ad2593d3611bc077826cb32b3f06419b9e841552d32294f2b28a8d53df2a1e8c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/11/2026, 09:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Size 4.2MB
Sample261113-lmamcss12m
SHA256 ad2593d3611bc077826cb32b3f06419b9e841552d32294f2b28a8d53df2a1e8c
MD5 782bcf3fe3a59c7bcb10aeaab0c9013b
SHA1 fa52f67a5eea889f80bfa61101a9f6813f3fb9cd
SHA512 cb7dae056a6da26416419b7beb72cf11d9e54b8a3b2a0fa7d2be6b0ad60bbbcaf16c257c16384c1c1cd81ecad32eeff6244b99ef4aceb875b5d6b3479e714a6b
SSDEEP 49152:x/09O1vS7+Ck8D1oF6Zr0OEK2DbdqoiPJ4yUnwykR56phwg8aSnUIA2lnus:x/d78qNbiPJjUn7PGBaxO0s
TLSH
T10916CE50FCDB10B5E607593118AB62BF2734AD094F35CAC7E6447B6DED73AE1093222A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution ransomware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1456	powershell.exe
2824	powershell.exe
2008	powershell.exe
436	powershell.exe
3060	powershell.exe
3760	powershell.exe
2480	powershell.exe
3944	powershell.exe
1468	powershell.exe
2740	powershell.exe
856	powershell.exe
4776	powershell.exe

Executes dropped EXE 5 IoCs

pid	Process
4712	fleetdeck_agent_svc.exe
996	fleetdeck_agent_svc.exe
3520	fleetdeck_agent_svc.exe
4944	fleetdeck_agent_svc.exe
2552	fleetdeck_agent.exe

Loads dropped DLL 3 IoCs

pid	Process
2532	MsiExec.exe
2936	MsiExec.exe
2552	fleetdeck_agent.exe

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
25	3936	msiexec.exe
26	3936	msiexec.exe
28	3936	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe

Drops file in System32 directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe	msiexec.exe
File created	C:\Program Files (x86)\FleetDeck Agent\deployment.json	fleetdeck_agent_svc.exe
File created	C:\Program Files (x86)\FleetDeck Agent\20261021023420\fd_agent.dll	fleetdeck_agent_svc.exe
File created	C:\Program Files (x86)\FleetDeck Agent\20261021023420\fleetdeck_agent.exe	fleetdeck_agent_svc.exe
File created	C:\Program Files (x86)\FleetDeck Agent\20261021023420\fleetdeck_agent_svc.exe	fleetdeck_agent_svc.exe
File created	C:\Program Files (x86)\FleetDeck Agent\latest.json	fleetdeck_agent_svc.exe
File opened for modification	C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe	powershell.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e588eed.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{91D2B1CB-907C-4D2E-BA94-4205540E5C02}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9372.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA3CF.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{91D2B1CB-907C-4D2E-BA94-4205540E5C02}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Installer\{91D2B1CB-907C-4D2E-BA94-4205540E5C02}\fleetdeck.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\e588eed.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9323.tmp	msiexec.exe
File created	C:\Windows\Installer\e588ef1.msi	msiexec.exe
File created	C:\Windows\Installer\{91D2B1CB-907C-4D2E-BA94-4205540E5C02}\fleetdeck.ico	msiexec.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	fleetdeck_agent_svc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	fleetdeck_agent_svc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	fleetdeck_agent_svc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	fleetdeck_agent_svc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	fleetdeck_agent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	fleetdeck_agent.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fleetdeck_agent_svc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fleetdeck_agent_svc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fleetdeck_agent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fleetdeck_agent_svc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fleetdeck_agent_svc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000001302849f6a5860da0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800001302849f0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff0000000007000100006809001302849f000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a1302849f000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d1302849f000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe

