Analysis
- user interaction
yes - max time kernel
149s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
10/03/2026, 16:44
General
- Target Soft_ConnectAgent.dll.exe
- Size 34.5MB
- Sample260310-t835sshv3l
- SHA256 28cc12c092e331809e92dd20604ee1f646cbb96f8426f3944214605f590fe7df
Malware Config
Signatures
- ConnectWise ScreenConnect remote access tool
ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Executes dropped EXE 2 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Soft_ConnectAgent.dll.exe"C:\Users\Admin\AppData\Local\Temp\Soft_ConnectAgent.dll.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\SoftConnect\SoftConnectAgent.exe"C:\ProgramData\SoftConnect\SoftConnectAgent.exe"2⤵
- Adds Run key to start application
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\ProgramData\SoftConnect\SoftConnectAgent.exe"C:\ProgramData\SoftConnect\SoftConnectAgent.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
SoftConnectAgent.exe
agent.log
agent.log
agent.log
memory/4268-41-0x000001E8392A0000-0x000001E8392D0000-memory.dmp
memory/4268-12-0x000001E835AB0000-0x000001E835B40000-memory.dmp
memory/4268-0-0x000001E836830000-0x000001E8374C0000-memory.dmp
memory/4268-37-0x000001E839210000-0x000001E839230000-memory.dmp
memory/4268-33-0x000001E8391E0000-0x000001E839200000-memory.dmp
memory/4268-4-0x000001A79EF70000-0x000001A79EF90000-memory.dmp
memory/4268-8-0x000001A7A08D0000-0x000001A7A0900000-memory.dmp
memory/4268-16-0x000001A7A0A30000-0x000001A7A0A70000-memory.dmp
memory/4268-20-0x000001E835B40000-0x000001E835B90000-memory.dmp
memory/4268-28-0x000001A7A0A70000-0x000001A7A0A90000-memory.dmp
memory/4268-24-0x000001A7A0900000-0x000001A7A0920000-memory.dmp
memory/5780-132-0x0000021CFE0F0000-0x0000021CFE130000-memory.dmp
memory/5780-164-0x0000021CFE130000-0x0000021CFE140000-memory.dmp
memory/5780-114-0x0000021CFD5C0000-0x0000021CFD5E0000-memory.dmp
memory/5780-110-0x0000021CFDEE0000-0x0000021CFDFA0000-memory.dmp
memory/5780-128-0x0000021CFE330000-0x0000021CFE4E0000-memory.dmp
memory/5780-122-0x0000021CFE070000-0x0000021CFE0B0000-memory.dmp
memory/5780-148-0x0000021CFD6F0000-0x0000021CFD710000-memory.dmp
memory/5780-144-0x0000021CFEA60000-0x0000021CFEC60000-memory.dmp
memory/5780-140-0x0000021CFE6D0000-0x0000021CFE780000-memory.dmp
memory/5780-136-0x0000021CFE550000-0x0000021CFE5C0000-memory.dmp
memory/5780-152-0x0000021CFE5C0000-0x0000021CFE5F0000-memory.dmp
memory/5780-156-0x0000021CFE7D0000-0x0000021CFE820000-memory.dmp
memory/5780-160-0x0000021CFEFF0000-0x0000021CFF040000-memory.dmp
memory/5780-118-0x0000021CFD6A0000-0x0000021CFD6F0000-memory.dmp
memory/5780-169-0x0000021CFE5F0000-0x0000021CFE620000-memory.dmp
memory/5780-177-0x0000021D00230000-0x0000021D009D0000-memory.dmp
memory/5780-173-0x0000021CFF450000-0x0000021CFF710000-memory.dmp
memory/5780-182-0x0000021CFE140000-0x0000021CFE150000-memory.dmp
memory/5780-106-0x0000021CFDB60000-0x0000021CFDEE0000-memory.dmp
memory/5780-233-0x0000021CFF0C0000-0x0000021CFF150000-memory.dmp
memory/5780-244-0x0000021CFF7D0000-0x0000021CFF7F0000-memory.dmp
memory/5780-101-0x0000021CFD500000-0x0000021CFD520000-memory.dmp
memory/5780-240-0x0000021CFF150000-0x0000021CFF180000-memory.dmp
memory/5780-253-0x0000021CFF8C0000-0x0000021CFF8E0000-memory.dmp
memory/5780-249-0x0000021CFF890000-0x0000021CFF8C0000-memory.dmp
memory/5780-258-0x0000021CFF960000-0x0000021CFF980000-memory.dmp
memory/5780-262-0x0000021CFF830000-0x0000021CFF840000-memory.dmp