> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# AutoIT Payload Injector
- URL: https://f4n6.co.uk/security-feed/autoit-payload-injector/
- Published: 2026-07-28T09:49:51.000Z
- Updated: 2026-07-28T09:49:51.000Z
- Author: Jeff Davies
- Tags: #security-feed

## 1\. Executive summary

An active email campaign distributing a multi-stage AutoIT payload injector has been observed since late July 2026\. The attack chain begins with a phishing email delivering a RAR archive containing a VBS dropper, which decompresses and executes a payload that ultimately injects shellcode into the legitimate Windows `charmap.exe` process. The final payload is identified as VIPKeylogger, which communicates with a known C2 domain. EMEA financial services are directly targeted by the initial lure, which impersonates a bank and uses the filename `Bank_account_details.rar`.

## 2\. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item.

## 3\. Technical analysis & attack chain

Attribution for the campaign is unconfirmed. The final payload is identified as VIPKeylogger, but no named threat actor with a MITRE profile is identified in the available data. The following attack chain is reconstructed from a single source (SANS ISC); verify before enforcement.

1. **Initial access:** A phishing email impersonating a bank delivers `Bank_account_details.rar` (SHA256: `5c4ca58e41c009c664a7134df12b0fdc0815f572e117fe67ca35582f19d9deab`).
2. **VBS execution:** The archive contains a VBS script (SHA256: `f88d9094a90f7000a3fb2cd7c981e03357ce2b39df9de5ee1d0742e619e3860f`). The script decodes a Base64 payload, writes it to disk as a `.bat.gz` file in `%TEMP%`, and invokes PowerShell to GZip-decompress it.
3. **Payload dumping:** The decompressed `.bat` script invokes another PowerShell process that writes three files to `C:\Users\REM\AppData\Roaming\SetupFiles\`. The files (`vijewyufveonabghulluonouceyasi.exe`, `wwman`, `Ennnn`) are Base64-decoded and XOR-decrypted using keys `0x02` and `0x3D`.
4. **Execution & persistence:** PowerShell executes `vijewyufveonabghulluonouceyasi.exe` (an AutoIT3 interpreter, SHA256: `bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1`) with `wwmaw` as an argument. Persistence is established via a Run key: `reg add HKCU\...\CurrentVersion\Run /v Windows32 /t REG_SZ /d "[...]\vijewyufveonabghulluonouceyasi.exe" "[...]\wwmaw"`.
5. **Shellcode injection:** The AutoIT script (`wwman`) reads the shellcode file `Ennnn`, XOR-decodes it with key `0xEC` (decimal 236), and launches `C:\Windows\Syswow64\charmap.exe` in a hidden window (`@SW_HIDE`). Using DllCall to `kernel32.dll`, the script performs process injection via `OpenProcess`, `VirtualAllocEx`, `WriteProcessMemory`, and `CreateRemoteThread`.
6. **Payload & C2:** The injected shellcode delivers VIPKeylogger, which communicates to `cphost17[.]qhoster[.]net`.

## 4\. Mitigation & containment

### P1 — Within 24 hours

- Block network communication to `cphost17[.]qhoster[.]net` at perimeter firewall and proxy controls.
- Add file hashes from §5 to EDR block lists and quarantine rules.
- Search endpoint telemetry for the presence of `vijewyufveonabghulluonouceyasi.exe` or the `SetupFiles` directory under `AppData\Roaming`.

### P2 — Within 72 hours

- Hunt for the persistence mechanism: query registry for `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` value named `Windows32`.
- Monitor for suspicious child processes of `charmap.exe`, specifically `charmap.exe` spawning from PowerShell or executing with hidden window state. This is anomalous behaviour for the Character Map utility.
- Block execution of `.vbs` and `.rar` attachments at the email gateway where business operations permit.

### P3 — Within 7 days

- Review email security gateway logs for inbound messages containing `Bank_account_details.rar` or similar bank-impersonation lures delivered since July 2026.
- Ensure EDR rules detect `AutoIT3` interpreters executing from `AppData\Roaming` paths with script arguments.