Modifies registry class 23 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BC1B2D19C709E2D4AB49245045E0C520\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BC1B2D19C709E2D4AB49245045E0C520\SourceList\PackageName = "3225759232.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BC1B2D19C709E2D4AB49245045E0C520\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BC1B2D19C709E2D4AB49245045E0C520\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BC1B2D19C709E2D4AB49245045E0C520\ProductName = "FleetDeck Agent"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BC1B2D19C709E2D4AB49245045E0C520\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BC1B2D19C709E2D4AB49245045E0C520\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BC1B2D19C709E2D4AB49245045E0C520\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BC1B2D19C709E2D4AB49245045E0C520\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BC1B2D19C709E2D4AB49245045E0C520\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BC1B2D19C709E2D4AB49245045E0C520	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BC1B2D19C709E2D4AB49245045E0C520\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BC1B2D19C709E2D4AB49245045E0C520\ProductIcon = "C:\\Windows\\Installer\\{91D2B1CB-907C-4D2E-BA94-4205540E5C02}\\fleetdeck.ico"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BC1B2D19C709E2D4AB49245045E0C520\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\BC1B2D19C709E2D4AB49245045E0C520\MainApplication	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BC1B2D19C709E2D4AB49245045E0C520\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BC1B2D19C709E2D4AB49245045E0C520\Version = "16777216"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BC1B2D19C709E2D4AB49245045E0C520\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0FF76E871FB951743958FFF47DDBE8BC	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0FF76E871FB951743958FFF47DDBE8BC\BC1B2D19C709E2D4AB49245045E0C520	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BC1B2D19C709E2D4AB49245045E0C520\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BC1B2D19C709E2D4AB49245045E0C520	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\BC1B2D19C709E2D4AB49245045E0C520\PackageCode = "B16F86C0C2923DE428A798F83DF0E7A3"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
3936	msiexec.exe
3936	msiexec.exe
3936	msiexec.exe
4712	fleetdeck_agent_svc.exe
4712	fleetdeck_agent_svc.exe
856	powershell.exe
856	powershell.exe
856	powershell.exe
4712	fleetdeck_agent_svc.exe
4712	fleetdeck_agent_svc.exe
4776	powershell.exe
4776	powershell.exe
4776	powershell.exe
2480	powershell.exe
2480	powershell.exe
3944	powershell.exe
3944	powershell.exe
4944	fleetdeck_agent_svc.exe
4944	fleetdeck_agent_svc.exe
4944	fleetdeck_agent_svc.exe
4944	fleetdeck_agent_svc.exe
1456	powershell.exe
1456	powershell.exe
4944	fleetdeck_agent_svc.exe
4944	fleetdeck_agent_svc.exe
2008	powershell.exe
2008	powershell.exe
2008	powershell.exe
1468	powershell.exe
1468	powershell.exe
1468	powershell.exe
436	powershell.exe
436	powershell.exe
436	powershell.exe
2740	powershell.exe
2740	powershell.exe
2824	powershell.exe
2824	powershell.exe
3060	powershell.exe
3060	powershell.exe
3760	powershell.exe
3760	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4964	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeIncreaseQuotaPrivilege	4964	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeSecurityPrivilege	3936	msiexec.exe
Token: SeCreateTokenPrivilege	4964	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeAssignPrimaryTokenPrivilege	4964	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeLockMemoryPrivilege	4964	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeIncreaseQuotaPrivilege	4964	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeMachineAccountPrivilege	4964	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeTcbPrivilege	4964	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeSecurityPrivilege	4964	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeTakeOwnershipPrivilege	4964	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeLoadDriverPrivilege	4964	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeSystemProfilePrivilege	4964	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeSystemtimePrivilege	