of selective targeting by an actor familiar with government-only OSes and custom update components, but there is no evidence indicating government backing or a specific nation-state actor.

Hypothesis

No additional hypotheses. Unverified items are listed under "Uncertainties and Limitations".

13. MITRE ATT&CK Mapping

14. Uncertainties and Limitations

• Initial delivery vectors, upstream compromise locations, payloads downloaded after C2 response, victim countries, and threat actors remain unknown.

15. Impact on SOCs and Organizations

For custom Windows images and update paths in government and critical organizations, do not trust signed binaries blindly. Monitor for .config files, AppDomainManager usage, XAML, dllhost child behaviors, changes to COMPlus_ETWEnabled, and CAB files within SoftwareDistribution.

16. Summary by Role

• SOC: Hunt for AppDomainManager, XAML, dllhost activity, long C2 delays, and log modifications.
• Administrators: Verify the provenance of custom OS update packages and third-party patch components.
• Users: Preserve evidence on endpoints showing suspected anomalies without rebooting or deleting files, even if the activity resembles a normal update.