connectwise: b831f47e — Third confirmed sibling, C2 at 104.236.198.16:8041

Executive Summary

A third confirmed sibling in the ConnectWise ScreenConnect abuse cluster (b831f47e, Nov 2022). Near-identical to sibling 7145e8 (ssdeep similarity 99): same MSVC 14.33 build timestamp, same DotNetRunner native wrapper, same embedded MSI installer payload with identical ProductCode and version strings. The only material divergence is the hard-coded C2 relay IP — 104.236.198.16:8041 versus 134.122.4.2:8041 in the prior sibling. Static-only analysis (CAPE skipped — no Windows guest).

What It Is

• Format: PE32 executable (GUI) Intel 80386, 5 sections ^[file.txt]
• Size: 5,662,256 bytes
• Compile time: Fri Nov 18 20:10:20 2022 UTC ^[pefile.txt:34]
• Linker: MSVC 14.33 (Visual Studio 2019/2022) ^[exiftool.json:18] ^[rabin2-info.txt]
• PDB path: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetRunner.pdb ^[strings.txt:125] ^[rabin2-info.txt:13]
• Secondary PDB: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\DotNetResolver\obj\Debug\DotNetResolver.pdb ^[strings.txt:20429]
• Language: C/C++ native wrapper bootstrapping embedded .NET 2.0 assemblies via mscoree!CorBindToRuntimeEx ^[rabin2-info.txt:19] ^[pefile.txt:239]
• Signed: Valid Authenticode by ConnectWise, LLC (Tampa, Florida), DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 ^[rabin2-info.txt:29] ^[binwalk.txt:30-46]
• Security directory: IMAGE_DIRECTORY_ENTRY_SECURITY at file offset 0x54A600, size 0x1C030, WIN_CERT_TYPE_PKCS_SIGNED_DATA ^[pefile.txt:193]
• Subsystem: Windows GUI ^[rabin2-info.txt:34]
• Guard flags: /DYNAMICBASE, /NXCOMPAT, Terminal Server aware; no CFG ^[pefile.txt:73]
• No packing, no obfuscation, no anti-debug, no VM checks. Evasion is the signature itself.^[triage.json]

OpenCTI labels: connectwise, exe, urlhaus ^[triage.json:7-11].

How It Works

Stage 1 — Native C++ Bootstrap

entry0 (0x004014ad) is standard MSVC CRT __tmainCRTStartup: security-cookie init, __initterm dispatch, then a call to main. ^[rabin2-info.txt] ^[r2:entry0]

The thin wrapper:

1. Loads mscoree.dll via LoadLibraryW.
2. Resolves CorBindToRuntimeEx to spin up CLR 2.0 runtime. ^[pefile.txt:239]
3. Enumerates named .rsrc entries and loads the embedded assemblies reflectively.

No direct socket API imports (no WinINet, WinHTTP, WSAStartup). No Crypt32 imports. Certificate trust is handled by the MSI engine during installation, not by this wrapper.

Stage 2 — Embedded .NET Assemblies in .rsrc

The .rsrc section (~5.4 MB, entropy 7.45) contains five named resource entries (all LANG_NEUTRAL):

This is the full ScreenConnect client installer stack, identical in layout to sibling 7145e8. ^[raw/analyses/7145e829/report.md]

Stage 3 — Hardcoded C2 Configuration

The embedded app.config (offset 0x54D053, within the _RESOLVER resource region) contains the C2 endpoint:

