# NetamLoader: Unknown APT Targets Government-Customized Windows 10 OS in Asia via Patch My PC-Themed XAML/.NET Loader

> Kaspersky Securelist reports an unattributed APT using a multi-stage .NET/XAML loader framework (NetamLoader) that masquerades as Patch My PC components and abuses AppDomainManager injection, BinaryFormatter TypeConfuseDelegate deserialization and XAML execution, with AMSI bypass and an AES-128-CBC/HMAC-SHA256 C2 channel. One confirmed victim in Asia; the framework targets a customized government-only Windows 10 build.

- **Published:** 2026-10-29T08:19:57Z
- **Last reviewed:** 2026-10-31T15:01:29.454Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4715
- **ID:** TL-2026-4715
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 31 (3 shown free below)

## Description

In H1 2026 Kaspersky detected a highly sophisticated infection chain on a customized, government-only Windows 10 build used in Asia (the host logs contain the keyword CmitUpdateAgent). A CAB archive (SHA1 e4537a1762fcafd2fd96bfc825bad34f9db9a24d) was found in C:\Windows\SoftwareDistribution\Download\ and unpacked into an Install\ folder containing legitimate Patch My PC components plus three malicious files: PatchMyPC-ScriptRunner.exe.config, fabric.config and Resources.resx. Kaspersky did not observe how the CAB was delivered to the victim; the researchers assess it as a supply-chain-style attack. Execution is triggered by running PatchMyPC-ScriptRunner.exe -updatepackage -applicationid=<GUID>.

The .config file uses AppDomainManager injection (appDomainManagerType Microsoft.ApplicationServer.Caching.DataCacheFactoryConfiguration from assembly Microsoft.HostIntegration.Connectors) so that the Windows Server AppFabric cache client loads fabric.config. That file points to System.Resources.ResXResourceSet, which parses Resources.resx containing a Base64 BinaryFormatter object. Deserialization uses a TypeConfuseDelegate gadget to call XamlReader.Parse(), loading XAML-1. XAML-1 derives an AES key from the SHA-256 of the lower-cased host process command line (environmental keying), decrypts XAML-2 and calls Environment.Exit(0) on failure. XAML-2 holds two compressed XAML files: XAML-2-1 patches AMSI (it overwrites Console.Clear() with the bytes 41 C7 00 01 00 00 00 33 C0 C3 and redirects the CAmsiAntimalware::Scan virtual-table entry to it so every scan returns AMSI_RESULT_CLEAN), and XAML-2-2 reflectively loads the first-stage .NET loader and passes it a JSON configuration.

The .NET 1 loader removes evidence (deletes the three malicious files, the CLR UsageLogs entry and the PatchMyPC-ScriptRunner Prefetch file, and filters lines containing GetExtendedUpdateInfoHandler from CmitUpdateAgent logs), requires administrator rights, builds an instance ID and a system ID from SusClientId, disables ETW for the CLR via COMPlus_ETWEnabled=0 set through WScript.Shell, and abuses a remote COM object (CLSID ab8902b4-09ca-4bb6-b78d-a8f59079a8d5) with a second deserialization/TypeConfuseDelegate chain to load XAML-3 into dllhost.exe, separating the payload from the original process tree. The .NET 2 plugin runs in dllhost.exe (a DllSurrogate appid {ff259bcd-2f0a-44de-b34a-0092fec1d8a2} is registered, and CoLockObjectExternal keeps the process alive), waits 20-40 minutes before first contact, runs a watchdog of roughly 28 hours, and long-polls https://openaigpt4v.com/model_v4/<instance_id> with POSTed ?b=<encrypted>&c=<instance_id> parameters. Proxy settings are resolved via WinHTTP default proxy, impersonation of the explorer.exe token, or DefaultWebProxy. Traffic uses AES-128-CBC with HMAC-SHA256 (encrypt-then-MAC, derived keys per seed). Downloaded XAML tasking is executed inside a short-lived isolated AppDomain via another TypeConfuseDelegate (TimeZoneInfo.ClearCachedData replaced by XamlReader.Parse through AppDomain.DoCallBack) and the AppDomain is then unloaded.

Kaspersky stated that after analysing TTPs, code similarities and infrastructure it could not link the activity to any known APT group. Kaspersky detection names are HEUR:Trojan.MSIL.NetamLoader.gen, Trojan.MSIL.Zapchast.* and Trojan.Script.Agent.*. Severity is analyst-assigned based on government targeting and the sophistication of the evasion chain; only one victim is confirmed.

## MITRE ATT&CK

- T1574.014 AppDomainManager
- T1036.005 Match Legitimate Resource Name or Location
- T1027.013 Encrypted/Encoded File
- T1140 Deobfuscate/Decode Files or Information
- T1620 Reflective Code Loading
- T1685 Disable or Modify Tools
- T1685 Disable or Modify Tools
- T1070.004 File Deletion
- T1480.001 Environmental Keying
- T1112 Modify Registry
- T1497.003 Time Based Checks
- T1134.001 Token Impersonation/Theft
- T1559.001 Component Object Model
- T1012 Query Registry
- T1082 System Information Discovery
- T1071.001 Web Protocols
- T1573.001 Symmetric Cryptography
- T1132.001 Standard Encoding
- T1016 System Network Configuration Discovery

