Executive Summary

Amethyst Systems recently isolated and analyzed a live, multi-stage AsyncRAT campaign deployed by a low-tier commodity threat actor. While AsyncRAT is a well-documented framework, this specific variant showcases distinct tactical modifications: it utilizes localized batch scripts for initial delivery, masquerades as a native Microsoft application for persistence, and deploys an uncataloged secondary binary, Celestial.exe (0 hits on VirusTotal), engineered to perform localized geofencing and immediate self-deletion upon regional mismatch.

The Execution Matrix & Attack Chain Timeline

Using a hardened sandbox environment equipped with stealth kernel tracking, the complete execution timeline was reconstructed into three core phases: Staging, Persistence/C2 Establishment, and Scout Reconnaissance.

[Original Sample] 
       │
       ▼ (Spawns)
[AppData\Local\Temp\tmp3A50.tmp.bat]
       │
       ▼ (Copies & Executes)
[AppData\Roaming\OneDriveStandaloneUpdater.exe] ───► Establishes C2 (2.27.4.236:5552)
       │
       ▼ (Drops & Spawns)
[Celestial.exe] ───► DNS Query (ipwho.is) ───► Regional Mismatch ───► Self-Delete

Phase 1: Staging and Masquerading

Upon manual execution, the original malware binary drops an interim orchestration script directly into the user’s localized temporary directory rather than the standard roaming path:

  • Path: \AppData\Local\Temp\tmp3A50.tmp.bat

This batch file acts as the primary deployment mechanism. It handles the physical file migration, copying the main AsyncRAT payload into the target’s roaming profile under a highly trusted Microsoft process name to evade casual file-system audits:

  • Target Dropped Path: \AppData\Roaming\OneDriveStandaloneUpdater.exe

Phase 2: Registry Persistence & C2 Infrastructure

Once the batch file successfully stages the masqueraded binary, the primary AsyncRAT engine executes and immediately establishes a programmatic foothold within the current user hive.

Sysmon tracked a clean Event ID 13 (Registry Value Set) targeting the standard startup keys:

  • Key Path: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveStandaloneUpdater
  • Value Data: Pointing directly to the newly dropped executable in Roaming.

With persistence locked down, the implant instantiates an outbound TCP socket to its hardcoded Command and Control (C2) node:

  • C2 Infrastructure: 2.27.4.236 on Port 5552 (Note: Port 5552 is a secondary standard default configuration for customized AsyncRAT builder profiles).

Phase 3: The Celestial.exe Zero-Day Scout Loop

Shortly after establishing its C2 connection, AsyncRAT drops and executes a completely unique, uncataloged secondary binary:

  • Payload: Celestial.exe

Our lab’s kernel file watcher successfully seized this artifact immediately upon creation. Cross-referencing the cryptographic hash against VirusTotal yielded zero existing signatures, confirming a completely fresh packer or private variant.

Celestial.exe acts strictly as an environmental validation guardrail:

  1. Reconnaissance: Upon execution, it immediately fires an outbound DNS request (Sysmon Event ID 22) to the public geolocation API ipwho.is. It parses the JSON payload to inspect the victim’s country code, network provider, and organization profile.
  2. Defensive Evacuation: Because our sandbox architecture resides outside the actor’s intended geo-target zone, Celestial.exe immediately invoked a self-deletion routine, destroying its physical disk footprint to prevent deep-dive analysis.
  3. Active Hook: Crucially, while the scout binary self-destructed, the primary OneDriveStandaloneUpdater.exe (AsyncRAT) process remained actively hooked into the system memory, waiting for secondary instructions.

Blue Team Takeaways and Indicators of Compromise (IoCs)

This campaign underscores the absolute necessity of monitoring temporary directories and auditing outbound network traffic originating from trusted app paths like OneDrive. Automated sandboxes with short runtime queues (under 10 minutes) would completely miss this attack chain due to the delayed deployment of the secondary payload.

Network IoCs:

  • 2.27.4.236:5552 (AsyncRAT C2 Infrastructure)
  • ipwho.is (External Geolocation Profiling)

Host IoCs:

  • \AppData\Local\Temp\tmp3A50.tmp.bat
  • \AppData\Roaming\OneDriveStandaloneUpdater.exe
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveStandaloneUpdater

Hashes:

  • OneDriveStandaloneUpdater
    • MD5: 833ccdfb580089d067baad896c99c0ba
    • SHA1: f1ba4918d53951a50db649248e28db908618ae81
    • SHA256: 85cd6c3229f9ab547cc54f2cbdcf6ef2937987c0181e5ffa3c4205105df8e8fe
  • Celestial
    • MD5: 5dc9cd59722b51a6e045ff66eaff7e8c
    • SHA1: d2cff20c98226e0d40c4dde58e9d5b3290c989af
    • SHA256: f6bbdfef7eaca7684da3fffc263d2b79c922270af17830d0f26f8507752b51cf