## 5\. Indicators of compromise

| type     | value                                                              | confidence | source   |
| -------- | ------------------------------------------------------------------ | ---------- | -------- |
| sha256   | 5c4ca58e41c009c664a7134df12b0fdc0815f572e117fe67ca35582f19d9deab   | High       | SANS ISC |
| sha256   | f88d9094a90f7000a3fb2cd7c981e03357ce2b39df9de5ee1d0742e619e3860f   | High       | SANS ISC |
| sha256   | bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1   | High       | SANS ISC |
| domain   | cphost17\[.\]qhoster\[.\]net                                       | High       | SANS ISC |
| filepath | C:\\Users\\REM\\AppData\\Roaming\\SetupFiles\\                     | Medium     | SANS ISC |
| regkey   | HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Windows32 | High       | SANS ISC |

```iocs
sha256  5c4ca58e41c009c664a7134df12b0fdc0815f572e117fe67ca35582f19d9deab
sha256  f88d9094a90f7000a3fb2cd7c981e03357ce2b39df9de5ee1d0742e619e3860f
sha256  bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1
domain  cphost17[.]qhoster[.]net
filepath  C:\Users\REM\AppData\Roaming\SetupFiles\
regkey  HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Windows32

```

## 6\. Detection

```yara
rule AutoIT_Payload_Injector_VIPKeylogger {
    meta:
        author = "Adverse Trace"
        date = "2026-07-28"
        reference = "https://isc.sans.edu/diary/rss/33192"
        description = "Detects AutoIT script performing shellcode injection into charmap.exe"
    strings:
        $autoit_noTray = "#NoTrayIcon" ascii
        $autoit_func = "Func _O($s)" ascii
        $charmap = "C:\\Windows\\Syswow64\\charmap.exe" ascii
        $shellcode_file = "\\Ennnn" ascii
        $xor_key = "BitXOR(DllStructGetData($S_M, 1, $i), 236)" ascii
        $run_key = "CurrentVersion\\Run /v Windows32" ascii
        $exe_name = "vijewyufveonabghulluonouceyasi.exe" ascii
        $api_open = "4F70656E50726F63657373" ascii
        $api_valloc = "5669727475616C416C6C6F634578" ascii
        $api_write = "577269746550726F636573734D656D6F7279" ascii
        $api_create = "43726561746552656D6F7465546872656164" ascii
    condition:
        4 of them
}

```

```yaml
title: Suspicious charmap.exe Execution from AppData via PowerShell
id: 7a3c1f2e-4b5d-4a6e-9c8f-1a2b3c4d5e6f
status: experimental
description: Detects charmap.exe launched in hidden state from an AutoIT interpreter located in AppData\Roaming\SetupFiles, consistent with shellcode injection activity.
author: Adverse Trace
date: 2026/07/28
references:

    - https://isc.sans.edu/diary/rss/33192
logsource:
    category: process_creation
    product: windows
detection:
    selection_target:
        Image|endswith: '\charmap.exe'
    selection_parent:
        ParentImage|contains: '\AppData\Roaming\SetupFiles\'
    condition: selection_target and selection_parent
falsepositives:

    - Unlikely; charmap.exe is not typically launched from user-writable AppData paths
level: high

```

```yaml
title: Persistence via Windows32 Run Key Pointing to AppData SetupFiles
id: 8b4d2g3f-5c6e-4b7f-0d9e-2b3c4d5e6f7a
status: experimental
description: Detects the creation of a Run key named 'Windows32' pointing to an executable in AppData\Roaming\SetupFiles, as used by the AutoIT payload injector.
author: Adverse Trace
date: 2026/07/28
references:

    - https://isc.sans.edu/diary/rss/33192
logsource:
    category: registry_event
    product: windows
detection:
    selection:
        TargetObject|contains: '\CurrentVersion\Run\Windows32'
        Details|contains: '\AppData\Roaming\SetupFiles\'
    condition: selection
falsepositives:

    - None known
level: high

```

## 7\. Sources

- SANS Internet Storm Center, "AutoIT Payload Injector", https://isc.sans.edu/diary/rss/33192, 2026-07-28

## 8\. Adverse Trace position

This is a moderately sophisticated but effective phishing campaign using AutoIT for shellcode injection into a legitimate Windows process, culminating in VIPKeylogger deployment. The use of `charmap.exe` as an injection target and XOR-decoded shellcode stored in a separate file are notable TTPs for detection. The campaign directly targets banking customers with a financial lure, making EMEA financial services clients a likely target demographic. Attribution is unconfirmed and the analysis is single-sourced from SANS ISC reporting; clients should verify IOCs against their own telemetry before broad enforcement. We will monitor for additional samples and corroboration from secondary sources, and will update if C2 infrastructure or attribution details emerge.

---

[Read the original source →](https://isc.sans.edu/diary/rss/33192?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*