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**NetamLoader - PatchMyPC-ScriptRunner Executed From Windows Update Staging Directory (-updatepackage)** (`TL-2026-4715-SPL-001`)

Detects the NetamLoader execution trigger: PatchMyPC-ScriptRunner.exe run with -updatepackage -applicationid=<GUID> from C:\Windows\SoftwareDistribution\Download\Install\, where a malicious PatchMyPC-ScriptRunner.exe.config performs AppDomainManager injection and fabric.config/Resources.resx drive BinaryFormatter TypeConfuseDelegate deserialization. XAML-1 derives its AES key from this exact command line (environmental keying), so the command line is stable and high-fidelity. Legitimate Patch My PC runs from its own install path, not from the Windows Update download cache.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1574.014, T1036.005, T1480.001
- **Data sources:** sysmon, windows_security, microsoft_defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 Image="*\\PatchMyPC-ScriptRunner.exe" Image="*\\SoftwareDistribution\\Download\\*" CommandLine="*-updatepackage*" CommandLine="*-applicationid=*"
```NetamLoader TL-2026-4715 stage 1: ScriptRunner launched from the update staging cache; the command line is the XAML-1 decryption key```
| eval cmdline_lower=lower(CommandLine), launched_from_update_staging="true"
| table _time host User ParentImage Image CommandLine cmdline_lower launched_from_update_staging ProcessGuid
````

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "PatchMyPC-ScriptRunner.exe"
| where FolderPath contains @"\SoftwareDistribution\Download"
| where ProcessCommandLine contains "-updatepackage" and ProcessCommandLine contains "-applicationid="
| project Timestamp, DeviceName, AccountName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA1, MD5, ReportId
```

### Sigma

```yaml
title: NetamLoader PatchMyPC-ScriptRunner Launched From Windows Update Staging Directory
id: 3f6a1c52-8d47-4b19-a2e0-5c7b9d104e11
status: experimental
description: Detects PatchMyPC-ScriptRunner.exe started with -updatepackage and -applicationid from the SoftwareDistribution Download staging directory, the execution trigger of the NetamLoader AppDomainManager injection chain.
references:
    - https://securelist.com/netamloader/121676/
    - https://attack.mitre.org/techniques/T1574/014/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-10-29
tags:
    - attack.persistence
    - attack.t1574.014
    - attack.defense-evasion
    - attack.t1036.005
    - attack.t1480.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith: '\PatchMyPC-ScriptRunner.exe'
    selection_path:
        Image|contains: '\SoftwareDistribution\Download'
    selection_cli:
        CommandLine|contains|all:
            - '-updatepackage'
            - '-applicationid='
    condition: all of selection_*
falsepositives:
    - Legitimate Patch My PC deployments that stage ScriptRunner inside the Windows Update download cache (uncommon)
level: high

```

**Known false positives:**

- Patch My PC package deployments that legitimately stage ScriptRunner under SoftwareDistribution\Download
- Internal red-team or software-packaging tests replicating the NetamLoader trigger

**Tuning notes:** Requires Sysmon EventCode 1 (or Security 4688 with command-line auditing) indexed in index=sysmon; adjust index/sourcetype to your environment. Allow-list known Patch My PC package GUIDs after validating them against the vendor catalog. The Image path condition is the main discriminator - keep it even if the command-line match is relaxed.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- NetamLoader - Malicious Config/Resx Files Staged In SoftwareDistribution\Download (locked: unlock with TL Creds)
- NetamLoader - Self-Cleanup Deletion of ScriptRunner Prefetch, CLR UsageLogs and Staged Config Files (locked: unlock with TL Creds)
- NetamLoader - Network Contact With [indicator] C2 or /model_v4/ Polling URL (locked: unlock with TL Creds)
- NetamLoader - AppFabric/HostIntegration and XAML Assemblies Loaded By Staged ScriptRunner (locked: unlock with TL Creds)
- NetamLoader - [indicator] Loading CLR and XAML Assemblies (DllSurrogate Payload Host) (locked: unlock with TL Creds)
- NetamLoader - HTTPS Polling of /model_v4/<instance_id> With b= and c= POST Parameters (locked: unlock with TL Creds)
- NetamLoader - DllSurrogate AppID Registration and CLR ETW Disable Variable (locked: unlock with TL Creds)
- NetamLoader - [indicator] Outbound HTTPS Beaconing to Public Hosts / [indicator] (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 31)

Defanged, TLP:CLEAR.

- IP address: `104.18.14[.]219`
- Domain: `openaigpt4v[.]com`
- File hash: `e4537a1762fcafd2fd96bfc825bad34f9db9a24d`

Full set of 31 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Unknown APT uses NetamLoader to attack a Win10 OS customized for governments in Asia (Securelist)](https://securelist.com/netamloader/121676/)
- [MITRE ATT&CK T1574.014 - Hijack Execution Flow: AppDomainManager](https://attack.mitre.org/techniques/T1574/014/)
- [Rapid7 - AppDomain Manager Injection: New Techniques For Red Teams](https://www.rapid7.com/blog/post/2023/05/05/appdomain-manager-injection-new-techniques-for-red-teams)
- [NTT Security Japan - AppDomainManager Injection](https://jp.security.ntt/tech_blog/appdomainmanager-injection-en)
- [BeaconBeagle C2 config search for openaigpt4v.com (no matches)](https://beaconbeagle.com/api/v1/configs/search?domain=openaigpt4v.com)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4715