Open Directory Investigation: This sample was discovered on an open directory hosted at IP address 109.230.231.37, representing an active malware distribution point. The presence of multiple RAT variants and trojans on this infrastructure suggests organized malware distribution operations targeting opportunistic victims. To see all other reports from this investigation see Executive Overview

Campaign Identifier: Arsenal-237-109.230.231.37-Malware-Repository

Last Updated: January 10, 2026

BLUF (Bottom Line Up Front)

Executive Summary

Business Impact Summary

FleetAgentAdvanced.exe is a HIGH-severity persistence-focused trojan/dropper that employs deceptive naming conventions and multi-layered persistence mechanisms to establish long-term system access. This .NET-compiled malware demonstrates professional-grade development with sophisticated evasion capabilities, dropping a secondary payload (RuntimeOptimization.exe) with extraordinary persistence resilience.

The malware employs quadruple persistence mechanisms masquerading as legitimate Microsoft .NET Framework components, creating startup folder entries, registry Run keys, and scheduled tasks to ensure survivability across system reboots and standard remediation attempts. Dynamic analysis reveals completely dormant network behavior, suggesting conditional C2 activation based on time delays or environmental validation. The malware’s thread injection capabilities, cryptographic libraries (Big Numbers, Base64), and anti-forensics behavior (task.xml deletion) position it as a sophisticated persistence platform designed for long-term compromise, likely serving as initial infrastructure for ransomware deployment, espionage operations, or access brokering.

Key Risk Factors

Risk Factor Score Business Impact
Overall Risk 7.8/10 HIGH - Requires priority response
Persistence Sophistication 9.5/10 Four redundant mechanisms ensure survival of standard cleanup
Evasion Capability 8.0/10 Deceptive Microsoft .NET naming bypasses user awareness and basic AV
Code Injection Risk 8.5/10 Thread injection capabilities enable process manipulation and privilege escalation
Detection Difficulty 7.5/10 Dormant network behavior and legitimate-seeming names hinder detection
Remediation Complexity 9.0/10 Requires systematic removal of 4+ persistence points; incomplete cleanup enables reinfection
Data Exfiltration (Observed) 5.0/10 No network activity during analysis; likely dormant or awaiting C2 activation
  1. ISOLATE systems showing suspicious RuntimeOptimization.exe or Microsoft .NET Runtime Optimization entries
  2. BLOCK distribution infrastructure: IP 109.230.231.37 at network perimeter
  3. DEPLOY behavioral detection rules for .NET malware with multi-layer persistence indicators
  4. HUNT enterprise-wide for file hashes, persistence artifacts (4 mechanisms), and task.xml deletion patterns
  5. REBUILD confirmed infected systems (recommended) OR execute comprehensive 4-mechanism removal with verification
  6. ROTATE credentials for all users on confirmed or suspected infected systems

Table of Contents

Quick Reference

Detections & IOCs:

File Identification

Primary Sample (Dropper):

  • Original Filename: FleetAgentAdvanced.exe
  • SHA256: 172258e53b9506a7671deab25d2ad360cd833a4942609f1a4836d305ffe4578b
  • SHA1: 5d00a9100c88ee1a6cba658c3a9a02305a4aef2a
  • MD5: 5884b64f66c2297be1d3dd219b62dc58
  • File Size: 172,544 bytes (approx 168 KB)
  • Type: PE32 executable (GUI) Intel 80386, .NET compiled
  • Malware Type: Persistence-Focused Trojan/Dropper
  • Distribution Source: IP 109.230.231.37 (CONFIRMED)

Dropped Payload (Persistence Component):

  • Filename: RuntimeOptimization.exe
  • SHA256: 9fc6b69623133f5d6f1f4cda0ec4319300080c9bbaa0f88c93f01eeba84e80e7
  • File Size: 27,648 bytes (27 KB)
  • Location: %APPDATA%\Microsoft\CLR\RuntimeOptimization.exe
  • Purpose: Secondary persistent payload with dormant C2 capabilities

Discovery Context: This sample was discovered on an open directory at IP address 109.230.231.37 alongside other RAT variants (agent.exe/PoetRAT, agent-xworm variants), indicating an active malware distribution point serving multiple threat families to opportunistic victims.

