Threat video1:00
NetamLoader Patch My PC-Themed Loader: Detection & IOCs
NetamLoader poses as Patch My PC components and injects via AppDomainManager. Get 9 detection rules, 23 IOCs and a free Splunk SPL rule.
Read the full threat intel for NetamLoader Patch My PC-Themed Loader: Detection & IOCs →
Chapters
- 0:00The hookUnattributed APT loader targets government.
- 0:04The storyMasquerades as patch tool.
- 0:10Attack pathFake CAB triggers multi-stage decode chain.
- 0:25AttributionNo threat actor is attributed.
- 0:29Indicators of compromise18 indicators to hunt: 1 IP, 1 domain and 1 URL, and more.
- 0:36MITRE ATT&CK techniques18 ATT&CK techniques, from execution to command and control.
- 0:41Remediation4 steps now: Block openaigpt4v[.]com and hunt for outbound HTTPS to /model_v4/.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Unattributed APT loader targets government.
0:05Masquerades as patch tool.
0:06Targets government Asia.
0:10Fake CAB triggers multi-stage decode chain.
0:14Patches AMSI to hide execution.
0:16Checks admin, disables ETW logs.
0:20Long-polls encrypted HTTPS C2 channel.
0:25No threat actor is attributed. Confidence: low.
0:3018 indicators to hunt: 1 IP, 1 domain and 1 URL, and more.
0:3618 ATT&CK techniques, from execution to command and control.
0:414 steps now: Block openaigpt4v[.]com and hunt for outbound HTTPS to /model_v4/.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.