4964	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeProfSingleProcessPrivilege	4964	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeIncBasePriorityPrivilege	4964	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeCreatePagefilePrivilege	4964	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeCreatePermanentPrivilege	4964	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeBackupPrivilege	4964	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeRestorePrivilege	4964	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeShutdownPrivilege	4964	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeDebugPrivilege	4964	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeAuditPrivilege	4964	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeSystemEnvironmentPrivilege	4964	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeChangeNotifyPrivilege	4964	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeRemoteShutdownPrivilege	4964	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeUndockPrivilege	4964	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeSyncAgentPrivilege	4964	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeEnableDelegationPrivilege	4964	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeManageVolumePrivilege	4964	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeImpersonatePrivilege	4964	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeCreateGlobalPrivilege	4964	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
Token: SeBackupPrivilege	3124	vssvc.exe
Token: SeRestorePrivilege	3124	vssvc.exe
Token: SeAuditPrivilege	3124	vssvc.exe
Token: SeBackupPrivilege	3936	msiexec.exe
Token: SeRestorePrivilege	3936	msiexec.exe
Token: SeRestorePrivilege	3936	msiexec.exe
Token: SeTakeOwnershipPrivilege	3936	msiexec.exe
Token: SeRestorePrivilege	3936	msiexec.exe
Token: SeTakeOwnershipPrivilege	3936	msiexec.exe
Token: SeRestorePrivilege	3936	msiexec.exe
Token: SeTakeOwnershipPrivilege	3936	msiexec.exe
Token: SeDebugPrivilege	856	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	856	powershell.exe
Token: SeIncreaseQuotaPrivilege	856	powershell.exe
Token: SeSecurityPrivilege	856	powershell.exe
Token: SeTakeOwnershipPrivilege	856	powershell.exe
Token: SeLoadDriverPrivilege	856	powershell.exe
Token: SeBackupPrivilege	856	powershell.exe
Token: SeRestorePrivilege	856	powershell.exe
Token: SeShutdownPrivilege	856	powershell.exe
Token: SeSystemEnvironmentPrivilege	856	powershell.exe
Token: SeUndockPrivilege	856	powershell.exe
Token: SeManageVolumePrivilege	856	powershell.exe
Token: 31	856	powershell.exe
Token: SeDebugPrivilege	4776	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	4776	powershell.exe
Token: SeIncreaseQuotaPrivilege	4776	powershell.exe
Token: SeSecurityPrivilege	4776	powershell.exe
Token: SeTakeOwnershipPrivilege	4776	powershell.exe
Token: SeLoadDriverPrivilege	4776	powershell.exe
Token: SeBackupPrivilege	4776	powershell.exe
Token: SeRestorePrivilege	4776	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4964	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
4964	2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3936 wrote to memory of 4512	3936	msiexec.exe	95
PID 3936 wrote to memory of 2532	3936	msiexec.exe	98
PID 3936 wrote to memory of 4712	3936	msiexec.exe	99
PID 4712 wrote to memory of 856	4712	fleetdeck_agent_svc.exe	100
PID 4712 wrote to memory of 4776	4712	fleetdeck_agent_svc.exe	102
PID 3936 wrote to memory of 2936	3936	msiexec.exe	104
PID 996 wrote to memory of 2480	996	fleetdeck_agent_svc.exe	106
PID 3520 wrote to memory of 3944	3520	fleetdeck_agent_svc.exe	109
PID 4944 wrote to memory of 3776	4944	fleetdeck_agent_svc.exe	112
PID 4944 wrote to memory of 1456	4944	fleetdeck_agent_svc.exe	114
PID 4944 wrote to memory of 2552	4944	fleetdeck_agent_svc.exe	116
PID 2552 wrote to memory of 2008	2552	fleetdeck_agent.exe	118
PID 2552 wrote to memory of 1468	2552	fleetdeck_agent.exe	121
PID 2552 wrote to memory of 436	2552	fleetdeck_agent.exe	124
PID 2552 wrote to memory of 2740	2552	fleetdeck_agent.exe	126
PID 2552 wrote to memory of 2824	2552	fleetdeck_agent.exe	128
PID 2552 wrote to memory of 3060	2552	fleetdeck_agent.exe	130
PID 2552 wrote to memory of 3760	2552	fleetdeck_agent.exe	132

