Remcos RAT delivered via VHDX containers

16 June 2026 medium threat

A multi-stage attack chain uses VHDX disk images and heavily obfuscated JavaScript and PowerShell to deploy Remcos RAT while evading detection.

SANS ISC analyzed a malicious campaign distributing Remcos RAT through an unusually layered infection chain. The attack begins with a ZIP archive containing a VHDX virtual hard disk file that, when automatically mounted on modern Windows systems, reveals obfuscated JavaScript. The JavaScript targets German-speaking victims with filenames referencing business quotations.

The payload employs three distinct stages to evade detection. Stage one uses WMI (WbemScripting.SWbemLocator) to launch PowerShell, breaking the direct parent-child process relationship that EDR solutions typically monitor. Stage two involves a PowerShell script that reconstructs strings by extracting every fourth character from garbage-polluted code and uses XOR decryption with the key 'Identificational'. This downloads a third-stage loader from a compromised Romanian domain, which extracts embedded shellcode via substring carving rather than traditional decryption.

The final stage uses PowerShell reflective .NET loading to inject Remcos RAT into backgroundTaskHost.exe. The malware establishes persistence via a Run registry key and communicates with its C2 server over a non-standard port (53552). Notably, most components in this infection chain remain undetected by the majority of antivirus vendors, with the initial JavaScript scoring only 5/57 on VirusTotal.

Mentioned in this report

Malware Remcos

Detection guidance

WMI-Spawned PowerShell via WbemScripting SWbemLocator (Parent Chain Break)

ATT&CK T1047

Detects PowerShell launched with WmiPrvSE.exe as parent process, indicating use of WbemScripting.SWbemLocator to break the normal parent-child process chain as seen in Remcos VHDX delivery chains. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: WMI-Spawned PowerShell via WbemScripting SWbemLocator
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \WmiPrvSE.exe
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
  filter_common:
    CommandLine|contains:
    - Get-WmiObject
    - Get-CimInstance
  condition: selection and not filter_common
fields:
- ParentImage
- Image
- CommandLine
- User
falsepositives:
- Legitimate management scripts or monitoring agents that enumerate WMI classes and
  subsequently call PowerShell for inventory tasks
- Software deployment tools that use WMI Win32_Process Create to launch PowerShell
  for patching
level: medium
tags:
- attack.t1047
- attack.t1059.001
id: 07d3874e-a1f3-5fa6-8bfc-085554eb22dd
status: experimental
author: Vorant

PowerShell Reflective .NET Assembly Load into Uncommon Host Process

ATT&CK T1620

Detects PowerShell command lines referencing reflective .NET assembly loading (Assembly.Load / Reflection) commonly used to inject shellcode such as Remcos RAT into legitimate processes like backgroundTaskHost.exe. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: PowerShell Reflective Assembly Load Indicators
logsource:
  category: process_creation
  product: windows
detection:
  selection_ps:
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
  selection_reflect:
    CommandLine|contains:
    - '[System.Reflection.Assembly]::Load'
    - Reflection.Assembly]::Load
    - .GetMethod("Invoke")
    - EntryPoint.Invoke
  selection_target:
    CommandLine|contains:
    - backgroundTaskHost
  condition: selection_ps and (selection_reflect or selection_target)
fields:
- CommandLine
- ParentImage
- Image
falsepositives:
- Legitimate .NET development or automation scripts that dynamically load assemblies
  via PowerShell for testing purposes
- Internal tooling that reflectively loads signed internal libraries
level: high
tags:
- attack.t1620
- attack.t1055
- attack.t1059.001
id: 70e92f2f-8f83-53fb-9f2b-6da383e9e116
status: experimental
author: Vorant

Registry Run Key Persistence Set by PowerShell or BackgroundTaskHost

ATT&CK T1547.001

Detects creation of a Run key persistence entry by powershell.exe or backgroundTaskHost.exe, matching the final-stage persistence behaviour of Remcos RAT after reflective injection. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Run Key Set by PowerShell or BackgroundTaskHost
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains:
    - \Software\Microsoft\Windows\CurrentVersion\Run\
    - \Software\Microsoft\Windows\CurrentVersion\RunOnce\
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
    - \backgroundTaskHost.exe
  filter_common:
    Details|contains:
    - Program Files
    - Windows Defender
  condition: selection and not filter_common
fields:
- Image
- TargetObject
- Details
- User
falsepositives:
- Legitimate PowerShell-based installers or provisioning scripts that create autorun
  entries for approved applications
level: medium
tags:
- attack.t1547.001
- attack.t1055
id: 41369fa5-fb77-5d00-81fb-12a022dfd866
status: experimental
author: Vorant

3 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers.

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://isc.sans.edu/diary/rss/33080

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free