In a sophisticated cyberattack, researchers have uncovered a five-stage campaign utilizing AsyncRAT, which involves a series of innovative techniques designed to employ socially engineered tactics, leverages batch files, exploits PowerShell, abuses AutoIt, and uses process injection techniques. This approach effectively conceals a .NET remote-access trojan within the legitimate Microsoft executable known as charmap.exe.
The initial step of this malicious campaign involves a socially engineered lure titled “Right-click to open Invoice Details.bat.” This batch file requires user interaction to be executed, implying that attackers are banking on psychological manipulation to prompt users into activating the infection chain. While the exact method of how this initial file is delivered has yet to be definitively identified, it is widely acknowledged that similar files are often disseminated via phishing emails, malicious download links, trojanized software, and enticing messages sent through various messaging platforms.
Once the victim opens the batch file, it triggers a hidden PowerShell instance, disabling user profile loading as a tactic to avoid drawing attention. The PowerShell script plays a critical role by reconstructing an encoded payload from ten Base64 fragments, skillfully removing unnecessary junk characters and then applying a repeating-key XOR routine to recover subsequent data stages. This intricate method is effective in evading static detection signatures; the entire Base64 payload, along with identifiable filenames and the final payload, is never presented as a singular and easily scannable string.
The PowerShell execution continues by creating an obfuscated folder within the %LOCALAPPDATA%\Temp directory, laying the groundwork for further malicious activity. Within this folder, three key artifacts are generated: a legitimate signed AutoIt interpreter, an AutoIt loader script named kojuyn.ini, and an extensionless encrypted blob designated as nloemfbihmhm. Furthermore, a batch file named h73la8.bat is created in the current user’s Startup folder. This particular script is designed to relaunch the renamed AutoIt executable with kojuyn.ini as its argument at every user logon, establishing a form of persistence without requiring a Registry Run key, administrative privileges, or a scheduled task.
This persistence strategy aligns neatly with MITRE ATT&CK’s Boot or Logon Autostart Execution techniques, specifically the Registry Run Keys / Startup Folder method (T1547.001). A noteworthy aspect of this tactic is that it utilizes a legitimate signed interpreter rather than deploying a custom, malicious executable.
According to findings by Point Wild Threat Intelligence researchers, this campaign illustrates the cunning strategies employed by commodity RAT operators, demonstrating how they deftly combine lightweight scripting with in-memory execution techniques to circumvent file-based detection mechanisms.
As the malicious cycle unfolds, the AutoIt binary serves as a seemingly trustworthy container for executing the malware, while the accompanying script harbors the malevolent logic. Interestingly, the AutoIt application is typically characterized by a distinctive blue circular icon, further misleading unsuspecting users. Variations in the binary size of AutoIt.exe are common, typically falling between 900 KB to 1 MB, depending on the version in use.
Even though the filenames and XOR keys utilized by the malware may vary between different builds, the behavior remains largely consistent. Hidden PowerShell executions, writing files into user-writable Temp paths, creating Startup-folder persistence, and executing through AutoIt present defenders with measurable detection opportunities.
The loader script kojuyn.ini cleverly reconstructs Windows API names like OpenProcess, VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread, using XOR-encoded integer arrays. This stage moves forward to read the extensionless payload and decrypt it in memory with a single-byte XOR key 0x36, leading to the execution of the legitimate charmap.exe process in a hidden window.
The malware’s critical functionality becomes particularly evident through the classic remote-thread process injection sequence, facilitated by the calls to OpenProcess, VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread. Analysis using PE-Sieve has confirmed the presence of an injected PE image in charmap.exe, which lacks a corresponding file on the disk, indicating that the payload is executing wholly from memory. Furthermore, the analysis revealed modified CLR and AMSI-related modules, suggesting that the .NET runtime was engaged and that AMSI scanning had possibly been disabled during execution.
Because it masquerades as a Microsoft-signed host process, the malware can conduct network communications and gather system information while appearing to originate from the highly regarded charmap.exe rather than from a potentially malicious executable launched from a Temp directory. As the attack progresses, subsequent decrypted stages lead to the creation of Veukuzmw.dll, an obfuscated AsyncRAT payload designed with capabilities for screen capture and data theft.
Researchers have identified a command-and-control indicator, 158[.]51[.]122[.]136:4944, which utilizes raw TCP for communication instead of traditional web protocols. AsyncRAT has gained notoriety as an open-source remote-access tool that has been seized by cybercriminals in various campaigns, showcasing capabilities that include remote command execution, monitoring, and exfiltration of sensitive data.
Security teams are urged to remain vigilant by monitoring for instances of hidden PowerShell processes initiated by batch files, especially in scenarios where either the parent or child process operates from %TEMP% or %LOCALAPPDATA%. High-priority alerts should include detections of AutoIt interpreter executions from user-writeable locations, Startup-folder batch files linking to Temp paths, and instances of charmap.exe spawned by suspicious AutoIt or PowerShell parent processes. Additionally, endpoint detection and response (EDR) telemetry should be set to flag events such as remote memory allocation actions, cross-process writing, and use of the CreateRemoteThread function targeting charmap.exe, along with any modifications to AMSI in memory.
Overall, correlating these behavioral indicators provides a more robust defense strategy than solely relying on changes in filenames, XOR keys, or hashes, creating a more resilient approach to thwarting such advanced persistent threats.