Exploring the Infection Chain: ScreenConnect’s Link to AsyncRAT Deployment

Adversaries don’t work 9-5 and neither do we. At eSentire, our 24/7 SOCs are staffed with Elite Threat Hunters and Cyber Analysts who hunt, investigate, contain and respond to threats within minutes.

We have discovered some of the most dangerous threats and nation state attacks in our space – including the Kaseya MSP breach and the more_eggs malware.

Our Security Operations Centers are supported with Threat Intelligence, Tactical Threat Response and Advanced Threat Analytics driven by our Threat Response Unit – the TRU team.

In TRU Positives, eSentire’s Threat Response Unit (TRU) provides a summary of a recent threat investigation. We outline how we responded to the confirmed threat and what recommendations we have going forward.

Here’s the latest from our TRU Team…

What did we find?

In June 2024, eSentire’s Threat Response Unit (TRU) observed several incidents involving users downloading the ScreenConnect remote access client. ScreenConnect is a remote access tool that can allow unauthorized access to a user's system if exploited by threat actors. We assess with medium confidence that the initial infection vector was a drive-by download.

This occurred when users visited a deceptive site that redirected them to download the ScreenConnect application automatically. With the established session via ScreenConnect, the threat actor dropped an executable file that eventually led to the infection of AsyncRAT, which is a remote access trojan (Figure 1).

Based on a review of available logs, we determined that the user in one case downloaded the ScreenConnect instance from a compromised WordPress site aviranpreschool[.]com, which was redirected from lomklauekabjikaiwoge[.]com. When launched, ScreenConnect connected to threat actor’s instance at fa-histsedueg.screenconnect[.]com.

As mentioned previously, using ScreenConnect, the threat actor dropped the executable file uy5a7ykit5s7xs7isi9i.exe (MD5: 6bdba391a77bb67cb5aaae203d061ea8).

The executable is an NSIS installer that contains an NSI script and embedded AutoIt components and batch scripts.

The NSI script is responsible for executing the batch file named “Industries.cmd” (MD5: 3f8ca557d51e210952bdd7180cb33d10) (Figure 2).

The Industries.cmd batch file performs the following actions:

• cmd /c copy /b Password + Ranging + Real 95885\B
  • Creates a new binary file by combining the contents of files “Password”, “Ranging”, and “Real” within the NSIS installer into a single file named B (MD5: 4f3bb0cdfff1c15b75041d07c1b7aac9) within directory 95885.
  • “B” is the malicious AutoIt script containing the embedded AsyncRAT payload.
• copy /b 95885\Lay.pif + Entities + Amongst + Find + Niagara + Brass + Conferences + Fields + Wives + Analysts + Issue + Apps + Waiting + Married + Appearing + Socket + Signs + Beyond + Replies + Paris + Summary + Description 95885\Lay.pif
  • Concatenates multiple files into a single file named “Lay.pif” (MD5: b06e67f9767e5023892d9698703ad098) under the 95885 folder
  • Lay.pif is the renamed AutoIt executable used to execute the AutoIT script.
• start /I 95885\Lay.pif 95885\B
  • Executes the malicious AutoIT script using the rebuilt AutoIT executable.
• ping -n 5 127.0.0.1
  • Introduces a 5 second delay to ensure all previous commands completed.
• tasklist | findstr /I "wrsa.exe opssvc.exe" 1>NUL & if not errorlevel 1 ping -n 183 127.0.0.1
  • Introduces a 183-second delay if wrsa.exe (WebRoot Endpoint Protection service) or opssvc.exe (Quick Heal AntiVirus software) are running. This is likely done to evade detections by the aforementioned security software.

The script also checks for processes such as avastui.exe (Avast antivirus software), avgui.exe (AVG AntiVirus), nswscsvc.exe (Norton Security), and sophoshealth.exe (Sophos endpoint). If any of these processes are found, it executes a malicious AutoIt script using the original AutoIt executable. It's possible this step is taken to evade detection for renamed binaries by these AV agents.

The malicious AutoIt script is responsible for decrypting the embedded AsyncRAT payload via RC4 and subsequently injecting it into either RegAsm.exe or AppLaunch.exe if bdagent.exe (Bitdefender Agent) is detected as a running process. You can access the configuration for the AsyncRat payload on our GitHub page.

In conclusion, the June 2024 incidents analyzed by eSentire's Threat Response Unit illustrate how threat actors utilized the ScreenConnect client to establish unauthorized remote sessions. By deceiving users into downloading ScreenConnect via misleading websites, the attackers gained remote access and subsequently deployed the AsyncRAT trojan.

What did we find?

• Our team of 24/7 SOC Cyber Analysts isolated the affected host to contain the infection.
• We also provided remediation recommendations and support to the customer.

What can you learn from this TRU Positive?

• eSentire’s Threat Response Unit observed two incidents in June 2024 where users inadvertently downloaded the ScreenConnect client from deceptive websites, leading to unauthorized remote access and deployment of the AsyncRAT trojan.
• Threat actors leveraged ScreenConnect access to remotely drop and execute malicious scripts, facilitating the AsyncRAT infection, which is a remote access trojan capable of significant system control and data theft.
• The infection process detailed in the article includes techniques like delaying tactics to evade detection, and conditional script execution based on the presence of specific antivirus processes.
• The incidents underline the importance of caution when downloading software, especially from unverified or suspicious sources, to prevent malware infections.

Recommendations from our Threat Response Unit (TRU):

We recommend implementing the following controls to help secure your organization:

• Confirm that all devices are protected with Endpoint Detection and Response (EDR) solutions.
• Implement a Phishing and Security Awareness Training (PSAT) Program that educates and informs your employees on emerging threats in the threat landscape.
• Encourage your employees to use password managers instead of using the password storage feature provided by web browsers. Use master passwords where applicable.

Indicators of Compromise

You can access the Indicators of Compromise here.