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-11_782bcf3fe3a59c7bcb10aeaab0c9013b_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4964

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4512
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F301117D95A3AB7B0A4AB4632DD7B2C7
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2532
- C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe
  "C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe" -deploymentID cc3e17ff-3f97-4875-b32f-602d68808e59 -askForName=0
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4712
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "New-NetFirewallRule -DisplayName 'FleetDeck Agent Service' -Name 'FleetDeck Agent Service' -Direction Inbound -Program 'C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe' -Action Allow"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:856
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "New-NetFirewallRule -DisplayName 'FleetDeck Agent Service' -Name 'FleetDeck Agent Service Command' -Direction Inbound -Program 'C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe' -Action Allow"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4776
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B3E65B5C6C27D304805D990114ABB248 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:2936

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3124

C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe
"C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:996
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " Restart-Service 'FleetDeck Agent Service' "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2480

C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe
"C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3520
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " $s=Get-Service 'FleetDeck Agent Service' if($s.Status -eq 'Running') { $s.Stop() if ($?) { $s.WaitForStatus('Stopped') } } while('True') { Move-Item -Force 'C:\Program Files (x86)\FleetDeck Agent\20261021023420\fleetdeck_agent_svc.exe' -Destination 'C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe' -ErrorVariable err if(!$err) { break } Start-Sleep -s 1 } $s.Start() "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3944

C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe
"C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\FleetDeck Agent Service" /VE /T REG_SZ /F /D Service
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3776
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -Command "Set-NetFirewallRule -Name 'FleetDeck Agent Service Command' -Program 'C:\Program Files (x86)\FleetDeck Agent\20261021023420\fleetdeck_agent.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1456
- C:\Program Files (x86)\FleetDeck Agent\20261021023420\fleetdeck_agent.exe
  "C:\Program Files (x86)\FleetDeck Agent\20261021023420\fleetdeck_agent.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " if(Get-NetRoute | ? DestinationPrefix -eq '0.0.0.0/0' | Get-NetIPInterface | Where ConnectionState -eq 'Connected') { return 1 } return 0 "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:2008
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " if(Get-NetRoute | ? DestinationPrefix -eq '0.0.0.0/0' | Get-NetIPInterface | Where ConnectionState -eq 'Connected') { return 1 } return 0 "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:1468
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " if(Get-NetRoute | ? DestinationPrefix -eq '0.0.0.0/0' | Get-NetIPInterface | Where ConnectionState -eq 'Connected') { return 1 } return 0 "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:436
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " if(Get-NetRoute | ? DestinationPrefix -eq '0.0.0.0/0' | Get-NetIPInterface | Where ConnectionState -eq 'Connected') { return 1 } return 0 "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:2740
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " if(Get-NetRoute | ? DestinationPrefix -eq '0.0.0.0/0' | Get-NetIPInterface | Where ConnectionState -eq 'Connected') { return 1 } return 0 "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:2824
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " if(Get-NetRoute | ? DestinationPrefix -eq '0.0.0.0/0' | Get-NetIPInterface | Where ConnectionState -eq 'Connected') { return 1 } return 0 "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:3060
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -Command " if(Get-NetRoute | ? DestinationPrefix -eq '0.0.0.0/0' | Get-NetIPInterface | Where ConnectionState -eq 'Connected') { return 1 } return 0 "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:3760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e588ef0.rbs

Path C:\Config.Msi\e588ef0.rbs
Size 219KB
SHA256 025dab2239f195af92c49b5cfe6c97ada4bfce04d31c568a62c39d1f536a982a
MD5 851ffdcb71b7591607909895e4c58ee9
SHA1 32a4727cbc8bbf613fd0aa0ea2c1c19298a0d4b6
SHA512 b11aea4f3cdd5d20ba2e59b7b3123eff7605881622ccd7ae1778a47aa4589cf563ab45f13e00e9f737975c3d068f08b04660bca7b4fcfa077ae21afef0979d1b
SSDEEP 3072:jJz/kyKA1X1dxbOZU32KndB4GLvyui2lhQtEaY4IDflQn0xHuudQ+cxEHSiZxad:jt/kE1jOZy2KL4GBiwQtEa4L2so
TLSH
T193249D216190947EE7FA0A36993EDA31AF7DF2340760C99EC3848C1E5D644C06BB7B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fd_agent.dll

Path C:\Program Files (x86)\FleetDeck Agent\20261021023420\fd_agent.dll
Size 1.8MB
SHA256 4ce08a6bf859b188ace0cf5aa61fd0e455d0baf34215369e561dc5fc6c315aac
MD5 c3adda737beb39bf3fe721c80eb68e79
SHA1 7159a7214267d43aeba4a836718a99b242d5da31
SHA512 0825bb629c3dc433db6172028c868a72de64b4e8df9570c779766b455376ba6b0c256c98304e57aea34253f349c9f168940c9319fc266293756ede69745201fc
SSDEEP 49152:eBXKkqGgYq8vNX7kb9hDqJCZIV/hWuVphsy:eBXysqeTCZI5hWuV
TLSH
T17A858E22FC41C035F9EA20BAC6FDABBE59AC8520037806D357D518B99E605D3773D29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fleetdeck_agent.exe

