Threat Advisory

AsyncRAT Delivered via AutoIT: Full Chain Analysis

Threat: Malware
Targeted Region: Global
Targeted Sector: Technology & IT
Criticality: High
[subscribe_to_unlock_form]

EXECUTIVE SUMMARY:

AsyncRAT is a five-stage infection chain that begins with a socially engineered batch file, Right-click to open Invoice a batch script. The batch file launches PowerShell with a hidden window and disables the profile before executing a a script payload script. It drops three files into an obfuscated build-specific folder under a renamed but legitimate signed AutoIT interpreter, an AutoIT loader script (a malicious file), and an extensionless encrypted payload.

The AutoIT script builds every API name and string at runtime from XOR-encoded integer lists, decrypts the payload in memory with a single-byte key, and injects it a malicious executable via the standard OpenProcess → VirtualAllocEx → WriteProcessMemory → CreateRemoteThread chain. Successive stages decrypt to a final AsyncRAT DLL (a malicious library) with screen capture and information stealing functionality.[/subscribe_to_unlock_form]

EXECUTIVE SUMMARY:

AsyncRAT is a five-stage infection chain that begins with a socially engineered batch file, Right-click to open Invoice a batch script. The batch file launches PowerShell with a hidden window and disables the profile before executing a a script payload script. It drops three files into an obfuscated build-specific folder under a renamed but legitimate signed AutoIT interpreter, an AutoIT loader script (a malicious file), and an extensionless encrypted payload.

The AutoIT script builds every API name and string at runtime from XOR-encoded integer lists, decrypts the payload in memory with a single-byte key, and injects it a malicious executable via the standard OpenProcess → VirtualAllocEx → WriteProcessMemory → CreateRemoteThread chain. Successive stages decrypt to a final AsyncRAT DLL (a malicious library) with screen capture and information stealing functionality.[emaillocker id="1283"]

The infection chain begins with phishing emails or malicious links that trick users into opening malware, which downloads a batch file that executes PowerShell with a hidden window and disables the profile before executing a a script payload script. The payload is delivered through AutoIT scripts that decrypt and inject the final AsyncRAT DLL into a malicious executable.

THREAT PROFILE:

Tactic Technique Id Technique Sub-technique
Initial access T1566.001 Phishing Spearphishing Attachment
Execution T1059.003 Command and Scripting Interpreter Windows Command Shell
Execution T1204.002 User Execution Malicious File
Persistence T1547.001 Boot or Logon Autostart Execution Registry Run Keys / Startup Folder
Defence Evasion T1055.002 Process Injection Portable Executable Injection
Defence Evasion T1140 Deobfuscate/Decode Files or Information -
Discovery T1082 System Information Discovery -
Collection T1113 Screen Capture -
Command and control T1071.001 Application Layer Protocol Web Protocols
Exfiltration T1041 Exfiltration Over C2 Channel -

MBC MAPPING:

Objective Behavior ID Behavior
Anti-Static Analysis B0032 Executable Code Obfuscation
Anti-Behavioral Analysis B0003 Dynamic Analysis Evasion
Defense Evasion B0029 Polymorphic Code
Execution E1204 User Execution
Persistence F0012 Registry Run Keys / Startup Folder
Defense Evasion E1055 Process Injection
Command & Control B0030 C2 Communication
Discovery E1083 File and Directory Discovery
Exfiltration E1020 Automated Exfiltration

REFERENCES:

The following reports contain further technical details:

[/emaillocker]
crossmenu