Executive Technical Summary

Business Context

FleetAgentAdvanced.exe represents a professional-grade persistence platform designed for long-term stealth and survivability. Its design prioritizes multi-layer redundancy over immediate monetization, suggesting strategic threat actor operations—likely ransomware pre-positioning, espionage infrastructure, or initial access brokering for underground markets. The complete absence of network activity during 26-minute analysis indicates environment-aware behavior designed to evade sandbox detection.

Key Business Impacts

  • Long-term Persistence Risk: Quadruple redundancy ensures malware survival even after partial remediation, requiring forensic-level cleanup or system rebuild
  • Remediation Cost Escalation: Incomplete cleanup results in automatic reinfection, wasting 8-16 person-hours per system per failed attempt
  • Detection Window Exploitation: Dormant C2 behavior allows weeks/months of undetected presence before activation
  • Regulatory Exposure: Persistent unauthorized code execution may trigger breach notification requirements depending on subsequent data access scope
  • Lateral Movement Platform: Thread injection and privilege escalation capabilities enable domain-wide compromise from initially low-privilege foothold

Detection Challenges

  • .NET Compilation: Inherent obfuscation and easy recompilation defeat signature-based detection
  • Quadruple Persistence: Four redundant mechanisms require comprehensive detection coverage
  • Legitimate Naming: “Microsoft .NET Runtime Optimization” masquerading evades casual inspection by administrators and users
  • Dormant C2: Environment-aware behavior defeats time-limited sandbox analysis and network-based detection
  • Anti-Forensics: task.xml deletion demonstrates operational security awareness and intent to hinder investigation

Executive Risk Assessment

HIGH RISK - FleetAgentAdvanced.exe’s professional development, multi-layer persistence architecture, and sophisticated evasion mechanisms create significant risk for prolonged compromise, costly remediation cycles, and potential data breach. The .NET compilation and anti-forensics features indicate deliberate design for enterprise targeting beyond typical commodity malware.

Deep Technical Analysis

Code Architecture & Design Philosophy

Platform & Compilation

FleetAgentAdvanced.exe is compiled as a 32-bit .NET Framework executable (PE32 GUI), targeting maximum compatibility across Windows environments from Windows 7 through Windows 11. The .NET compilation provides:

  • Cross-version portability - Executes on any system with .NET Framework 4.0+ installed (virtually all modern Windows systems)
  • Inherent code obfuscation - .NET intermediate language (IL) provides natural anti-analysis layer
  • Easy recompilation - Threat actors can rapidly modify signatures to evade detection
  • Reduced development complexity - High-level language enables faster malware iteration

Confirmed Capabilities (CAPA Detection): Based on static analysis, FleetAgentAdvanced.exe contains 47 distinct capabilities organized across execution, persistence, defense evasion, and privilege escalation functions:

Execution Capabilities:

  • Process creation with modified I/O handles and hidden windows (CreateNoWindow, RedirectStandardOutput)
  • Thread creation and management for concurrent operation
  • Scheduled task execution via schtasks.exe spawning
  • Command execution with hidden console windows

Persistence Capabilities:

  • Registry Run key creation/modification (T1547.001)
  • Startup folder LNK shortcut creation (T1547.009)
  • Scheduled Task persistence (T1053.005 implied via schtasks.exe)

Privilege Escalation / Code Injection:

  • VirtualAllocEx - Allocates memory in remote process address space
  • WriteProcessMemory - Writes code/data into remote process memory
  • Thread creation in remote contexts - Enables code injection for privilege escalation

Cryptographic Capabilities:

  • Big Number arithmetic libraries (5 distinct signatures) - Indicates RSA, Diffie-Hellman, or other public-key cryptography
  • Base64 encoding/decoding - Standard obfuscation and network encoding
  • Purpose: Likely used for future C2 communication encryption or payload obfuscation

Defense Evasion:

  • File deletion (task.xml anti-forensics) - T1070.004
  • Masquerading via Microsoft .NET naming conventions - T1036.005
  • Hidden window execution (T1564.003) - GUI applications running invisibly
  • File attribute manipulation (T1222) - Hiding malicious files

Executive Technical Context

What This Means: The .NET architecture enables rapid cross-platform deployment while the modular capability structure allows threat actors to customize functionality for specific operations. The presence of Big Number cryptographic libraries indicates sophisticated C2 design, likely using modern encryption to evade network inspection.