Path C:\Program Files (x86)\FleetDeck Agent\20261021023420\fleetdeck_agent.exe
Size 6.3MB
SHA256 08c5fc1cca98e77549f14d87abde0dda7a5d58076be6d88ceaaf26e3283b786d
MD5 57c20b15518c4498f31dddace020cbb1
SHA1 2fb038e48e33b04f6fb1309c1bc9a2f70d55a628
SHA512 cf20c8a4a3b1cd89cadc338d26aa2c6fbffb6988b15d73d00e9ab891c5af5c36cc80ef76fecf5db778383e3d737500958945731b176c24e473e8a667cfbdd3d2
SSDEEP 98304:Nl8YgLZng+nOMxdgiI+yy4UI6fXtkiv7PKT:sYgdgQxyh6koM
TLSH
T17E664A91F9DB40F5D903183044AB623F67306D0A8B35CFD7EA507F6AE9779E20A32619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fleetdeck_agent_svc.exe

Path C:\Program Files (x86)\FleetDeck Agent\20261021023420\fleetdeck_agent_svc.exe
Size 6.0MB
SHA256 ded6bd6efa372d340d9f8b827cff4a8f90ca069d86011bac7443dd9785f292bd
MD5 3715bf40e9519883fe72d1400c84d4a6
SHA1 537e0e150fe89ba5f5fe79efd19435fbaf45eacb
SHA512 f9f16def59a6f9a62535ac57ac1ea094fcc98b561b67786d2c49f3d35928c387219c7dea5c3c399a3ab6f15b026a7864e4a2797803ea11cd1cb1d7fd2f9ffb30
SSDEEP 49152:X5wTWNn0d9npqjS2R67Y8ZunlFTm5047PZeqEZ76y1B3QTXWm0cF8/OiBwaElxQW:X5wTWNupq+w67Y8ZQmBKYUWaMtTHZ
TLSH
T189562A90FDDB40F5EA07593044A7627F17306D0A4F24CBC7EA507F6AE877AE21A32619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

deployment.json

Path C:\Program Files (x86)\FleetDeck Agent\deployment.json
Size 69B
SHA256 903e85458bc000bce8682f8490d858da8013af1a7af057f29f8b948da8d7b71a
MD5 886f390b6668b9e955d2d24077152009
SHA1 fe508be60808382d9fd3a4e0af3d93f0285da50b
SHA512 2db0d5713c1d54666ef07317d0adfd54ce8c5b23bb1dc0c551c43432a01f12c4d0c70278001b8304e31b6e1cb92b30f3e9e20c74b2c243384ef9277ba00a4bab
TLSH
T11BA022000B80AE8302000AAC2CBE2AA8AF03820803000CA0C8200C33822CCCA0CA2333
MD5 SHA1 SHA512 TLSH

Submit Download

fleetdeck_agent_svc.exe

Path C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe
Size 6.0MB
SHA256 bd0285b480122f05ae85bae5edffa751095ddd216d05c04dafb204950b17c863
MD5 0468a819def38923bee96f1fead5710a
SHA1 230bdaf90995992f6a64ab39487446deb3fbd5a4
SHA512 0c84592a3040e67d94e8b69158b6f5373e0405db1008e96e64279affab85079df32994eb1f1918274720508854514ed6f26583ab82ce064794d9b708a1b181b7
SSDEEP 49152:o5wTWNn0d9npqjS2R67Y8ZunlFTm5047PZeqEZ76y1B3QTXWm0cF8/OiBwaElxQx:o5wTWNupq+w67Y8ZQmBKYUWaMtTHi
TLSH
T14C562A90FDDB40F5EA07593044A7627F17306D0A4F24CBC7EA507F6AE877AE21A32619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

latest.json

Path C:\Program Files (x86)\FleetDeck Agent\latest.json
Size 102B
SHA256 5660ebdc065d3a9fe7a4557daa71728a4b5b07980dd02e4b85812c2e2f7d9932
MD5 c0094d81a0987a052557ba8457358cc8
SHA1 e8a15b296be2bb76cd387543f129f6aef088dd86
SHA512 3a3fe7f7e8e08005a063cdd49a9894c92cb20f4dbbb7d7270cfbfeab248248d4c92c3e19b0d048ec1d828adfd638adfd79a0c6497b0802281b60ce67effc141a
TLSH
T16EB012F798147033CA74025014F412B05B042A890182A409F3C243C0DC0C7F3FD8346F
MD5 SHA1 SHA512 TLSH

