The parent process is where this becomes a detection rule. ScreenConnect's RunFile capability executed HideUL_x64.exe, Password.exe, Opencamera.exe and a wrapper that opened Phone Link through the ms-phone: handler, with ScreenConnect.WindowsClient.exe as the parent in every case [7]. Deception.Pro also recorded LSASS access from wmiprvse.exe 45 times and from ScreenConnect.ClientService.exe seven times, one of those with a full-rights handle [8]. An RMM service process holding a full-rights handle on LSASS is the highest-value line in the whole capture.
The tooling arrived in two visits. HideUL_x64.exe dropped its temp file at 22:29 on August 6 by the EDR clock, and Password.exe, Opencamera.exe and phonepcNew (1).exe all ran at 12:54 on August 8 [7]. That is a gap of 38 hours and 25 minutes [13], which is an operator who kept a foothold, went away, and came back to do collection in one burst. The roughly 75 MB of outbound traffic on the secondary relay at 185.241.149.220:8041 fits a sustained interactive session rather than a beacon [6].
The automated half is noisier and cheaper to spot. Spread across the full 54-hour window, 19,284 GET check-ins average one every 10 seconds [14], and because FormBook only started calling home after the operator deployed it, the live rate was faster than that. The GET-to-POST ratio is about 75 to 1 [15]: the 256-plus POSTs are the stolen form data, and the rest is check-in traffic diluted deliberately, since the 63-domain set mixes actor infrastructure with beacons to legitimate domains [11]. The form-grabber's target list ran through Fidelity, Chase, Bank of America, Schwab, Vanguard, PayPal and others, with staging and upload to Sendspace, which Suricata flagged as a Sendspace API upload [12].
On novelty, read the scope carefully. Deception.Pro says the co-occurrence of interactive ScreenConnect operator access and automated XLoader deployment in one coordinated intrusion is first-observed in its own collection [2], which is a statement about one telemetry set and not a claim about the wild. No actor or crew is named in the report. The environment was a deception workstation run by Trinity Cyber, so nothing here describes damage to a production estate [3].
Two of the network indicators were already covered: Suricata fired both on the bare-IP curl to a non-standard port and on the ET HUNTING rule for a silent ScreenConnect MSI install [5]. Rotating 172.245.23.152 and 185.241.149.220 costs the operator an afternoon [6], while the RunFile parent relationship [7] and the four-character URI with a spoofed Android 4.4.4 user-agent [10] survive re-tooling.
