AutoIT Payload Injector A New Wave of Malware
AutoIT Payload Injector: A New Wave of Malware
For a long time, AutoIT has been a common tool in the malware ecosystem. Threat actors continue to use it due to its ease of use and powerful capabilities. Recently, a surge of similar emails delivering this type of payload has been detected. The initial example began with a fake bank email containing a RAR archive named Bank_account_details.rar.
The archive includes a VBS script that decodes a Base64 payload, saves it to disk with a random name, and invokes a PowerShell interpreter to decompress it. The PowerShell command used is:
1
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "$in='C:\Users\cape2\AppData\Local\Temp\tmp656234.bat.gz'; $out='C:\Users\cape2\AppData\Local\Temp\tmp656234.bat'; $fs=New-Object IO.FileStream($in,[IO.FileMode]::Open); $gz=New-Object IO.Compression.GzipStream($fs,[IO.Compression.CompressionMode]::Decompress); $ms=New-Object IO.MemoryStream;$gz.CopyTo($ms); $gz.Close(); $fs.Close(); [IO.File]::WriteAllBytes($out,$ms.ToArray()); Remove-Item $in"
Once unzipped, the VBS will execute the dumped script. Another PowerShell command will create three new files on disk: vijewyufveonabghulluonouceyasi.exe, wwman, and Ennnn. These files are Base64 encoded and XOR with the keys 0x02 and 0x3D.
PowerShell will then execute:
1
C:\Users\REM\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe "C:\Users\REM\AppData\Roaming\SetupFiles\wwmaw"
Persistence is achieved through a classic Run key:
1
reg add HKCU\...\CurrentVersion\Run /v Windows32 /t REG_SZ /d "[...]\vijewyufveonabghulluonouceyasi.exe" "[...]\wwmaw"
The executable vijewyufveonabghulluonouceyasi.exe is an AutoIT3 interpreter. The script wwman will perform the injection of the shellcode stored in Ennnn.
This AutoIT script decodes the shellcode (XOR key 0xEC), launches charmap.exe, and injects the payload using API calls such as OpenProcess, VirtualAllocEx, WriteProcessMemory, CreateRemoteThread, and CloseHandle. The process charmap.exe is the legitimate executable for the Character Map utility in Windows.
In conclusion, the shellcode delivers a VIPKeylogger malware that communicates with cphost17.qhoster.net. It appears that AutoIT is making a comeback, as another malware analysis report describes a similar infection path.