AsyncRAT Malware Abuses AutoIt and PowerShell to Hide Inside Legitimate Windows Process

A five-stage AsyncRAT campaign that chains a socially engineered batch file, hidden PowerShell execution, AutoIt abuse and process injection to conceal a .NET remote-access trojan inside Microsoft’s legitimate charmap.exe process.

The infection begins with a lure named “Right-click to open Invoice Details.bat”, which relies on user interaction to trigger execution.

While the precise delivery method was not established, such files are commonly distributed through phishing attachments, malicious download links, trojanized software and messaging-platform lures.

Once opened, the batch file launches PowerShell with its window hidden and user profile loading disabled.

It reconstructs an encoded payload from ten Base64 fragments, removes deliberately inserted junk characters and applies a repeating-key XOR routine to recover the next-stage data.

This approach breaks static signatures: the full Base64 content, meaningful filenames and final payload are never exposed as a single, easily scannable string.

The PowerShell stage creates an obfuscated folder beneath %LOCALAPPDATA%Temp and writes three artifacts: a renamed but legitimate signed AutoIt interpreter, an AutoIt loader script called kojuyn.ini, and an extensionless encrypted blob identified as nloemfbihmhm.

It also creates a batch file, h73la8.bat, in the current user’s Startup folder. At each logon, that script relaunches the renamed AutoIt executable with kojuyn.ini as its argument, establishing persistence without a Run key, scheduled task or administrative privileges.

This behavior maps to MITRE ATT&CK’s Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder technique, T1547.001.

The persistence mechanism is notable because it uses a legitimate signed interpreter rather than a custom malicious executable.

Point Wild Threat Intelligence Researchers said that, the campaign demonstrates how commodity RAT operators are combining lightweight scripting and in-memory execution to defeat file-based detection.

AsyncRAT Hides in Windows Processes

The AutoIt binary provides a trusted-looking execution container, while the accompanying script contains the malicious logic.

The blue circular icon in the listing is the AutoIT icon rather than a generic application icon. The size of AutoIT.exe is roughly 900 KB–1 MB depending on version.

The malware’s filenames and XOR keys can rotate between builds, but the behavioral sequence hidden PowerShell, writes into a user-writable Temp path, Startup-folder persistence and AutoIt execution offers defenders a more durable detection opportunity.

The kojuyn.ini loader dynamically reconstructs Windows API names such as OpenProcess, VirtualAllocEx, WriteProcessMemory and CreateRemoteThread from XOR-encoded integer arrays.

It then reads the extensionless payload, decrypts it in memory using the single-byte XOR key 0x36, and launches %WINDIR%SysWOW64charmap.exe with its window hidden.

The loader injects the decrypted content through the classic remote-thread process-injection sequence:

OpenProcess → VirtualAllocEx → WriteProcessMemory → CreateRemoteThread

PE-Sieve analysis identified an implanted PE image in charmap.exe with no corresponding file on disk, confirming that the payload was operating from memory.

The scan also found modified CLR and AMSI-related modules, indicating the .NET runtime was loaded and that AMSI scanning may have been patched in-process.

Using Character Map gives the malware a Microsoft-signed host process for its activity.

Network communication, system discovery and collection actions can therefore appear to originate from charmap.exe rather than from a suspicious executable launched from a Temp directory.

Subsequent decrypted stages produce Veukuzmw.dll, an obfuscated AsyncRAT payload with screen-capture and information-stealing functionality.

The RAT captures the primary display through .NET graphics APIs, encodes screenshots in memory and can return the collected data over its command-and-control channel.

Researchers observed a C2 indicator at 158[.]51[.]122[.]136:4944, using raw TCP rather than web traffic.

AsyncRAT is an open-source remote-access tool that has repeatedly been repurposed in malicious campaigns; known capabilities include remote command execution, monitoring and data theft.

Security teams should monitor for hidden PowerShell spawned by batch files, especially where the parent or child process operates from %TEMP% or %LOCALAPPDATA%.

High-value alerts include AutoIt interpreters launched from user-writable locations, Startup-folder batch files that reference Temp paths, and charmap.exe instances created by suspicious AutoIt or PowerShell parent processes.

EDR telemetry should also flag remote memory allocation, cross-process writes and CreateRemoteThread activity targeting charmap.exe, alongside AMSI memory modifications.

Correlating these behaviors is more resilient than relying on changing filenames, XOR keys or hashes.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

★ Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.