?h=104.236.198.16&p=8041&k=BgIAAACkAABSU0ExAAgAAAEAAQDJIomMmrYgBCVgM5UalPDMiVC+Wsv2Z/d1n4CyYDzO0dYMkgYhFJWa+SSlGSgaVxYYS/rG9Dwatu118XXWYt+zdufqUCjy1ETBumWMDanDn7pI7UkOiaLn0sDaUgN+VlF35wu3aZTJC8OY6XnT/hRKs2YHy+C5o83CliMZ0ZvevcuqVTJL9Q48gsugsQmruWQ0O048CK0Gq4zKQINiqIa2xzl8a3gP6OgMj6tUykBiWI8eloClGJigIfvSasxzOAtCZIfgkUAwtv5NNPy3Rw5X2CAdhl7O+8DIXeilpGXkrvU0M6ZSSc6kpNx4q2hqRlx0fPT5NquEAxVswMKxfoy8
``` ^[strings.txt:20622] ^[strings.txt:21268]

Parameters:
- `h=104.236.198.16` — C2 relay host ^[strings.txt:20622]
- `p=8041` — listener port ^[strings.txt:20622]
- `k=` — base64-wrapped RSA public key / session key for ScreenConnect pairing ^[strings.txt:20622]

**Same infrastructure format as sibling `7145e8` (port and key blob structure identical) but IP changed from `134.122.4.2` to `104.236.198.16`.**

### Stage 4 — Windows Installer (MSI) Artifacts

The `_ENTRYPOINT` resource contains the MSI payload. Strings recovered from the binary include:

- `ProductCode {B292C5EA-BF5F-4280-B056-1670FB10BB1D}` ^[strings.txt:20276]
- `ProductVersion 25.2.4.9229` ^[strings.txt:20276]
- `Manufacturer ScreenConnect Software` ^[strings.txt:20276]
- `ScreenConnect.ClientService.dll` / `ScreenConnect.WindowsBackstageShell.exe` / `ScreenConnect.WindowsFileManager.exe` ^[strings.txt:20276]
- Service installation entries with `SafeBoot\Network\[SERVICE_NAME]` persistence ^[strings.txt:20276]
- `SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages[~][#ScreenConnect.WindowsAuthenticationPackage.dll]` ^[strings.txt:20276]
- `CLSID\[CREDENTIAL_PROVIDER_CLASS_ID]\InprocServer32[#ScreenConnect.WindowsCredentialProvider.dll]` ^[strings.txt:20276]

These MSI tables and registry keys are byte-for-byte identical to sibling `7145e8`.

## Decompiled Behavior

**`entry0`** (`0x004014ad`): Standard MSVC CRT `__tmainCRTStartup`. ^[r2:entry0]

**`main`** and beyond: Not statically recoverable — the native side is a thin loader; all threat logic lives in the embedded CIL assemblies. The decompilation shows no anti-debug branches, no VM checks, no sandbox gates. The binary trusts the MSI/UAC elevation model and the valid Authenticode signature for evasion.

## C2 Infrastructure

| Indicator | Value | Notes |
|---|---|---|
| **IP** | `104.236.198.16` | C2 host, hard-coded in `_RESOLVER` region ^[strings.txt:20622] |
| **Port** | `8041` | Listener port ^[strings.txt:20622] |
| **Key blob** | `BgIAAACkAABSU0ExAAgAA...` | RSA public key / session key ^[strings.txt:20622] |
| **Product** | `ScreenConnect` (v25.2.4.9229) | Version string in resources ^[strings.txt:20276] |
| **Certificate CN** | `ConnectWise, LLC` | Valid DigiCert-issued code-signing cert ^[rabin2-info.txt:29] |

Static-only; no observed DNS or secondary C2.

## Interesting Tidbits

- **Siblings differ only by C2 IP.** ssdeep similarity with `7145e8` is 99. Build timestamp, linker version, PDB path, embedded resource layout, ProductCode, and MSI tables are identical. This is the same builder output with a different C2 endpoint injected at build time. ^[ssdeep.txt] ^[raw/analyses/7145e829/report.md]
- **Same valid signer, different attacker infrastructure.** The binary carries a legitimate ConnectWise Authenticode signature (DigiCert chain). Either a stolen certificate or a compromised build artifact. The certificate subject is `ConnectWise, LLC`, Tampa, Florida. ^[rabin2-info.txt:29]
- **PDB leak confirms internal developer.** `jmorgan` at ConnectWise built this inside the `cwcontrol` repository under `Custom\DotNetRunner`. Both Release and Debug PDB paths are present. ^[strings.txt:125] ^[strings.txt:20429]
- **No obfuscation, no packer.** Strings, imports, PDB, C2 configuration, and MSI tables are all plaintext. Evasion relies entirely on the valid signature and the legitimate tool chain. ^[triage.json]
- **SafeBoot service persistence.** The MSI payload registers a service that survives Safe Mode (Network) via `System\CurrentControlSet\Control\SafeBoot\Network\[SERVICE_NAME]`. ^[strings.txt:20276]
- **LSA Authentication Package injection.** The MSI writes to `SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages`, inserting `ScreenConnect.WindowsAuthenticationPackage.dll` into LSASS. This is a credential-grabbing / logon-notification hook. ^[strings.txt:20276]
- **Windows Credential Provider registration.** Also registers a custom credential provider (`CLSID\[CREDENTIAL_PROVIDER_CLASS_ID]\InprocServer32` → `ScreenConnect.WindowsCredentialProvider.dll`), capable of harvesting logon credentials at the interactive login screen. ^[strings.txt:20276]
- **capa and floss failed.** capa signatures were missing from the environment (`ERROR: Using default signature path, but it doesn't exist`). ^[capa.txt] floss was invoked with a malformed argument string. ^[floss.txt] Neither tool produced usable output.

## How To Mess With It (Homelab Replication)

See sibling `7145e8` analysis for the full replication recipe. The delta to reproduce is the C2 endpoint swap:

1. Build the `DotNetRunner` wrapper as described in `7145e8`.
2. Before embedding the `app.config` into the `_RESOLVER` resource, edit the `<value>` node to point your own IP/port and RSA key.
3. Rebuild the PE. The resulting binary should have the same ssdeep similarity (~99) with the original, differing only in the C2 IP and key blob.

**Verification:** Run `ssdeep` against the original sibling. A similarity score >95 with a single contiguous diff region near the C2 offset confirms the builder is the same.

## Deployable Signatures

### YARA rule

