Remcos RAT delivered via VHDX containers

Published16 June 2026 Vorant ratingroutine threat

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

A multi-stage attack chain uses VHDX disk images and heavily obfuscated JavaScript and PowerShell to deploy Remcos RAT while evading detection.

Sourceisc.sans.edu — open the original

What to check

Applies to: Whether this concerns you is not assessed; the names the report mentions are listed below.

SANS ISC analyzed a malicious campaign distributing Remcos RAT through an unusually layered infection chain. The attack begins with a ZIP archive containing a VHDX virtual hard disk file that, when automatically mounted on modern Windows systems, reveals obfuscated JavaScript. The JavaScript targets German-speaking victims with filenames referencing business quotations.

The payload employs three distinct stages to evade detection. Stage one uses WMI (WbemScripting.SWbemLocator) to launch PowerShell, breaking the direct parent-child process relationship that EDR solutions typically monitor. Stage two involves a PowerShell script that reconstructs strings by extracting every fourth character from garbage-polluted code and uses XOR decryption with the key 'Identificational'. This downloads a third-stage loader from a compromised Romanian domain, which extracts embedded shellcode via substring carving rather than traditional decryption.

The final stage uses PowerShell reflective .NET loading to inject Remcos RAT into backgroundTaskHost.exe. The malware establishes persistence via a Run registry key and communicates with its C2 server over a non-standard port (53552). Notably, most components in this infection chain remain undetected by the majority of antivirus vendors, with the initial JavaScript scoring only 5/57 on VirusTotal.

Mentioned in this report

Malware Remcos

Detection guidance

WMI-Spawned PowerShell via WbemScripting SWbemLocator (Parent Chain Break)

ATT&CK T1047 · status experimental · needs windows process_creation logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general.

Detects PowerShell launched with WmiPrvSE.exe as parent process, indicating use of WbemScripting.SWbemLocator to break the normal parent-child process chain as seen in Remcos VHDX delivery chains. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: WMI-Spawned PowerShell via WbemScripting SWbemLocator
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \WmiPrvSE.exe
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
  filter_common:
    CommandLine|contains:
    - Get-WmiObject
    - Get-CimInstance
  condition: selection and not filter_common
fields:
- ParentImage
- Image
- CommandLine
- User
falsepositives:
- Legitimate management scripts or monitoring agents that enumerate WMI classes and
  subsequently call PowerShell for inventory tasks
- Software deployment tools that use WMI Win32_Process Create to launch PowerShell
  for patching
level: medium
tags:
- attack.t1047
- attack.t1059.001
id: 07d3874e-a1f3-5fa6-8bfc-085554eb22dd
status: experimental
author: Vorant

PowerShell Reflective .NET Assembly Load into Uncommon Host Process

ATT&CK T1620 · status experimental · needs windows process_creation logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general.

Detects PowerShell command lines referencing reflective .NET assembly loading (Assembly.Load / Reflection) commonly used to inject shellcode such as Remcos RAT into legitimate processes like backgroundTaskHost.exe. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: PowerShell Reflective Assembly Load Indicators
logsource:
  category: process_creation
  product: windows
detection:
  selection_ps:
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
  selection_reflect:
    CommandLine|contains:
    - '[System.Reflection.Assembly]::Load'
    - Reflection.Assembly]::Load
    - .GetMethod("Invoke")
    - EntryPoint.Invoke
  selection_target:
    CommandLine|contains:
    - backgroundTaskHost
  condition: selection_ps and (selection_reflect or selection_target)
fields:
- CommandLine
- ParentImage
- Image
falsepositives:
- Legitimate .NET development or automation scripts that dynamically load assemblies
  via PowerShell for testing purposes
- Internal tooling that reflectively loads signed internal libraries
level: high
tags:
- attack.t1620
- attack.t1055
- attack.t1059.001
id: 70e92f2f-8f83-53fb-9f2b-6da383e9e116
status: experimental
author: Vorant

Registry Run Key Persistence Set by PowerShell or BackgroundTaskHost

ATT&CK T1547.001 · status experimental · needs windows registry_set logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general.

Detects creation of a Run key persistence entry by powershell.exe or backgroundTaskHost.exe, matching the final-stage persistence behaviour of Remcos RAT after reflective injection. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Run Key Set by PowerShell or BackgroundTaskHost
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains:
    - \Software\Microsoft\Windows\CurrentVersion\Run\
    - \Software\Microsoft\Windows\CurrentVersion\RunOnce\
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
    - \backgroundTaskHost.exe
  filter_common:
    Details|contains:
    - Program Files
    - Windows Defender
  condition: selection and not filter_common
fields:
- Image
- TargetObject
- Details
- User
falsepositives:
- Legitimate PowerShell-based installers or provisioning scripts that create autorun
  entries for approved applications
level: medium
tags:
- attack.t1547.001
- attack.t1055
id: 41369fa5-fb77-5d00-81fb-12a022dfd866
status: experimental
author: Vorant

3 more detections for this report are in the app — indicator rules, each with Sigma, Splunk SPL, and Elastic, some with Microsoft Defender XDR KQL, YARA, or Suricata as well. Free account, no card.

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://isc.sans.edu/diary/rss/33080

Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the malware it names. The paid plans add the security research and news reporting the free tier leaves out.

It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.

Create a free account What it costs