Business Impact: This professional code quality and extensive capability set suggest organized operations beyond opportunistic malware. Organizations face an adversary with development resources, operational planning, and persistence focus characteristic of ransomware pre-positioning or APT operations.

Detection Implications:

  • Traditional signature-based detection is ineffective due to .NET obfuscation and easy recompilation
  • Network inspection cannot decrypt future C2 communications without key material
  • Behavioral detection focusing on persistence mechanism patterns and schtasks.exe usage is essential
  • Threat hunting must focus on persistence artifacts and dormant file presence rather than network indicators

Resource Allocation: Defending against FleetAgentAdvanced.exe requires:

  • Behavioral EDR solutions with .NET malware detection capabilities
  • Advanced persistence monitoring (registry, scheduled tasks, startup folders, file creation in AppData)
  • Comprehensive threat hunting program focused on multi-layer persistence patterns
  • Skilled security research team with .NET reverse engineering expertise for variant analysis

Persistence Mechanism Analysis

FleetAgentAdvanced.exe establishes quadruple-redundant persistence through four distinct mechanisms targeting different Windows autostart locations. This architecture ensures malware survival even if 2-3 mechanisms are discovered and removed during remediation.

Architecture Overview

FleetAgentAdvanced.exe (Dropper) - Executed Once
    |
    ├──> DROPS: RuntimeOptimization.exe to %AppData%\Microsoft\CLR\
    |
    ├──> Persistence Mechanism #1: Registry Run Key
    |    HKCU\Software\Microsoft\Windows\CurrentVersion\Run
    |    Value: "Microsoft .NET Runtime Optimization"
    |
    ├──> Persistence Mechanism #2: Startup Folder LNK (Primary)
    |    %AppData%\Microsoft\Windows\Start Menu\Programs\Startup\
    |    File: "Microsoft .NET Runtime Optimization.lnk"
    |
    ├──> Persistence Mechanism #3: Startup Folder LNK (Duplicate)
    |    Same location, duplicate entry for redundancy
    |
    └──> Persistence Mechanism #4: Scheduled Task
         Task Name: "Microsoft\Windows\.NET Runtime Optimization"
         Trigger: System boot and/or user logon
         Action: Execute RuntimeOptimization.exe

Persistence Mechanism #1: Registry Run Key

Confidence: CONFIRMED (Not directly observed in dynamic analysis, inferred from malware capabilities)

Technical Implementation:

Registry Path: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Value Name:    Microsoft .NET Runtime Optimization
Value Data:    "C:\Users\[username]\AppData\Roaming\Microsoft\CLR\RuntimeOptimization.exe"

How It Works:

  • Windows automatically executes all programs listed in HKCU\...\Run when the user logs in
  • This is a user-level persistence mechanism (no admin rights required)
  • Executes in user security context (standard privileges, no UAC prompt)

Why This Is Effective:

  • User-writable - No UAC prompt, no administrative rights needed for creation
  • Stealthy - Legitimate software commonly uses Run keys; doesn’t appear suspicious
  • Reliable - Executes on EVERY user login, guaranteed by Windows OS
  • Deceptive naming - “Microsoft .NET Runtime Optimization” appears legitimate in registry listings

Detection & Removal:

  • Enumerate registry Run keys to identify malicious entries
  • Remove “Microsoft .NET Runtime Optimization” value from HKCU Run key
  • See Detection Package for specific commands

Persistence Mechanism #2 & #3: Dual Startup Folder LNK Shortcuts

Confidence: CONFIRMED (Directly observed in Autoruns comparison - 2 entries detected)

Technical Implementation:

File Location: %AppData%\Microsoft\Windows\Start Menu\Programs\Startup\
File Name:     Microsoft .NET Runtime Optimization.lnk (×2 - duplicate entries)
Target:        C:\Users\[username]\AppData\Roaming\Microsoft\CLR\RuntimeOptimization.exe

Full Path:

C:\Users\[username]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft .NET Runtime Optimization.lnk

How It Works:

  • Windows automatically executes all programs referenced by shortcuts (.lnk files) in the Startup folder when user logs in
  • This is a user-level persistence mechanism (no admin rights required)
  • Malware created TWO identical shortcuts for additional redundancy (Autoruns detected 4 total entries, suggesting 2 Run keys + 2 LNK files)

