Full Report
A malspam campaign abusing Google's DoubleClick delivers the loader through a five-stage chain that evades detection and blinds Windows telemetry before persisting
Analysis Summary
# Tool/Technique: Unidentified .NET Loader (DoubleClick Malspam Chain)
## Overview
This is a sophisticated, five-stage fileless infection chain that leverages legitimate Google infrastructure (DoubleClick) for initial redirection. The attack culminates in a .NET loader that utilizes in-memory execution, native API patching to blind security tools, and process injection into trusted Microsoft binaries to maintain a low profile.
## Technical Details
- **Type:** Malware family (Loader) / Malspam Campaign
- **Platform:** Windows
- **Capabilities:** Anti-sandboxing, EDR/Telemetry blinding (AMSI/ETW patching), Dynamic Branding (Social Engineering), In-memory execution, Process Injection.
- **First Seen:** May 2026 (Reported June 2026)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link] (Abusing DoubleClick redirects)
- **[TA0002 - Execution]**
- [T1059.005 - Command and Scripting Interpreter: VisualBasic] (JScript/VBS components)
- [T1059.001 - Command and Scripting Interpreter: PowerShell]
- **[TA0005 - Defense Evasion]**
- [T1562.001 - Impair Defenses: Disable or Modify Tools] (AMSI and ETW patching)
- [T1622 - Debugger Evasion] (Sandbox detection and forced reboot)
- [T1055 - Process Injection] (Injecting into MSBuild.exe/InstallUtil.exe)
- [T1027.011 - Obfuscation/Reflection: .NET Reflection]
- **[TA0011 - Command and Control]**
- [T1095 - Non-Application Layer Protocol] (C2 over non-standard ports)
- [T1568.002 - Dynamic DNS]
## Functionality
### Core Capabilities
- **Dynamic Lure Generation:** The malspam kit extracts the victim's email from the URL to dynamically pull company logos and branding, increasing the credibility of the phishing page without manual attacker effort.
- **Multi-Stage Staging:** Moves through a five-stage chain (HTML -> JScript -> PowerShell -> .NET assembly -> Loader) to avoid signature-based detection.
- **Process Hollowing/Injection:** Hardcoded to inject into legitimate, Microsoft-signed binaries: `InstallUtil.exe` and `MSBuild.exe`.
### Advanced Features
- **Telemetry Blinding:** Actively patches the **Anti-Malware Scan Interface (AMSI)** and **Event Tracing for Windows (ETW)** at the native API level to prevent logs from being generated or analyzed.
- **Aggressive Anti-Analysis:** If the loader identifies a sandbox environment, it immediately reboots the victim's machine to disrupt forensic memory capture and automated analysis.
- **Reflective Loading:** Uses .NET reflection to load stages directly into memory, ensuring minimal artifacts are left on the physical disk.
## Indicators of Compromise
- **File Names:** `InstallUtil.exe`, `MSBuild.exe` (as injection targets); Various temporary JScript/PowerShell scripts.
- **Network Indicators:**
- `ad.doubleclick[.]net` (Initial redirection)
- Various Dynamic DNS (DDNS) domains for C2 (e.g., `duckdns[.]org` or similar providers).
- **Behavioral Indicators:**
- `PowerShell.exe` executing highly obfuscated Base64 commands.
- Unexpected network connections from `MSBuild.exe` or `InstallUtil.exe` on non-standard ports.
- Rapid, unexplained system reboots (potential anti-analysis trigger).
- Native API calls to `WriteProcessMemory` targeting AMSI/ETW functions.
## Associated Threat Actors
- Currently unidentified (attributed to a sophisticated malspam operation).
## Detection Methods
- **Behavioral Detection:** Monitor for "Living off the Land" (LotL) binaries making external network connections. Track unauthorized memory modifications to `amsi.dll` and `ntdll.dll` (ETW).
- **EDR/SIEM Alerts:** Alert on PowerShell scripts using `.Load([System.Convert]::FromBase64String(...))` or other reflection techniques.
- **Gateway Inspection:** Inspect URL parameters in emails for DoubleClick redirects that point to suspicious secondary domains.
## Mitigation Strategies
- **Email Security:** Implement strict filtering for links containing redirects from high-reputation domains (like DoubleClick) to known DDNS providers.
- **Endpoint Hardening:** Enforce "Constrained Language Mode" for PowerShell and restrict the execution of `MSBuild.exe` and `InstallUtil.exe` using AppLocker or Windows Defender Application Control (WDAC).
- **Telemetry Protection:** Monitor for attempts to disable ETW/AMSI, which should be treated as high-severity alerts.
## Related Tools/Techniques
- **HTML Smuggling:** Used in the initial stages to deliver the JScript payload.
- **Reflective Code Loading:** Similar to techniques used by Cobalt Strike and other advanced loaders.