Operation PhantomCLR : Stealth Execution via AppDomain Hijacking and In-Memory .NET Abuse

CYFIRMA discovered a multi-stage, APT-grade post-exploitation framework that hijacks the .NET AppDomainManager to execute attacker code inside the legitimately signed Intel utility IAStorHelp.exe and load a reflective, encrypted payload. The framework combines sandbox exhaustion, JIT trampoline in-memory execution, direct ntdll syscalls, and CloudFront domain fronting for resilient C2 while employing anti-forensic memory teardown techniques. #IAStorHelp #CloudFront

Keypoints

Attack leverages AppDomainManager hijacking via a coerced IAStorHelp.exe.config to execute an unsigned .NET DLL (IAStorHelpMosquitoproof.dll) inside a legitimately signed Intel binary.
Dual-phase sandbox evasion: a 60-second prime-sieve timing gate plus an 892,007-iteration SHA-256-based AES key derivation loop delays payload activation beyond typical sandbox windows.
JIT trampoline technique and reflective DLL loading enable in-memory shellcode execution without using monitored APIs like VirtualAlloc or WriteProcessMemory, creating EDR blind spots.
PEB-based zero-API module discovery, manual PE export walking, and direct ntdll syscalls bypass userland API hooks and reduce forensic artifacts.
Command-and-control is concealed using Amazon CloudFront domain fronting with backend ELB infrastructure, complicating network blocking without TLS inspection.
Advanced anti-forensics include per-section memory protections, DLL injection storm noise generation, heap-walking context recovery, and a two-phase NtProtect/NtFree memory teardown.

MITRE Techniques

[T1566.001 ] Phishing: Spearphishing Attachment – Delivered via a malicious ZIP archive containing all components and a disguised LNK to prompt user execution (‘spear-phishing delivery via a malicious ZIP archive containing all required components.’)
[T1204.002 ] User Execution: Malicious File – User double-clicks a .pdf.lnk shortcut that launches the trusted host while opening a decoy PDF (‘User double-clicks .pdf.lnk shortcut’)
[T1106 ] Native API – Direct use of NTDLL syscalls to bypass userland API monitoring (‘Direct NTDLL syscall stubs’)
[T1129 ] Shared Modules – Loading multiple DLLs (16) via randomized LoadLibrary calls to create benign-looking noise (’16 DLLs via randomized LoadLibrary’)
[T1574.014 ] Hijack Execution Flow: AppDomainManager – .exe.config overrides CLR initialization to force attacker-controlled AppDomainManager execution (‘.config overrides CLR initialization’)
[T1036.005 ] Masquerading: Match Legitimate Resource Name or Location – LNK uses Edge PDF icon and DLL spoofs Intel to appear legitimate (‘LNK uses Edge PDF icon; DLL spoofs Intel’)
[T1218 ] System Binary Proxy Execution – Abuse of signed IAStorHelp.exe as execution proxy for malicious .NET payload (‘Signed IAStorHelp.exe as execution proxy’)
[T1027.002 ] Obfuscated Files or Information: Software Packing – AES-encrypted and compressed payload blob prevents static extraction (‘AES-encrypted + GZip-compressed payload’)
[T1027.009 ] Obfuscated Files or Information: Embedded Payloads – Embedded and obfuscated API names and payload components to hinder analysis (’27 API names via scrambled stack strings’)
[T1027 ] Obfuscated Files or Information – XOR de-obfuscation and large junk-class inflation to dilute static analysis (‘XOR de-obfuscation; 36 junk classes’)
[T1140 ] Deobfuscate/Decode Files or Information – Runtime AES key derivation loop and XOR-based string de-obfuscation used to reveal payload and magic string at runtime (‘Runtime AES key derivation loop combined with XOR-based string de-obfuscation’)
[T1620 ] Reflective Code Loading – Custom reflective DLL loader maps modules in-memory with per-section protections (‘Custom reflective DLL loader’)
[T1070 ] Indicator Removal on Host – Memory buffers and PE headers wiped as part of anti-forensic cleanup (‘PE headers wiped; buffers zeroed’)
[T1562.001 ] Impair Defenses: Disable or Modify Tools – Bypasses EDR hooks by using direct NTDLL syscalls (‘Bypasses EDR hooks via direct NTDLL’)
[T1497.001 ] Virtualization/Sandbox Evasion: System Checks – 60-second prime sieve timing gate prevents sandbox observation (’60-second prime sieve timing gate’)
[T1480 ] Execution Guardrails – File-size and payload guards prevent execution with tampered blobs (‘File size validation (0x3AAC6C)’)
[T1055.003 ] Process Injection: Thread Execution Hijacking – JIT trampoline execution hijacks JIT-compiled memory and runs shellcode via delegate invocation (‘JIT trampoline via DefineDynamicAssembly’)
[T1082 ] System Information Discovery – Registry and locale interrogation used for environmental checks (‘Registry processor/locale interrogation’)
[T1057 ] Process Discovery – Thread enumeration and Process.Modules scanning verify injected modules and execution state (‘Thread enumeration; Process.Modules scan’)
[T1055.001 ] Process Injection: Dynamic-link Library Injection – Reflective DLL injection used to load modules without standard loader APIs (‘Reflective DLL injection’)
[T1071.001 ] Application Layer Protocol: Web Protocols – HTTPS/TLS-based C2 beaconing over CDN endpoints (‘HTTPS/TLS C2 over CloudFront’)
[T1090.004 ] Proxy: Domain Fronting – CloudFront-based domain fronting conceals true C2 origin and complicates blocking (‘C2 via cloudfront.net CDN’)

Indicators of Compromise

[File Hash ] sample malware and loader artifacts – f2266b45d60f5443c5c9304b5f0246348ad82ca4f63c7554c46642311e3f8b83, 4f353b9634509a5e1456e54ccb4ce64c1e6d95094df96048ef79b30cc2fda6cb, and 2 more hashes
[Domain ] CDN-based C2 and backend infrastructure – dp8519iqiftub[.]cloudfront[.]net, dunamis-ethos508-prod-va6-856defacfb833db1[.]elb[.]us-east-1[.]amazonaws[.]com
[File Name ] dispatched components delivered in the ZIP archive – IAStorHelp.exe.config, IAStorHelpMosquitoproof.dll