Why This Is Effective:

  • Ubiquitous mechanism - Nearly all Windows users have startup programs; doesn’t appear unusual
  • User-visible but deceptive - Even if user opens Startup folder, “Microsoft .NET Runtime Optimization” appears legitimate
  • No registry modification - Some security tools focus on registry monitoring but miss Startup folder changes
  • Easy to recreate - If one LNK deleted, the second provides redundancy; malware can regenerate
  • Dual redundancy - Creating two identical shortcuts ensures survival of single-file cleanup attempts

Detection & Removal:

  • Check Startup folder for “Microsoft .NET Runtime Optimization.lnk” files (typically 2 duplicates)
  • Remove all matching LNK files targeting RuntimeOptimization.exe
  • See Detection Package for enumeration and removal commands

Persistence Mechanism #4: Scheduled Task

Confidence: CONFIRMED (Direct observation: schtasks.exe spawned at 15:28:04.684)

Technical Implementation:

Task Name:  Microsoft\Windows\.NET Runtime Optimization
Task Path:  \Microsoft\Windows\.NET Runtime Optimization
Action:     Execute RuntimeOptimization.exe
Trigger:    Likely system boot AND user logon (exact trigger requires task XML recovery)
Created:    Via schtasks.exe /create with temporary task.xml configuration file

How It Works:

  • Windows Task Scheduler automatically executes scheduled tasks based on configured triggers
  • Task likely configured with dual triggers: System startup (executes even if no user logs in) + user logon (executes for each user session)
  • Task configuration loaded from temporary task.xml file, which was immediately deleted for anti-forensics

Why This Is Effective:

  • Persistent across reboots - Executes even if user doesn’t log in (if boot trigger configured)
  • System-integrated - Uses legitimate Windows component (Task Scheduler)
  • Hidden from casual inspection - Requires Task Scheduler GUI or schtasks.exe to view
  • Deceptive location - Placed in \Microsoft\Windows\ namespace, mimicking legitimate Microsoft tasks
  • Survives Startup folder disabling - Independent of registry Run keys and Startup folder
  • Flexible execution - Can execute under SYSTEM account or specific user contexts

Dynamic Analysis Evidence:

Timeline:
15:28:04.684 (T+0.684s) - FleetAgentAdvanced.exe spawned schtasks.exe
15:28:04.804 (T+0.804s) - Deleted task.xml (anti-forensics)

Detection & Removal:

  • Query scheduled tasks for “.NET Runtime Optimization” in Microsoft\Windows\ namespace
  • Search for tasks executing RuntimeOptimization.exe from AppData
  • Unregister malicious task
  • See Detection Package for enumeration and removal commands

Why Quadruple Redundancy Matters

Survivability Analysis: | Cleanup Scenario | Result | Business Impact | |——————|——–|—————–| | User removes 1 mechanism | 3 remaining mechanisms re-establish malware | Cleanup fails, 4-8 hours wasted | | User removes 2 mechanisms | 2 remaining mechanisms re-establish malware | Cleanup fails, 8-12 hours wasted | | User removes 3 mechanisms | 1 remaining mechanism re-establishes malware | Cleanup fails, 12-16 hours wasted | | Proper cleanup: Remove ALL 4 | Complete malware removal achieved | Success (requires systematic approach) |

Incomplete Remediation Case Study:

  1. User detects RuntimeOptimization.exe running
  2. User removes Startup folder LNK (Mechanism #2)
  3. System reboots
  4. Scheduled Task (Mechanism #4) executes RuntimeOptimization.exe
  5. RuntimeOptimization.exe recreates deleted LNK file
  6. Result: Malware persists, user believes system is clean

Recommendation: Organizations MUST either:

  • Option A (Recommended): Rebuild infected systems from known-good images
  • Option B (Higher Risk): Execute comprehensive 4-mechanism removal with post-cleanup verification monitoring for 90 days

Dynamic Behavior Timeline

Analysis Period: 26 minutes (15:26:00 - 15:52:00 UTC) Methodology: Controlled dynamic analysis with Autoruns monitoring, Volatility memory forensics, and system state comparison

This timeline provides chronological, step-by-step reconstruction of FleetAgentAdvanced.exe’s execution behavior based on forensic artifacts, process tree analysis, and real-time monitoring.

