AutoHotKey

The infection flow starts with an XLSM document with malicious macros, which is sent to potential victims via e-mail under the subject “Military Financing Program”.

AutoHotkeyU32.ahk→an AHK script which sends a POST request to the C&C server and can receive additional AHK script URLs to download and execute.

Once the macros are enabled, two files are extracted from hex encoded cells within the XLSM document.

The victim was instructed to launch Quick Assist and grant the threat actors access. Once connected, threat actors navigated to an Amazon S3-hosted phishing site and downloaded AutoHotkey along with a malicious AutoHotkey script, which was then executed to install Edgecution.

Once the macros are enabled, two files are extracted from hex encoded cells within the XLSM document.

Finally, persistence is gained by adding a new value to the following registry key: “HKCU\Software\Microsoft\Windows\CurrentVersion\Run”

After renaming the extracted files, a shortcut to the AutoHotkey is created in the AppData directory. The arguments to the shortcut are the AutoHotkey script and the Mekotio DLL.

the attack chain... ultimately deploying AutoHotkey-based loaders that reflectively inject a .NET remote access trojan and AsynRAT into memory... That Execute() implements a full process hollowing workflow.

That Execute() implements a full process hollowing workflow... creates a legitimate .NET process in a suspended state... optionally unmaps the original image, allocates memory within the remote process, writes the payload’s headers and sections... and finally resumes the suspended thread.

Finally, persistence is gained by adding a new value to the following registry key: “HKCU\Software\Microsoft\Windows\CurrentVersion\Run”

After renaming the extracted files, a shortcut to the AutoHotkey is created in the AppData directory. The arguments to the shortcut are the AutoHotkey script and the Mekotio DLL.

All strings in the stager are obfuscated by a single-byte XOR routine... The file in question was obfuscated through the free JavaScript obfuscation service Obfuscator.io.

It builds a working folder under a path crafted to mimic a Windows audio diagnostics component, then extracts and decodes embedded blocks into files named to look like Realtek tooling.

the attack chain... ultimately deploying AutoHotkey-based loaders that reflectively inject a .NET remote access trojan and AsynRAT into memory... That Execute() implements a full process hollowing workflow.

That Execute() implements a full process hollowing workflow... creates a legitimate .NET process in a suspended state... optionally unmaps the original image, allocates memory within the remote process, writes the payload’s headers and sections... and finally resumes the suspended thread.

Deletes itself with the following command: cmd /c start /min "" cmd /c timeout 4 & del "' A_AhkPath '" 2>nul & del "' A_ScriptFullPath '" & exit /b

A legitimate AutoHotkeyU32.exe program.

hinfo.ahk : Sends the victim’s username and computer information to the C&C server.

hscreen.ahk : Takes a screenshot of the victim’s PC and uploads it to the C&C server.

Next, a secondary zip file with a random file name is downloaded to the directory. The downloaded zip archive contains three files: Mekotio payload DLL, AutoHotkey interpreter and AutoHotkey script.

can receive additional AHK script URLs to download and execute... htv.ahk : Downloads a malicious version of TeamViewer, executes it

sends a POST request to the C&C server... Takes a screenshot of the victim’s PC and uploads it to the C&C server... sends the login credentials to the C&C server.