```yara
rule connectwise_dotnetrunner_msi_bundle_b831f47e {
    meta:
        description = "ConnectWise DotNetRunner MSI installer bundle with embedded ScreenConnect (b831f47e variant)"
        author = "triage"
        date = "2026-07-09"
        sha256 = "b831f47ee0fedb819d1060a68fdfe4500d2a1a5f18f5e613fe8454c452626c48"
    strings:
        $pdb = "DotNetRunner.pdb" ascii wide
        $pdb2 = "DotNetResolver.pdb" ascii wide
        $core = "ScreenConnect.Core" wide
        $windows = "ScreenConnect.Windows" wide
        $installer = "ScreenConnect.WindowsInstaller" wide
        $product = "ScreenConnect Software" wide
        $version = "25.2.4.9229" wide
        $product_code = "{B292C5EA-BF5F-4280-B056-1670FB10BB1D}" wide
        $c2_ip_b831 = "104.236.198.16" ascii
        $c2_ip_7145 = "134.122.4.2" ascii
        $c2_port = "8041" ascii
        $safeboot = "SafeBoot\\Network\\" wide
        $lsa = "SYSTEM\\CurrentControlSet\\Control\\Lsa\\Authentication Packages" wide
        $credprov = "ScreenConnect.WindowsCredentialProvider.dll" wide
    condition:
        uint16(0) == 0x5A4D and
        ($pdb or $pdb2) and
        ($core or $windows or $installer) and
        ($c2_ip_b831 or $c2_ip_7145 or $product_code)
}

Sigma rule

title: ConnectWise ScreenConnect MSI installer bundle execution
status: experimental
description: Detects execution of the ConnectWise DotNetRunner MSI bundle embedding hardcoded C2.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - CommandLine|contains:
            - 'ScreenConnect.WindowsClient.exe'
            - 'ScreenConnect.ClientService.exe'
        - ParentImage|endswith:
            - 'ScreenConnect.ClientInstallerRunner.exe'
        - Image|endswith:
            - 'ScreenConnect.ClientInstallerRunner.exe'
    selection_registry:
        - TargetObject|contains:
            - 'ScreenConnect.WindowsAuthenticationPackage.dll'
            - 'ScreenConnect.WindowsCredentialProvider.dll'
        - EventType: SetValue
    condition: selection or selection_registry
falsepositives:
    - Legitimate ConnectWise ScreenConnect deployments within an enterprise.
level: medium

IOC list

Behavioral fingerprint

This binary is a native PE32 wrapper that loads mscoree.dll and initializes the CLR 2.0 runtime via CorBindToRuntimeEx. It extracts multiple large RCData resources named SCREENCONNECT.CORE, SCREENCONNECT.WINDOWS, and SCREENCONNECT.WINDOWSINSTALLER from its .rsrc section, then passes control to embedded CIL assemblies. The wrapper contains no direct network imports — all C2 configuration is read from an embedded XML app.config (inside the _RESOLVER resource region) that specifies an IP (104.236.198.16), port (8041), and RSA session key. Post-installation, the MSI payload registers a Windows service (SafeBoot network compatible), an LSA authentication package DLL, and a Windows credential provider DLL. The binary is signed with a valid DigiCert-issued Authenticode certificate in the name of ConnectWise, LLC.

Detection Signatures

References

• SHA-256: b831f47ee0fedb819d1060a68fdfe4500d2a1a5f18f5e613fe8454c452626c48
• Source: OpenCTI / abuse.ch urlhaus payloads
• Family entity page: connectwise
• Sibling analysis: raw/analyses/7145e829/report.md
• Concept page: legitimate-remote-access-tool-abuse
• Technique page: clickonce-certificate-trust-bootstrap (sibling 81adbf9a uses this; this sample predates it)

Provenance

• file.txt — file(1) output
• exiftool.json — ExifTool PE metadata
• pefile.txt — pefile library dump
• strings.txt — strings(1) extraction
• binwalk.txt — Binwalk embedded-artifact scan
• rabin2-info.txt — radare2 binary header summary
• triage.json — triage pipeline metadata
• capa.txt — capa execution failed (missing signatures)
• floss.txt — floss execution failed (malformed arguments)
• dynamic-analysis.md — CAPE status: skipped (no Windows guest available)
• radare2 decompilation of entry0 at 0x4014ad
• Manual DER certificate extraction from IMAGE_DIRECTORY_ENTRY_SECURITY at offset 0x54A600

Tools: ExifTool 12.76, pefile, radare2 5.x, binwalk, strings, openssl pkcs7