How a VHDX File Delivers Remcos RAT

Summary

A multi-stage malware campaign uses a weaponized ZIP archive containing a VHDX disk image to evade common security controls. After the VHDX is mounted, an obfuscated JavaScript file runs and launches a series of PowerShell stages through WMI. The final payload is Remcos RAT, which is injected into a legitimate Windows process to conceal its execution.

Investigation

The researcher examined a malicious ZIP archive and the embedded VHDX container to reconstruct the full attack flow. The analysis exposed a complex execution chain that used WMI-based process creation to disguise parent-child relationships, along with XOR and Base64 string obfuscation and a reflective .NET loader. The infection path was successfully traced from the initial JavaScript execution through to deployment of the final Remcos payload.

Mitigation

Organizations should apply strict controls to prevent mounting of VHDX disk images from untrusted sources. Security tooling should also monitor suspicious Win32_Process.Create activity triggered by scripting engines such as JavaScript or PowerShell. Blocking known malicious domains and watching for unusual Run key persistence in the registry can further reduce risk.

Response

If this activity is detected, isolate the affected endpoint immediately to stop command-and-control communication. Acquire a memory dump to capture the injected Remcos payload and the reflective .NET loader. A full forensic review should then search for malicious Run key entries, additional VHDX files, and suspicious PowerShell activity elsewhere in the environment.

## Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary aims to execute a malicious payload in memory to avoid detection by traditional AV. They utilize a PowerShell script that leverages [System.Reflection.Assembly]::Load() to pull a compiled .NET DLL directly from a byte array into the current process. To maintain persistence and evade scrutiny, they attempt to spawn or interact with backgroundTaskHost.exe, a legitimate Windows process, to hide their execution thread within a standard system background task.

• Regression Test Script:

  # Simulation Script: Reflective .NET Load & Process Interaction
  # This script mimics the logic captured by the detection rule.
  
  # 1. Create a dummy byte array representing a .NET Assembly (highly simplified for simulation)
  $assemblyBytes = [byte[]](0x4D, 0x5A, 0x90, 0x00, 0x03, 0x00, 0x00, 0x00) # Mimics MZ header
  
  Write-Host "[+] Attempting Reflective .NET Assembly Load..." -ForegroundColor Cyan
  try {
      # This specific string is a target for the detection rule
      $assembly = [System.Reflection.Assembly]::Load($assemblyBytes)
      Write-Host "[!] Success: Assembly loaded into memory (Simulation only)." -ForegroundColor Green
  } catch {
      Write-Host "[-] Assembly load failed (expected due to invalid dummy bytes), but the command was sent." -ForegroundColor Yellow
  }
  
  Write-Host "[+] Attempting to invoke backgroundTaskHost.exe to trigger detection..." -ForegroundColor Cyan
  # This specific string is a target for the detection rule
  Start-Process "C:WindowsSystem32backgroundTaskHost.exe" -ArgumentList "/test-detection"

• Cleanup Commands:

  # Cleanup: Terminate the spawned backgroundTaskHost process
  Stop-Process -Name "backgroundTaskHost" -ErrorAction SilentlyContinue
  Write-Host "[+] Cleanup complete. BackgroundTaskHost terminated." -ForegroundColor Green