AsyncRAT Injected Via AutoIt Into Microsoft Windows Processes

Key Takeaways

• A new campaign injects the AsyncRAT remote access trojan (RAT) into Microsoft-signed Windows processes, specifically `charmap.exe`.
• The attack chain leverages the legitimate Windows automation tool AutoIt to achieve stealth and persistence.
• Initial infection relies on social engineering via a deceptive batch file, “Right-click to open Invoice Details.bat.”
• The technique allows the RAT to operate from a trusted process, making detection difficult for standard security tools.
• Defenders should focus on behavioral analysis, monitoring unusual process relationships, and network connections from typically benign executables.

Hackers are actively deploying AsyncRAT, a potent remote-access trojan, by ingeniously injecting it into legitimate Microsoft Windows processes. This sophisticated campaign exploits the AutoIt scripting language, a common automation tool, to embed the malware within trusted system components, significantly increasing its stealth and persistence.

The attack initiates with a deceptive batch file, “Right-click to open Invoice Details.bat,” designed to mimic a benign document. This social engineering tactic aims to trick unsuspecting users into execution, believing they are accessing an invoice or a shared file.

Upon execution, the batch file silently invokes PowerShell. This PowerShell process then reconstructs fragmented, hidden code and deploys several malicious components into a randomly named directory within the user’s temporary files. The ultimate objective is to establish remote control for the attacker while evading detection by both the victim and conventional security software.

Point Wild Threat Intelligence researchers meticulously mapped out this five-stage attack chain. Their analysis, detailed in a report shared with Cyber Security News (CSN), concludes that AsyncRAT ultimately runs in memory within `charmap.exe`, the Windows Character Map utility. Because `charmap.exe` is a Microsoft-signed Windows component, its presence might appear routine to defenders unless a deeper inspection of its parent process and memory is performed. This strategy highlights how attackers are combining social engineering, native scripting, and trusted applications to bypass security measures, rather than relying on overtly malicious files. The campaign underscores the critical need to move beyond simply trusting a file’s apparent legitimacy or a valid digital signature.

Hackers Abuse AutoIt

The infection sequence begins when a user manually opens the malicious batch file. This often occurs after the file is delivered via phishing emails, malicious links, trojanized downloads, or insecure messaging platforms.

Initial Execution and Payload Reconstruction

Once launched, the batch file executes PowerShell in a hidden window, disabling its normal profile. The PowerShell script then decodes a multi-layered payload. This decoding process involves Base64 text, interspersed junk characters, and XOR operations to obfuscate the true malicious code.

This stage subsequently drops a renamed, legitimate AutoIt interpreter, a loader script named `kojuyn.ini`, and an encrypted, extensionless file into a randomly generated temporary directory. To ensure persistence across reboots, the batch file also writes `h73la8.bat` to the user’s Startup folder. This mechanism allows the AutoIt interpreter and its loader script to restart with each user sign-in, crucially without requiring administrator privileges or modification of the Registry’s run keys.

Memory-Only Injection

The `kojuyn.ini` loader script is designed to decrypt its payload exclusively in memory. It then discreetly launches the 32-bit Character Map program (`charmap.exe`) in a hidden state. Utilizing Windows programming functions, the loader allocates memory within the `charmap.exe` process, copies the decrypted payload into this allocated space, and creates a new thread to execute it.

The outcome of this sophisticated process is a malicious .NET program implanted directly into `charmap.exe`, leaving no corresponding executable file on the disk. This fileless technique redirects suspicious network traffic and credential-access activities to a signed Windows process, a common tactic in process injection defense evasion. Such methods can effectively circumvent security checks that rely solely on executable names for anomaly detection.

Screen Capture and Detection Priorities

Following the successful injection, the final decrypted DLL, identified as `Veukuzmw.dll`, activates the full suite of remote-access functionalities characteristic of AsyncRAT.

Malware Capabilities and Evasion

Researchers observed code specifically designed for screen capture, which records the primary display, converts the image data into bytes, and prepares it for exfiltration to the attacker’s command-and-control (C2) server. The analysis also revealed that the Windows Anti-Malware Scan Interface (AMSI), responsible for scanning scripts, was patched within the compromised process. This indicates a deliberate attempt to reduce the visibility of subsequent script and assembly execution, as the loader exits, leaving `charmap.exe` to host the active RAT.

Given that `charmap.exe` is typically a benign utility for viewing special characters, its initiation from an AutoIt process, especially when hidden, or its engagement in outbound network connections, represents highly anomalous behavior. These unusual process relationships are far more valuable detection indicators than the mere presence of a digitally signed file.

Recommendations for Defenders

Security teams should prioritize alerts for hidden PowerShell processes that write files to the `Temp` and `Startup` directories. This is particularly critical when such processes then launch an AutoIt binary with a script file as its sole argument. Correlating this activity with unexpected launches of `charmap.exe`, the creation of remote threads within it, or unusual network connections emanating from `charmap.exe` can expose the attack chain before sensitive data is compromised.

Users are advised to exercise extreme caution with unexpected invoice files and to refrain from opening attachments, clicking suspicious links, downloading cracked software, or accepting shared documents from unverified sources. Furthermore, security teams can leverage the insights from these AsyncRAT fileless loader techniques and recent delivery campaigns to actively hunt for hidden scripting, unauthorized startup persistence, and any trusted processes exhibiting behavior outside their normal operational profiles.

What You Should Do

• Educate Users: Conduct regular training on identifying phishing attempts, suspicious attachments, and malicious links, especially those disguised as invoices or shared documents.
• Implement Strong Email Security: Utilize advanced email gateways with robust attachment scanning, URL sandboxing, and anti-phishing capabilities.
• Monitor Process Behavior: Deploy Endpoint Detection and Response (EDR) solutions capable of monitoring process parent-child relationships, hidden process launches, and unexpected network connections from legitimate Windows executables like `charmap.exe`.
• Audit Startup Items: Regularly review and audit user-level startup folders and registry run keys for unauthorized entries.
• Enable and Monitor AMSI: Ensure AMSI is active and its logs are integrated into your SIEM for detection of script-based attacks. Be alert for attempts to bypass or patch AMSI.
• Implement Application Whitelisting: Consider application whitelisting to restrict the execution of unauthorized scripts and executables, especially in sensitive directories.
• Threat Hunting: Proactively hunt for indicators of compromise (IoCs) and behavioral anomalies across your network, focusing on the specific techniques described in this report.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.