Hackers Use AutoIt and Process Injection to Deploy AsyncRAT
Attackers are leveraging AutoIt scripts to inject the AsyncRAT remote-access trojan into legitimate, Microsoft-signed Windows processes like charmap.exe, evading detection by hiding malicious activity within trusted applications.
Cybercriminals are employing a sophisticated multi-stage attack chain that begins with a deceptively named batch file, "Right-click to open Invoice Details.bat," to deliver the AsyncRAT remote-access trojan. This campaign, identified by Point Wild Threat Intelligence, aims to obscure malicious activity by embedding the final payload within the memory space of a legitimate, Microsoft-signed Windows process, specifically the Character Map utility (charmap.exe).
The initial infection vector relies on social engineering, where a victim is tricked into opening the batch file, likely received via email, a malicious link, or a compromised download. Upon execution, the batch file silently launches PowerShell, which then proceeds to decode and assemble various components. These components are strategically placed in a randomly named temporary directory, making them harder to locate.
A key element of the attack involves a disguised, legitimate AutoIt interpreter. This interpreter is used to execute a loader script, which in turn decrypts the final payload in memory. To ensure persistence, a batch file is written to the user's Startup folder, allowing the malicious components to relaunch automatically upon system reboots without requiring administrator privileges or modifying the Windows Registry.
The final stage of the attack is particularly stealthy. The loader script invisibly launches the 32-bit Character Map program (charmap.exe). Using Windows programming functions, it allocates memory within this legitimate process, copies the decrypted malicious payload, and initiates a new thread to execute it. This technique results in a fileless .NET-based AsyncRAT implant running directly within the memory of charmap.exe, leaving no executable file on disk.
This process injection method is designed to evade security measures that rely on identifying known malicious executable names. By hiding within a signed Windows process, the malicious activity, including network communications and potential credential access, appears to originate from a trusted source. Researchers noted that the injected DLL, identified as Veukuzmw.dll, contains familiar AsyncRAT functionalities, including screen capture capabilities.
Furthermore, the attackers have taken steps to disable or bypass security mechanisms. Analysis revealed that the Windows Antimalware Scan Interface (AMSI) has been patched within the infected process, reducing the visibility of subsequent script and assembly activity. This allows the loader script to exit cleanly, leaving only the compromised charmap.exe process running.
Detection of this campaign relies on observing anomalous behavior rather than solely relying on file signatures. Security analysts are advised to look for unusual patterns such as hidden PowerShell processes writing to temporary and startup directories, unexpected launches of charmap.exe, and the creation of remote threads or outbound network connections from this process. These indicators can help expose the attack chain before significant damage occurs.
To mitigate the risk, users should exercise caution with unexpected "invoice" files and avoid opening attachments, links, or software from unverified sources. Security teams can enhance their defenses by hunting for hidden scripting activities, persistence mechanisms in startup folders, and trusted processes exhibiting unusual behavior, leveraging insights from this and similar AsyncRAT delivery campaigns.