Shiesty Remcos: PO Phish to RegAsm Hollowing

A procurement workstation tripped the endpoint console mid-morning with an Office-spawns-script alert, and the SOC has pulled the mail, endpoint, and perimeter telemetry for the host. Get oriented before you start pivoting.

The trail starts in the mailbox. One inbound message carried a weaponized purchase-order attachment that failed sender authentication. Establish who sent it.

Enabling content did not run the payload directly. The workbook macro wrote a small script to the user profile and handed off to a Windows script host. Recover the file it ran.

The script host launched a hidden PowerShell that reached out to the internet to pull its real payload. Identify the external host it downloaded from.

To survive inspection, the payload was not launched as a new executable. It was hidden inside a legitimate, signed Windows binary that was started suspended and overwritten. Identify the process it took over.

The disguised process reached out to attacker infrastructure to take orders and ship stolen data over an encrypted channel. To contain the host, identify the command-and-control host it beaconed to.

For the report, classify the core evasive move the attacker used to run a commodity remote-access tool under a trusted name. Map it to its MITRE ATT&CK technique.