Analyzing SMOKE#SCREEN: ScreenConnect RMM Abuse, Cloudflare Tunnels, and Trusted Software Lures

Domains/URLs

blog.derrspecial-onlinedmin.live

Crestmarkhq.com

subscription-magnetic-recommended-meat.trycloudflare.com

dropbox.com/scl/fi/a0hp9g4w2ddkb3ggnkivx

IP Address

207.174.0.143

142.202.191.225

207.189.11.170

Hash

9161a8f7f07741db06b9f9a87b6ec7f277faf2ae3a3a661d6eb09cec4e12b920

35be1b070f06eb313c3cb818c74aa0a9c2d9f39a05621dac4de6cff6067a5d12

31260c37cc442719ac84540f4159dd9d4738575d2ab05e92c751a9b4b5f9b91b

371166ebd83e8318b49ba71321396524fbca7dc42fe1ca4badda8af794bf5a59

873011c181d00709fdf66f32bb3cca0c5ff3147d00ef818fef72987a6773ea66

433b61c29aefaa5b55fe78063e6ad8597d3835f36e1242d5402ab23e6dc61194

c8695906dcefc64becb3123fa0a8058278c8c2f9c86130956b6b10d49c1a35dc

8e87a734daddd95322b3f18f71eb9275219e244aac4f62b8dc6da6e2e91525e9

dd23012b4dc29cf7901185ae4fb2d507e737e9ea4d467846eafd6a86b26486bf

3cd9b7d583442963261f9985128042bf45d25482efcbf903c9248837cb0d744b

01e4cb3c60fa50b2927daa11f25a3c412549680406fc121a3d1870a9a33f5d38

60c730addd2a15e4213a1d37f55186686976de73a106317b5a258fe0121cfd5c

dc8b056dd6eb75df21e9721ac2e340f91bb5e94d5a6ff412d7d0c7539e0f06e2

aa84e2ac68f7fc18f4927b89be7b4a7739f2eaf099e489aa0f65c1d3913ce62a

5253e66f1f493c4e13539749f1aa86fd0c61e3072900fec29a44ba046a6d97e2

63c46b3c090a4b1efef146f2f1efc4f93d44f21db21d7825f43e02c3c5c89de6

9d9f3fa5aaf6bc91091873bd7ee04f0cc23e8709e4ad20c61d2779ff1a43c4b4

639430a33c0ecdf5a134501788a3a40f065ae4232efc66e1b82eca2b355e0606

2423decbfcf820f41bc356547e4e18e61d60c9829421d7121c374dcef88577f7

aefac65c42c0c72ed3e08b32774fa1b902f4fd1d53de189d50f38130cc357764

Detection Query 1 :

domainname like "Crestmarkhq.com" or url like "Crestmarkhq.com" or siteurl like "Crestmarkhq.com" or domainname like "subscription-magnetic-recommended-meat.trycloudflare.com" or url like "subscription-magnetic-recommended-meat.trycloudflare.com" or siteurl like "subscription-magnetic-recommended-meat.trycloudflare.com" or domainname like "blog.derrspecial-onlinedmin.live" or url like "blog.derrspecial-onlinedmin.live" or siteurl like "blog.derrspecial-onlinedmin.live" or domainname like "dropbox.com/scl/fi/a0hp9g4w2ddkb3ggnkivx" or siteurl like "dropbox.com/scl/fi/a0hp9g4w2ddkb3ggnkivx" or url like "dropbox.com/scl/fi/a0hp9g4w2ddkb3ggnkivx"

Detection Query 2 :

dstipaddress IN ("207.189.11.170","142.202.191.225","207.174.0.143") or srcipaddress IN ("207.189.11.170","142.202.191.225","207.174.0.143")

Detection Query 3 :

sha256hash IN ("371166ebd83e8318b49ba71321396524fbca7dc42fe1ca4badda8af794bf5a59","dc8b056dd6eb75df21e9721ac2e340f91bb5e94d5a6ff412d7d0c7539e0f06e2","dd23012b4dc29cf7901185ae4fb2d507e737e9ea4d467846eafd6a86b26486bf","35be1b070f06eb313c3cb818c74aa0a9c2d9f39a05621dac4de6cff6067a5d12","aa84e2ac68f7fc18f4927b89be7b4a7739f2eaf099e489aa0f65c1d3913ce62a","433b61c29aefaa5b55fe78063e6ad8597d3835f36e1242d5402ab23e6dc61194","9d9f3fa5aaf6bc91091873bd7ee04f0cc23e8709e4ad20c61d2779ff1a43c4b4","873011c181d00709fdf66f32bb3cca0c5ff3147d00ef818fef72987a6773ea66","5253e66f1f493c4e13539749f1aa86fd0c61e3072900fec29a44ba046a6d97e2","63c46b3c090a4b1efef146f2f1efc4f93d44f21db21d7825f43e02c3c5c89de6","60c730addd2a15e4213a1d37f55186686976de73a106317b5a258fe0121cfd5c","c8695906dcefc64becb3123fa0a8058278c8c2f9c86130956b6b10d49c1a35dc","3cd9b7d583442963261f9985128042bf45d25482efcbf903c9248837cb0d744b","9161a8f7f07741db06b9f9a87b6ec7f277faf2ae3a3a661d6eb09cec4e12b920","31260c37cc442719ac84540f4159dd9d4738575d2ab05e92c751a9b4b5f9b91b","8e87a734daddd95322b3f18f71eb9275219e244aac4f62b8dc6da6e2e91525e9","01e4cb3c60fa50b2927daa11f25a3c412549680406fc121a3d1870a9a33f5d38","639430a33c0ecdf5a134501788a3a40f065ae4232efc66e1b82eca2b355e0606","2423decbfcf820f41bc356547e4e18e61d60c9829421d7121c374dcef88577f7","aefac65c42c0c72ed3e08b32774fa1b902f4fd1d53de189d50f38130cc357764")