AutoIT Payload Injector

1. Executive summary

An active email campaign distributing a multi-stage AutoIT payload injector has been observed since late July 2026. The attack chain begins with a phishing email delivering a RAR archive containing a VBS dropper, which decompresses and executes a payload that ultimately injects shellcode into the legitimate Windows charmap.exe process. The final payload is identified as VIPKeylogger, which communicates with a known C2 domain. EMEA financial services are directly targeted by the initial lure, which impersonates a bank and uses the filename Bank_account_details.rar.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item.

3. Technical analysis & attack chain

Attribution for the campaign is unconfirmed. The final payload is identified as VIPKeylogger, but no named threat actor with a MITRE profile is identified in the available data. The following attack chain is reconstructed from a single source (SANS ISC); verify before enforcement.

Initial access: A phishing email impersonating a bank delivers Bank_account_details.rar (SHA256: 5c4ca58e41c009c664a7134df12b0fdc0815f572e117fe67ca35582f19d9deab).
VBS execution: The archive contains a VBS script (SHA256: f88d9094a90f7000a3fb2cd7c981e03357ce2b39df9de5ee1d0742e619e3860f). The script decodes a Base64 payload, writes it to disk as a .bat.gz file in %TEMP%, and invokes PowerShell to GZip-decompress it.
Payload dumping: The decompressed .bat script invokes another PowerShell process that writes three files to C:\Users\REM\AppData\Roaming\SetupFiles\. The files (vijewyufveonabghulluonouceyasi.exe, wwman, Ennnn) are Base64-decoded and XOR-decrypted using keys 0x02 and 0x3D.
Execution & persistence: PowerShell executes vijewyufveonabghulluonouceyasi.exe (an AutoIT3 interpreter, SHA256: bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1) with wwmaw as an argument. Persistence is established via a Run key: reg add HKCU\...\CurrentVersion\Run /v Windows32 /t REG_SZ /d "[...]\vijewyufveonabghulluonouceyasi.exe" "[...]\wwmaw".
Shellcode injection: The AutoIT script (wwman) reads the shellcode file Ennnn, XOR-decodes it with key 0xEC (decimal 236), and launches C:\Windows\Syswow64\charmap.exe in a hidden window (@SW_HIDE). Using DllCall to kernel32.dll, the script performs process injection via OpenProcess, VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread.
Payload & C2: The injected shellcode delivers VIPKeylogger, which communicates to cphost17[.]qhoster[.]net.

4. Mitigation & containment

P1 — Within 24 hours

Block network communication to cphost17[.]qhoster[.]net at perimeter firewall and proxy controls.
Add file hashes from §5 to EDR block lists and quarantine rules.
Search endpoint telemetry for the presence of vijewyufveonabghulluonouceyasi.exe or the SetupFiles directory under AppData\Roaming.

P2 — Within 72 hours

Hunt for the persistence mechanism: query registry for HKCU\Software\Microsoft\Windows\CurrentVersion\Run value named Windows32.
Monitor for suspicious child processes of charmap.exe, specifically charmap.exe spawning from PowerShell or executing with hidden window state. This is anomalous behaviour for the Character Map utility.
Block execution of .vbs and .rar attachments at the email gateway where business operations permit.

P3 — Within 7 days

Review email security gateway logs for inbound messages containing Bank_account_details.rar or similar bank-impersonation lures delivered since July 2026.
Ensure EDR rules detect AutoIT3 interpreters executing from AppData\Roaming paths with script arguments.

