AsyncRAT Campaign Uses AutoIt for Multi-Stage Malware Delivery

Summary

A five-stage AsyncRAT infection chain has been identified that uses a socially engineered batch file and the legitimate AutoIt interpreter for execution. The malware relies on layered obfuscation, including Base64 fragment reconstruction and multiple rounds of XOR decryption, to evade detection. The final stage deploys a .NET-based AsyncRAT payload that is injected into a legitimate Windows process to steal information and capture screenshots.

Investigation

The investigation traced execution from a malicious batch file to a PowerShell script, followed by an AutoIt loader script named kojuyn.ini that drops an encrypted payload. Analysts used PE-Sieve to confirm process injection into charmap.exe and determined that the payload was a .NET assembly capable of AMSI patching. The final payload was recovered from memory as Veukuzmw.dll.

Mitigation

Defenders should monitor for suspicious PowerShell execution using hidden windows and for batch files created inside the User Startup folder. Organizations should restrict unsigned script execution and watch for legitimate binaries such as charmap.exe initiating unexpected outbound network connections. Enhanced monitoring of AutoIt interpreter activity and memory injection attempts is also recommended.

Response

If AsyncRAT activity is detected, the affected endpoint should be isolated immediately to stop further C2 communication or data exfiltration. Responders should perform memory forensics to identify injected payloads and preserve volatile artifacts. Systems should also be checked for persistence mechanisms in the Startup folder, while PowerShell command history should be reviewed for additional staging or lateral movement.

Simulation Execution

• Attack Narrative & Commands: The attacker has gained initial access and wishes to establish persistence. To avoid detection, they avoid direct Registry modifications. Instead, they use a command shell (cmd.exe) to invoke a hidden PowerShell instance. This PowerShell instance is instructed to write a small malicious batch file into the current user’s Startup folder. This ensures that even after a reboot, the attacker’s code will run automatically when the user logs in.

• Regression Test Script:

  # This script simulates the exact chain: CMD -> PowerShell (Hidden) -> Write to Startup
  $startupFolder = "$env:APPDATAMicrosoftWindowsStart MenuProgramsStartup"
  $targetFile = Join-Path $startupFolder "persistence_test.bat"
  $payloadContent = "@echo off`necho 'Persistence Test Successful'"
  
  # We execute via CMD to satisfy the 'ParentImage: cmd.exe' requirement of the rule
  Start-Process cmd.exe -ArgumentList "/c powershell.exe -WindowStyle Hidden -Command `"$payloadContent | Out-File -FilePath '$targetFile' -Encoding ascii`"" -Wait
  
  Write-Host "Simulation command sent. Check Sysmon Event ID 1 and 11."

• Cleanup Commands:

  $startupFolder = "$env:APPDATAMicrosoftWindowsStart MenuProgramsStartup"
  $targetFile = Join-Path $startupFolder "persistence_test.bat"
  if (Test-Path $targetFile) {
      Remove-Item $targetFile -Force
      Write-Host "Cleanup complete: $targetFile removed."
  } else {
      Write-Host "File not found, cleanup unnecessary."
  }