Submit Download

3225759232.msi

Path C:\Users\Admin\AppData\Local\Temp\3225759232.msi
Size 2.3MB
SHA256 a70ce7c36d344cf5fdd62481c7fdc5067842923493d1d588422e4ac15314d218
MD5 80478c63395f3eb8e51d3b885c8e4405
SHA1 8a9b3621daaa82804a359729b72a1f18b7d8e91e
SHA512 63f0f047a6c2c9e42d83a3bd10134cb1e61e5502c0dd4572549502ef0dadcee897dc29e360e88529202475da4e5b3f163cf5e0851338c4d85d26c080353bdfd7
SSDEEP 49152:lF6Zr0OEK2DbdqoiPJ4yUnwykR56phwg8aSnUIA2:l8qNbiPJjUn7PGBaxO
TLSH
T1B7B52321B541403EDBBB0932E1BE8AB06E79FE340775C4698388B50E2D745D067B7BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI9372.tmp

Path C:\Windows\Installer\MSI9372.tmp
Size 211KB
SHA256 c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
MD5 a3ae5d86ecf38db9427359ea37a5f646
SHA1 eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
SHA512 96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
SSDEEP 3072:/Jz/kyKA1X1dxbOZU32KndB4GLvyui2lhQtEaY4IDflQn0xHuudQ+cxEHSiZxaQ:/t/kE1jOZy2KL4GBiwQtEa4L2sV
TLSH
T1ED249D316094943EE7FA0936997ED671AE3DF2341760C9AEC3848C0E6D644C16BB7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FleetDeck Agent Service.log

Path C:\Windows\TEMP\FleetDeck\FleetDeck Agent Service.log
Size 787B
SHA256 1276deda98d7886b47fe9d42ef93767820de326a911118d18684c0bb75306a7b
MD5 9d853bb7bb94015eeb4b8ff7424900f6
SHA1 bb56ae32aaf487ef5cb077c32f08ddef1b27f4c5
SHA512 d74940af2c032bb9b5eb80befddd99f4923abce88c958172dc0344e8cb71e5fa5e2b295f0ef1063650103259b718a796737ce80cb4fdb04cbeff6e876c9e21a3
TLSH
T1900145AB41C3A0BDAB2E028248DA1B639B150311B30DFC4DB3C4D2C869459EBD86909A
MD5 SHA1 SHA512 TLSH

Submit Download

FleetDeck Agent Service.log

Path C:\Windows\TEMP\FleetDeck\FleetDeck Agent Service.log
Size 1KB
SHA256 2fcc66e330b2b50f3e02fc8f40598d31961847bc585cabf05015d7237627aa2b
MD5 453bcbde0354f6b0d82d87db10227f35
SHA1 84acad13904482a2eee9a44e235a6e3948486b35
SHA512 3741996417a0f8ba47177b1906fb2bf36c9a8aac4ac11192465d031abbd129456f5a52b5b974ea3f82e70f2247b44a3cfe551c609fac12ab985ea3d93db6a7f9
TLSH
T1A821485741C391FEAB2E12415CDB1BA3A70A0721B34CFC4DB3D4E1C968459DBD8690D7
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_c2lcpr5b.izq.ps1

Path C:\Windows\Temp\__PSScriptPolicyTest_c2lcpr5b.izq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 3924113f27f3ad2ebe752cf27a50523b9f05382776f88ad4c6172df175bd25a3
MD5 53169e560f94b03247bdd6bd752445e1
SHA1 b6efc96de828a2bb21d659e3fcbc16a871ba5e71
SHA512 9d9250339f36c1584090cb58df895e81d8344c1133f659c416d4eb3e0f68214c5aafec75257e1643127cd69a94c854903f2719ba5b5bf83fd16ee3a261d8c334
TLSH
T18B81FE323375B0D4C9567F062A2819D063BF4386EA98AF4CB25C621EDD2640BDB122F3
MD5 SHA1 SHA512 TLSH

Submit Download