5. Indicators of compromise

type	value	confidence	source
sha256	5c4ca58e41c009c664a7134df12b0fdc0815f572e117fe67ca35582f19d9deab	High	SANS ISC
sha256	f88d9094a90f7000a3fb2cd7c981e03357ce2b39df9de5ee1d0742e619e3860f	High	SANS ISC
sha256	bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1	High	SANS ISC
domain	cphost17[.]qhoster[.]net	High	SANS ISC
filepath	C:\Users\REM\AppData\Roaming\SetupFiles\	Medium	SANS ISC
regkey	HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Windows32	High	SANS ISC

sha256  5c4ca58e41c009c664a7134df12b0fdc0815f572e117fe67ca35582f19d9deab
sha256  f88d9094a90f7000a3fb2cd7c981e03357ce2b39df9de5ee1d0742e619e3860f
sha256  bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1
domain  cphost17[.]qhoster[.]net
filepath  C:\Users\REM\AppData\Roaming\SetupFiles\
regkey  HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Windows32

6. Detection

rule AutoIT_Payload_Injector_VIPKeylogger {
    meta:
        author = "Adverse Trace"
        date = "2026-07-28"
        reference = "https://isc.sans.edu/diary/rss/33192"
        description = "Detects AutoIT script performing shellcode injection into charmap.exe"
    strings:
        $autoit_noTray = "#NoTrayIcon" ascii
        $autoit_func = "Func _O($s)" ascii
        $charmap = "C:\\Windows\\Syswow64\\charmap.exe" ascii
        $shellcode_file = "\\Ennnn" ascii
        $xor_key = "BitXOR(DllStructGetData($S_M, 1, $i), 236)" ascii
        $run_key = "CurrentVersion\\Run /v Windows32" ascii
        $exe_name = "vijewyufveonabghulluonouceyasi.exe" ascii
        $api_open = "4F70656E50726F63657373" ascii
        $api_valloc = "5669727475616C416C6C6F634578" ascii
        $api_write = "577269746550726F636573734D656D6F7279" ascii
        $api_create = "43726561746552656D6F7465546872656164" ascii
    condition:
        4 of them
}

title: Suspicious charmap.exe Execution from AppData via PowerShell
id: 7a3c1f2e-4b5d-4a6e-9c8f-1a2b3c4d5e6f
status: experimental
description: Detects charmap.exe launched in hidden state from an AutoIT interpreter located in AppData\Roaming\SetupFiles, consistent with shellcode injection activity.
author: Adverse Trace
date: 2026/07/28
references:

    - https://isc.sans.edu/diary/rss/33192
logsource:
    category: process_creation
    product: windows
detection:
    selection_target:
        Image|endswith: '\charmap.exe'
    selection_parent:
        ParentImage|contains: '\AppData\Roaming\SetupFiles\'
    condition: selection_target and selection_parent
falsepositives:

    - Unlikely; charmap.exe is not typically launched from user-writable AppData paths
level: high

title: Persistence via Windows32 Run Key Pointing to AppData SetupFiles
id: 8b4d2g3f-5c6e-4b7f-0d9e-2b3c4d5e6f7a
status: experimental
description: Detects the creation of a Run key named 'Windows32' pointing to an executable in AppData\Roaming\SetupFiles, as used by the AutoIT payload injector.
author: Adverse Trace
date: 2026/07/28
references:

    - https://isc.sans.edu/diary/rss/33192
logsource:
    category: registry_event
    product: windows
detection:
    selection:
        TargetObject|contains: '\CurrentVersion\Run\Windows32'
        Details|contains: '\AppData\Roaming\SetupFiles\'
    condition: selection
falsepositives:

    - None known
level: high

7. Sources

SANS Internet Storm Center, "AutoIT Payload Injector", https://isc.sans.edu/diary/rss/33192, 2026-07-28

8. Adverse Trace position

This is a moderately sophisticated but effective phishing campaign using AutoIT for shellcode injection into a legitimate Windows process, culminating in VIPKeylogger deployment. The use of charmap.exe as an injection target and XOR-decoded shellcode stored in a separate file are notable TTPs for detection. The campaign directly targets banking customers with a financial lure, making EMEA financial services clients a likely target demographic. Attribution is unconfirmed and the analysis is single-sourced from SANS ISC reporting; clients should verify IOCs against their own telemetry before broad enforcement. We will monitor for additional samples and corroboration from secondary sources, and will update if C2 infrastructure or attribution details emerge.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.