Remote-Access Trojan Masquerades as Trusted System Utility Through Memory Injection

AsyncRAT Campaign Uses Multi-Stage Chain to Evade Endpoint Detection

A newly analyzed AsyncRAT campaign uses a five-stage infection chain combining a malicious batch file, concealed PowerShell, a signed AutoIt interpreter and process injection to run the remote-access trojan from memory.

Researchers at Point Wild found that the final payload is injected into Microsoft's charmap.exe, allowing malicious activity to appear under a trusted system process rather than an obviously suspicious executable.

Fake Invoice File Starts the Infection

The attack begins with a file named “Right-click to open Invoice Details.bat.”

When executed, it launches PowerShell with its window hidden and reconstructs an encoded payload from multiple Base64 fragments. Junk characters are removed before a repeating-key XOR routine recovers the next stage.

Signed AutoIt Interpreter Helps Maintain Persistence

The PowerShell stage creates an obfuscated directory under %LOCALAPPDATA%\Temp and drops a legitimate, signed AutoIt executable alongside the kojuyn.ini loader and an encrypted extensionless payload.

It also places h73la8.bat in the user's Startup folder. This causes the chain to restart at every login without requiring administrator privileges or registry Run keys.

Payload Moves Into charmap.exe

The AutoIt loader reconstructs Windows API calls including OpenProcess, VirtualAllocEx, WriteProcessMemory and CreateRemoteThread.

It decrypts the payload in memory and launches %WINDIR%\SysWOW64\charmap.exe, then injects the malicious code into that trusted process.

Memory Analysis Confirms the Implant

PE-Sieve identified an implanted PE image insidecharmap.exewithout a matching executable on disk.

Researchers also observed modified CLR and AMSI-related modules, suggesting that the .NET runtime was loaded and AMSI protections may have been altered in memory.

RAT Enables Surveillance and Data Theft

The injected payload produces an obfuscated AsyncRAT component capable of capturing screenshots and collecting system information.

Researchers observed the C2 indicator 158[.]51[.]122[.]136:4944, communicating over raw TCP rather than conventional web traffic.

Behavior Offers Better Detection Opportunities

Point Wild recommends focusing on the execution chain rather than relying solely on filenames or static signatures, which can change between builds.

Security teams should investigate hidden PowerShell launched by batch files, AutoIt interpreters operating from user-writable directories, Startup-folder scripts referencing temporary paths, and suspiciouscharmap.exeinstances.

Monitor Cross-Process Injection

EDR systems should also flag remote memory allocation, cross-process writes and CreateRemoteThread activity involving charmap.exe.

Correlating these behaviors can provide stronger detection against variants that change their filenames, encryption keys or hashes.