id-server connection . Post-Exploitation Analysis . During our research, we discovered a compromised host in Saudi Arabia that used ScreenConnect remote administration software. We then observed the threat actors interact with the compromised host using the ScreenConnect software, executing the following commands. Another instance of SharpChisel with different settings is executed, this time using PowerShell using the following command line: This time, traffic will be forwarded to the server over port 443. The use of the following command provides additional evidence to support our assumption: The command connects to the C&C server, downloads procdump64.exe, and saves the file in the C:\programdata directory. The following PowerShell command was used for this: The command downloads out1.exe and saves the file in the C:\users\public\ directory. This is unexpected since we believe this attack is connected to the MuddyWater threat actors — and in other connected campaigns, the attackers have shown higher levels of technical skill. sXpIBdPeKzI9PC2p0SWMpUSM2NSxWzPyXTMLlbXmYa0R20xk . This website uses cookies for website functionality, traffic analytics, personalization, social media functionality and advertising. OFF ON Keyboard Navigation (Motor) Use website with the keyboard This profile enables motor-impaired persons to operate the website using the keyboard Tab, Shift+Tab, and the Enter keys. 2) Keyboard navigation optimization: The background process also adjusts the website’s HTML and adds various behaviors using JavaScript code to make the website operable by the keyboard. If you wish to contact the website’s owner, please use the website's form . Hide Accessibility Interface