eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 2000+ organizations in 80+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
We provide sophisticated cybersecurity solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs). Find out why you should partner with eSentire, the Authority in Managed Detection and Response, today.
Adversaries don’t work 9-5 and neither do we. At eSentire, our 24/7 SOCs are staffed with Elite Threat Hunters and Cyber Analysts who hunt, investigate, contain and respond to threats within minutes.
We have discovered some of the most dangerous threats and nation state attacks in our space – including the Kaseya MSP breach and the more_eggs malware.
Our Security Operations Centers are supported with Threat Intelligence, Tactical Threat Response and Advanced Threat Analytics driven by our Threat Response Unit – the TRU team.
In TRU Positives, eSentire’s Threat Response Unit (TRU) provides a summary of a recent threat investigation. We outline how we responded to the confirmed threat and what recommendations we have going forward.
Here’s the latest from our TRU Team…
What did we find?
In June 2024, eSentire’s Threat Response Unit (TRU) observed several incidents involving users downloading the ScreenConnect remote access client. ScreenConnect is a remote access tool that can allow unauthorized access to a user's system if exploited by threat actors. We assess with medium confidence that the initial infection vector was a drive-by download.
This occurred when users visited a deceptive site that redirected them to download the ScreenConnect application automatically. With the established session via ScreenConnect, the threat actor dropped an executable file that eventually led to the infection of AsyncRAT, which is a remote access trojan (Figure 1).
Based on a review of available logs, we determined that the user in one case downloaded the ScreenConnect instance from a compromised WordPress site aviranpreschool[.]com, which was redirected from lomklauekabjikaiwoge[.]com. When launched, ScreenConnect connected to threat actor’s instance at fa-histsedueg.screenconnect[.]com.
Figure 1: Infection chain
As mentioned previously, using ScreenConnect, the threat actor dropped the executable file uy5a7ykit5s7xs7isi9i.exe (MD5: 6bdba391a77bb67cb5aaae203d061ea8).
The executable is an NSIS installer that contains an NSI script and embedded AutoIt components and batch scripts.
The NSI script is responsible for executing the batch file named “Industries.cmd” (MD5: 3f8ca557d51e210952bdd7180cb33d10) (Figure 2).
Figure 2: The contents of the "Industries" batch file
The Industries.cmd batch file performs the following actions:
cmd /c copy /b Password + Ranging + Real 95885\B
Creates a new binary file by combining the contents of files “Password”, “Ranging”, and “Real” within the NSIS installer into a single file named B (MD5: 4f3bb0cdfff1c15b75041d07c1b7aac9) within directory 95885.
“B” is the malicious AutoIt script containing the embedded AsyncRAT payload.
Concatenates multiple files into a single file named “Lay.pif” (MD5: b06e67f9767e5023892d9698703ad098) under the 95885 folder
Lay.pif is the renamed AutoIt executable used to execute the AutoIT script.
start /I 95885\Lay.pif 95885\B
Executes the malicious AutoIT script using the rebuilt AutoIT executable.
ping -n 5 127.0.0.1
Introduces a 5 second delay to ensure all previous commands completed.
tasklist | findstr /I "wrsa.exe opssvc.exe" 1>NUL & if not errorlevel 1 ping -n 183 127.0.0.1
Introduces a 183-second delay if wrsa.exe (WebRoot Endpoint Protection service) or opssvc.exe (Quick Heal AntiVirus software) are running. This is likely done to evade detections by the aforementioned security software.
The script also checks for processes such as avastui.exe (Avast antivirus software), avgui.exe (AVG AntiVirus), nswscsvc.exe (Norton Security), and sophoshealth.exe (Sophos endpoint). If any of these processes are found, it executes a malicious AutoIt script using the original AutoIt executable. It's possible this step is taken to evade detection for renamed binaries by these AV agents.
The malicious AutoIt script is responsible for decrypting the embedded AsyncRAT payload via RC4 and subsequently injecting it into either RegAsm.exe or AppLaunch.exe if bdagent.exe (Bitdefender Agent) is detected as a running process. You can access the configuration for the AsyncRat payload on our GitHub page.
In conclusion, the June 2024 incidents analyzed by eSentire's Threat Response Unit illustrate how threat actors utilized the ScreenConnect client to establish unauthorized remote sessions. By deceiving users into downloading ScreenConnect via misleading websites, the attackers gained remote access and subsequently deployed the AsyncRAT trojan.
We also provided remediation recommendations and support to the customer.
What can you learn from this TRU Positive?
eSentire’s Threat Response Unit observed two incidents in June 2024 where users inadvertently downloaded the ScreenConnect client from deceptive websites, leading to unauthorized remote access and deployment of the AsyncRAT trojan.
Threat actors leveraged ScreenConnect access to remotely drop and execute malicious scripts, facilitating the AsyncRAT infection, which is a remote access trojan capable of significant system control and data theft.
The infection process detailed in the article includes techniques like delaying tactics to evade detection, and conditional script execution based on the presence of specific antivirus processes.
The incidents underline the importance of caution when downloading software, especially from unverified or suspicious sources, to prevent malware infections.
Recommendations from our Threat Response Unit (TRU):
We recommend implementing the following controls to help secure your organization:
Encourage your employees to use password managers instead of using the password storage feature provided by web browsers. Use master passwords where applicable.
The eSentire Threat Response Unit (TRU) is an industry-leading threat research team committed to helping your organization become more resilient. TRU is an elite team of threat hunters and researchers that supports our 24/7 Security Operations Centers (SOCs), builds threat detection models across the eSentire XDR Cloud Platform, and works as an extension of your security team to continuously improve our Managed Detection and Response service. By providing complete visibility across your attack surface and performing global threat sweeps and proactive hypothesis-driven threat hunts augmented by original threat research, we are laser-focused on defending your organization against known and unknown threats.
Cookies allow us to deliver the best possible experience for you on our website - by continuing to use our website or by closing this box, you are consenting to our use of cookies. Visit our Privacy Policy to learn more.
