Behind the Refund: From GST Phishing to Remcos RAT Through a Multi-Stage .NET Infection Chain

Summary

A sophisticated phishing campaign targeting Indian taxpayers uses GST-themed lures to launch a multi-stage .NET malware infection chain. The attack starts with a malicious archive and moves through several in-memory loaders before ultimately deploying Remcos RAT. The operation also relies on advanced evasion techniques, including bitmap-based payload hiding and fileless execution.

Investigation

The investigation revealed a multi-stage execution chain beginning with a .NET binary that contains an encoded bitmap. That loader extracts a second-stage DLL, Windows Health Optimizer Plus.dll, which then calls a third-stage loader, perfgurd.dll, to execute the final Remcos RAT payload entirely in memory. Infrastructure analysis also identified use of dynamic DNS services and rotating hosting providers.

Mitigation

Organizations should implement strong email filtering to detect spoofed government domains and malicious archive attachments. Better endpoint visibility is also needed to identify suspicious .NET assembly loading, such as Assembly.Load, and unusual child processes spawned by cmstp.exe. Restricting PowerShell execution and monitoring registry Run keys can further help block persistence.

Response

If this activity is detected, affected hosts should be isolated immediately to stop further command-and-control communication. Investigators should conduct memory forensics to identify fileless artifacts and assess the extent of credential theft. Network logs should also be reviewed for connections to the identified dynamic DNS domains and for possible signs of lateral movement.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary aims to establish persistence and execute code using legitimate system tools to evade detection. First, the attacker uses cmstp.exe to install a connection profile that executes a malicious payload (simulated here by calling calc.exe via cmstp). Second, the attacker drops a malicious binary named RVKLmPcYcNO.exe into the C:UsersadminAppDataRoaming directory to simulate a payload delivery/persistence mechanism used in recent RAT infections.

• Regression Test Script:

  # 1. Simulate Abuse of cmstp.exe
  # Note: In a real attack, this would involve a .INF file. 
  # Here we trigger the process creation of cmstp.exe directly.
  Start-Process "C:WindowsSystem32cmstp.exe" -ArgumentList "/s C:pathtomalicious.inf" -ErrorAction SilentlyContinue
  
  # 2. Simulate Persistence via AppData with the specific malicious filename
  $targetDir = "C:UsersadminAppDataRoaming"
  $maliciousFile = Join-Path $targetDir "RVKLmPcYcNO.exe"
  
  # Create a dummy file to represent the malware
  New-Item -Path $maliciousFile -ItemType File -Force | Out-Null
  
  # Execute the "malware" to trigger the second part of the detection rule
  Start-Process $maliciousFile -ErrorAction SilentlyContinue

• Cleanup Commands:

  # Cleanup the simulated malicious files
  Remove-Item -Path "C:UsersadminAppDataRoamingRVKLmPcYcNO.exe" -Force -ErrorAction SilentlyContinue