AsyncRAT Uses AutoIt in a Five-Stage Infection Chain

A five-stage AsyncRAT infection chain has been identified that uses a socially engineered batch file and the legitimate AutoIt interpreter for execution. The malware relies on layered obfuscation, including Base64 fragment reconstruction and multiple rounds of XOR decryption, to evade detection. The final stage deploys a .NET-based AsyncRAT payload that is injected into a legitimate Windows process to steal information and capture screenshots.

The investigation traced execution from a malicious batch file to a PowerShell script, followed by an AutoIt loader script named kojuyn.ini that drops an encrypted payload. Analysts used PE-Sieve to confirm process injection into charmap.exe and determined that the payload was a .NET assembly capable of AMSI patching. The final payload was recovered from memory as Veukuzmw.dll .

Defenders should monitor for suspicious PowerShell execution using hidden windows and for batch files created inside the User Startup folder. Organizations should restrict unsigned script execution and watch for legitimate binaries such as charmap.exe initiating unexpected outbound network connections. Enhanced monitoring of AutoIt interpreter activity and memory injection attempts is also recommended.

If AsyncRAT activity is detected, the affected endpoint should be isolated immediately to stop further C2 communication or data exfiltration. Responders should perform memory forensics to identify injected payloads and preserve volatile artifacts. Systems should also be checked for persistence mechanisms in the Startup folder, while PowerShell command history should be reviewed for additional staging or lateral movement.

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

Attack Narrative & Commands: The attacker has gained initial access and wishes to establish persistence. To avoid detection, they avoid direct Registry modifications. Instead, they use a command shell ( cmd.exe ) to invoke a hidden PowerShell instance. This PowerShell instance is instructed to write a small malicious batch file into the current user’s Startup folder. This ensures that even after a reboot, the attacker’s code will run automatically when the user logs in.

Attack Narrative & Commands: The attacker has gained initial access and wishes to establish persistence. To avoid detection, they avoid direct Registry modifications. Instead, they use a command shell ( cmd.exe ) to invoke a hidden PowerShell instance. This PowerShell instance is instructed to write a small malicious batch file into the current user’s Startup folder. This ensures that even after a reboot, the attacker’s code will run automatically when the user logs in.

Regression Test Script: # This script simulates the exact chain: CMD -> PowerShell (Hidden) -> Write to Startup $startupFolder = "$env:APPDATAMicrosoftWindowsStart MenuProgramsStartup" $targetFile = Join-Path $startupFolder "persistence_test.bat" $payloadContent = "@echo off`necho 'Persistence Test Successful'" # We execute via CMD to satisfy the 'ParentImage: cmd.exe' requirement of the rule Start-Process cmd.exe -ArgumentList "/c powershell.exe -WindowStyle Hidden -Command `"$payloadContent | Out-File -FilePath '$targetFile' -Encoding ascii`"" -Wait Write-Host "Simulation command sent. Check Sysmon Event ID 1 and 11."

Regression Test Script:

Cleanup Commands: $startupFolder = "$env:APPDATAMicrosoftWindowsStart MenuProgramsStartup" $targetFile = Join-Path $startupFolder "persistence_test.bat" if (Test-Path $targetFile) { Remove-Item $targetFile -Force Write-Host "Cleanup complete: $targetFile removed." } else { Write-Host "File not found, cleanup unnecessary." }

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.