.NET Assembly Loading Without Disk Access by Remcos Loader

Ankit Mehta@Secvyn

•updated Jun 23, 2026•0•0•3

Detects the loading of .NET assemblies (mscorlib.dll, System.dll, System.Net.dll, System.IO.dll) by processes whose filenames start with 'GST' or contain 'Debit' or 'Invoice'. This pattern is indicative of the Remcos RAT loader attempting to execute without writing the assembly to disk, a technique often used to evade detection.