Security researchers have identified a malware campaign targeted at government organizations in Asia. It uses a sophisticated infection chain that abuses legitimate software components to execute malicious .NET assemblies.

With this blog, we take a closer look at the NetamLoader malware campaign, its potential impact on organizations, and what organizations can do to defend themselves.

About the threat

How does it impact organizations?

Attackers may exploit this infection chain to:

• Execute malicious .NET assemblies within legitimate Windows processes.
• Bypass security monitoring through AMSI evasion techniques.
• Establish communication with attacker-controlled C2 infrastructure.
• Download and execute additional malicious payloads remotely.
• Collect system information through Windows Registry access.
• Delete malicious files, CLR usage logs, and Prefetch records to hinder forensic investigations.
• Maintain persistent communication with attacker infrastructure and potentially facilitate further espionage activities.

The malware uses delayed C2 communication, including an initial delay of 20–40 minutes, making detection more challenging.

SharkStriker’s recommendations

We recommend implementing the following security measures:

• Block the identified C2 domain openaigpt4v[.]com across firewall, DNS security and web proxy controls.
• Perform threat hunting for suspicious execution of PatchMyPC-ScriptRunner.exe and unexpected loading of Microsoft.HostIntegration.Connectors.dll.
• Monitor for unauthorized .config file modifications and suspicious .NET assembly loading.
• Review EDR telemetry for unusual dllhost.exe activity and AMSI bypass attempts.
• Ensure endpoint protection policies are configured to detect and prevent malicious script execution and DLL injection.
• Isolate any endpoint showing confirmed indicators of compromise and conduct a forensic investigation.
• Review third-party software update mechanisms and validate the integrity of downloaded packages.

SharkStriker’s action

• Shared the NetamLoader threat intelligence with the SOC team for awareness and monitoring.
• Reviewed the reported indicators of compromise and identified relevant detection opportunities.
• Recommended blocking the identified C2 domain across applicable security controls.
• Advised enhanced monitoring of suspicious .NET assembly loading, DLL execution and Windows update directories.
• Recommended proactive threat hunting across monitored endpoints to identify potential indicators of compromise.