Threat Research

PowerShell Loader Executes Remcos RAT

Securonix
PowerShell Loader Executes Remcos RAT

Cybercriminals are increasingly leveraging PowerShell-based loaders and proxy execution through mshta.exe to deploy the stealthy Remcos RAT, which operates entirely in memory to evade traditional defenses. This malware uses advanced persistence, evasion, and data theft techniques, highlighting the importance of behavioral detection and robust endpoint protection. #Remcos #PowerShellLoader #MSHTA #Rmc7SY4AX

Keypoints

  • Remcos RAT is delivered via weaponized LNK files embedded in ZIP archives, employing mshta.exe for initial proxy execution and stealth.
  • A newly discovered PowerShell-based shellcode loader loads Remcos directly into memory, bypassing Windows Defender and executing obfuscated payloads without disk artifacts.
  • Remcos exploits persistence through registry run keys, UAC bypass using ICMLuaUtil COM objects, and process hollowing into svchost.exe for stealthy execution.
  • The malware features multiple modules including keylogging, screenshot capture, clipboard access, webcam and microphone recording, and credential theft from browsers.
  • Network communication occurs over TLS with the C2 server readysteaurants[.]com on port 2025, using encrypted commands and maintaining keep-alive connections.
  • Remcos uses anti-analysis techniques such as vectored exception handling, debugger detection, and dynamic API resolution to evade detection and analysis.
  • Qualys EDR and EPP solutions are effective in detecting and mitigating this threat, emphasizing the need for PowerShell logging, AMSI monitoring, and behavioral threat hunting.

MITRE Techniques

  • [T1547.001] Registry Run Keys / Startup Folder – Malware creates registry entries to maintain persistence (‘The malware modifies the Windows Registry using the following command’).
  • [T1218.005] System Binary Proxy Execution: Mshta – Initial execution via mshta.exe running obfuscated HTA files (‘MSHTA.exe executes obfuscated hta file’).
  • [T1105] Ingress Tool Transfer – Downloads PowerShell payloads and other files into victim’s public directory (‘hta downloads multiple payloads into “C:/Users/Public/” directory’).
  • [T1555.003] Credentials from Password Stores: Credentials from Web Browsers – Extracts browser credentials from logins.json and key3.db files (‘…scans browser directories using FindFirstFile() and FindNextFile() to steal saved credentials’).
  • [T1513] Screen Capture – Captures screenshots of victim’s desktop (‘It logs keystrokes… captures clipboard data, screenshots…’).
  • [T1512] Video Capture – Accesses webcam to capture frames (‘…can track user idle time, access the webcam to capture frames’).
  • [T1560] Archive Collected Data – Logs and sends collected keylogger data and other captured files to C2 (‘Logged data is saved in a file and sent to the C&C server’).
  • [T1059.001] Command and Scripting Interpreter: PowerShell – Uses PowerShell scripts to reconstruct and execute shellcode (‘…downloads PowerShell script into the “C:/Users/Public/” directory…’).
  • [T1055.012] Process Injection: Process Hollowing – Injects its code into svchost.exe for evasion (‘It will perform process injection of its own file into svchost.exe using Process Hollowing’).
  • [T1027] Obfuscated Files or Information – Uses heavy obfuscation in PowerShell and encrypted data sections (‘The downloaded PowerShell payload 24.ps1 is heavily obfuscated…’).
  • [T1020] Automated Exfiltration – Exfiltrates data via encrypted network connections (‘Once the connection is established… Remcos server continues sending packets’).
  • [T1417.001] Keylogging – Implements a keyboard hook to log keystrokes (‘It logs keystrokes by setting a keyboard hook using SetWindowsHookExA’).
  • [T1027.001] Binary Padding – Uses padding with null bytes in shellcode for obfuscation (‘The shellcode Loader of 104 KB is padded with numerous null bytes’).
  • [T1548.002] Abuse Elevation Control Mechanism: Bypass User Account Control – Attempts UAC bypass using ICMLuaUtil Elevated and COM objects (‘Attempts to bypass UAC by leveraging “ICMLuaUtil Elevated” and COM object techniques’).
  • [T1027.007] Obfuscated Files or Information: Dynamic API Resolution – Dynamically resolves APIs during execution for stealth (‘Uses the function “CallWindowProcW” and dynamically constructs API names’).
  • [T1027.013] Obfuscated Files or Information: Encrypted/Encoded File – Stores encrypted configuration data in resource sections (‘The resource section has encrypted data in “RCData->setting” section’).

Indicators of Compromise

  • [File Hash] Malicious samples – SHA-256 Remcos PE file: ab8caac901b477c08934ec63978400eb369efb655114805ccba28c48272e5dad, PowerShell script 24.ps1: b63178f562b948b850f4676d4b8db1c024.ps1, HTA file: xlab22.hta (example of initial loader).
  • [File Name] Delivered files – Weaponized LNK files embedded in ZIP archives containing malicious HTA and PowerShell scripts, e.g., xlab22.hta, 311.hta.
  • [Domain] Command and Control – readysteaurants[.]com used for TLS communication over port 2025.
  • [Mutex] Persistence and infection check – Mutex named Rmc-7SY4AX to prevent multiple infections on the same system.
  • [IP Address] Network connections – Example IPs include 193.142.146.101 and 162.254.39.129 involved in C2 or threat activity.

Read more: https://blog.qualys.com/vulnerabilities-threat-research/2025/05/15/fileless-execution-powershell-based-shellcode-loader-executes-remcos-rat

SHARE THIS STORY

WhatsAppX (Twitter)TelegramBlueskyFacebookLinkedInThreadsEmailPrint