Overview

overview

10

Static

static

3

fleet-agen...17.exe

windows10-2004-x64

10

fleet-agen...17.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/10/2026, 23:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    fleet-agent-0.10.17.exe
  • Size 6.7MB
  • Sample261007-3p7hjsxvft
  • SHA256 b6e63facef8c4b9a908846779dff36f65ffee2e014c10bf939614fbd8f770057
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoverypersistencespywaretrojan

Malware Config

Signatures

  • Enumerates VirtualBox DLL files 2 TTPs 2 IoCs
  • Looks for VirtualBox drivers on disk 2 TTPs 4 IoCs
    defense_evasion
  • Looks for VMWare drivers on disk 2 TTPs 4 IoCs
    defense_evasion
  • Executes dropped EXE 2 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Maps connected drives based on registry 3 TTPs 12 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in Program Files directory 1 IoCs
  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 24 IoCs
  • Modifies data under HKEY_USERS 40 IoCs
  • Modifies registry key 1 TTPs 6 IoCs
  • Modifies system certificate store 2 TTPs 1 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\fleet-agent-0.10.17.exe
    "C:\Users\Admin\AppData\Local\Temp\fleet-agent-0.10.17.exe"
    1⤵
    • Enumerates VirtualBox DLL files
    • Looks for VirtualBox drivers on disk
    • Looks for VMWare drivers on disk
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Drops file in Program Files directory
    • Modifies trusted root certificate store through registry
    • Reads the TCP/IP host and domain name from the registry
    • Enumerates system info in registry
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4712
    • C:\Windows\system32\icacls.exe
      icacls C:\ProgramData\FleetAgent /inheritance:r /grant:r *S-1-5-18:(OI)(CI)F /grant:r *S-1-5-32-544:(OI)(CI)F /grant:r *S-1-5-32-545:(OI)(CI)RX
      2⤵
      • Modifies file permissions
      PID:4908
    • C:\Windows\system32\schtasks.exe
      schtasks /Query /TN FleetAgentGuard
      2⤵
        PID:1992
      • C:\Windows\system32\schtasks.exe
        schtasks /Query /TN FleetAgentGuardLogon
        2⤵
          PID:1224
        • C:\Windows\system32\schtasks.exe
          schtasks /Query /TN FleetAgentGuardUser
          2⤵
            PID:3140
          • C:\Windows\system32\schtasks.exe
            schtasks /Query /TN FleetAgentGuard
            2⤵
              PID:5688
            • C:\Windows\system32\schtasks.exe
              schtasks /Query /TN FleetAgentGuardLogon
              2⤵
                PID:4340
              • C:\Windows\system32\schtasks.exe
                schtasks /Query /TN FleetAgentGuardUser
                2⤵
                  PID:4432
              • C:\Program Files\Fleet\fleet-agent.exe
                "C:\Program Files\Fleet\fleet-agent.exe" -server wss://light-manager.fly.dev/agent -token epEl-ZtuYKwo1RyV1kp27kgJ2PsAQWk5
                1⤵
                • Enumerates VirtualBox DLL files
                • Looks for VirtualBox drivers on disk
                • Looks for VMWare drivers on disk
                • Executes dropped EXE
                • Maps connected drives based on registry
                • Reads the TCP/IP host and domain name from the registry
                • Enumerates system info in registry
                • Modifies data under HKEY_USERS
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:5164
                • C:\Windows\system32\reg.exe
                  reg query HKLM\HARDWARE\DESCRIPTION\System\BIOS /v SystemManufacturer
                  2⤵
                  • Enumerates system info in registry
                  • Modifies registry key
                  PID:5824
                • C:\Windows\system32\reg.exe
                  reg query HKLM\HARDWARE\DESCRIPTION\System\BIOS /v SystemProductName
                  2⤵
                  • Enumerates system info in registry
                  • Modifies registry key
                  PID:3700
                • C:\Windows\system32\reg.exe
                  reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName
                  2⤵
                    PID:2120
                  • C:\Windows\system32\reg.exe
                    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v DisplayVersion
                    2⤵
                      PID:3408
                    • C:\Windows\system32\reg.exe
                      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuild
                      2⤵
                        PID:4656
                      • C:\Windows\system32\reg.exe
                        reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v UBR
                        2⤵
                          PID:4128
                        • C:\Windows\system32\reg.exe
                          reg query HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0 /v ProcessorNameString
                          2⤵
                          • Checks processor information in registry
                          • Modifies registry key
                          PID:4284
                        • C:\Windows\system32\reg.exe
                          reg query HKLM\HARDWARE\DESCRIPTION\System\BIOS /v SystemManufacturer
                          2⤵
                          • Enumerates system info in registry
                          • Modifies registry key
                          PID:2584
                        • C:\Windows\system32\reg.exe
                          reg query HKLM\HARDWARE\DESCRIPTION\System\BIOS /v SystemProductName
                          2⤵
                          • Enumerates system info in registry
                          • Modifies registry key
                          PID:5024
                        • C:\Windows\system32\reg.exe
                          reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName
                          2⤵
                            PID:2736
                          • C:\Windows\system32\reg.exe
                            reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v DisplayVersion
                            2⤵
                              PID:1252
                            • C:\Windows\system32\reg.exe
                              reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuild
                              2⤵
                                PID:3360
                              • C:\Windows\system32\reg.exe
                                reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v UBR
                                2⤵
                                  PID:5412
                                • C:\Windows\system32\reg.exe
                                  reg query HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0 /v ProcessorNameString
                                  2⤵
                                  • Checks processor information in registry
                                  • Modifies registry key
                                  PID:4180
                              • C:\Program Files\Fleet\fleet-agent.exe
                                "C:\Program Files\Fleet\fleet-agent.exe" -guard
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:692
                                • C:\Windows\system32\schtasks.exe
                                  schtasks /Query /TN FleetAgentGuard
                                  2⤵
                                    PID:872
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks /Query /TN FleetAgentGuardLogon
                                    2⤵
                                      PID:3220
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks /Query /TN FleetAgentGuardUser
                                      2⤵
                                        PID:2532

                                    Network

                                          MITRE ATT&CK Enterprise v16

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          fleet-agent.exe.new
                                          • Path C:\ProgramData\FleetAgent\fleet-agent.exe.new
                                          • Size 6.7MB
                                          • SHA256 b6e63facef8c4b9a908846779dff36f65ffee2e014c10bf939614fbd8f770057
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          agent.log
                                          • Path C:\ProgramData\fleet\agent.log
                                          • Size 550B
                                          • SHA256 42cc74406491e4e2bfeb99cf28a4f3d9766f48df58ec4705447c1a581a65a4ee
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          agent.log
                                          • Path C:\ProgramData\fleet\agent.log
                                          • Size 490B
                                          • SHA256 4d54e3779f332553214cf90da328cf3dc5e797a916ba6ccbb9504f62a721105a
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          id.txt
                                          • Path C:\ProgramData\fleet\id.txt
                                          • Size 33B
                                          • SHA256 fb81b0f1777ba58db262e31743076ca945fc1b29aab99684546b7a7c44245c56
                                          • MD5 SHA1 SHA512
                                          Submit Download