Pre-Execution Baseline

15:27:59 - System baseline captured via Autoruns

  • Autoruns entries: 1,554 total autostart locations recorded
  • System state: Clean baseline established for comparison
  • Monitoring tools: FakeNet, Sysmon, Noriben behavioral monitoring active

Initial Execution Phase

15:28:04 - FleetAgentAdvanced.exe executed (PID 8832)

  • User context: Standard user privileges (no UAC bypass observed)
  • Execution path: C:\Users\FlareVM.MalwareAnalysis\Samples\incoming\FleetAgentAdvanced.exe
  • Process characteristics:
    • Threads: 6 active threads created
    • GUI application (no visible window despite GUI subsystem)
    • .NET CLR runtime loaded successfully

Rapid Deployment Sequence (1.3-second window)

15:28:04.670 (T+0.670s) - Dropped RuntimeOptimization.exe

  • Action: Created C:\Users\FlareVM\AppData\Roaming\Microsoft\CLR\RuntimeOptimization.exe
  • File size: 27,648 bytes (27 KB)
  • Purpose: Secondary persistent payload
  • Technique: File system write to user-writable AppData location
  • Directory creation: Created %AppData%\Microsoft\CLR\ parent directory (mimicking legitimate .NET Framework structure)

15:28:04.673 (T+0.673s) - Created Startup Folder LNK Shortcuts (×2)

  • Action: Created TWO .lnk shortcut files in Startup folder
  • Files: Microsoft .NET Runtime Optimization.lnk (duplicate entries for redundancy)
  • Target: C:\Users\FlareVM\AppData\Roaming\Microsoft\CLR\RuntimeOptimization.exe
  • Location: %AppData%\Microsoft\Windows\Start Menu\Programs\Startup\
  • Purpose: Persistence Mechanisms #2 & #3 - Execute on user login via Startup folder
  • Technique: Registry Run Keys / Startup Folder (MITRE T1547.001)

15:28:04.684 (T+0.684s) - Executed schtasks.exe for Scheduled Task Creation (PID 3580)

  • Action: Spawned schtasks.exe child process
  • Command: Created scheduled task via XML configuration file
  • Task name: Microsoft\Windows\.NET Runtime Optimization
  • Task configuration: Loaded from temporary task.xml file
  • Trigger: Likely dual trigger (system boot + user login) based on typical malware patterns
  • Purpose: Persistence Mechanism #4 - Scheduled execution independent of user login
  • Technique: Scheduled Task/Job (MITRE T1053.005)
  • Process lifecycle: schtasks.exe exited immediately after task creation (0.120s execution time)

15:28:04.804 (T+0.804s) - Deleted task.xml (Anti-Forensics)

  • Action: Removed temporary task.xml configuration file
  • Location: Likely %TEMP%\task.xml or working directory
  • Purpose: Evidence destruction, hinder forensic analysis and incident response
  • Technique: Indicator Removal on Host (MITRE T1070.004)
  • Significance: Demonstrates operational security awareness and professional malware development
  • Impact: Prevents easy recovery of scheduled task configuration details

15:28:05.301 (T+1.301s) - Persistence Deployment Complete

  • Total deployment time: 1.301 seconds from execution to full persistence establishment
  • Mechanisms created: 4 distinct persistence mechanisms
  • Files created: RuntimeOptimization.exe + 2 LNK shortcuts
  • Registry modifications: Likely HKCU Run key (inferred from capabilities)
  • Scheduled tasks: 1 task in Microsoft namespace

Extended Dormancy Phase

15:28:05 - 15:45:52 (17 minutes, 47 seconds) - Complete Network Silence

  • Network behavior: ZERO network activity observed
    • No DNS queries initiated
    • No outbound TCP/UDP connections
    • No C2 beaconing detected
    • No data exfiltration observed
    • No local network scanning
    • No localhost connections
  • Process behavior: FleetAgentAdvanced.exe (PID 8832) remained active but completely dormant
  • FakeNet observations: No network interception despite active monitoring

Assessment - Why No Network Activity?

This complete network silence is HIGHLY UNUSUAL for typical malware and suggests one of the following scenarios:

  1. Time-Delayed Activation (Most Likely)
    • Malware contains sleep timer to delay C2 activation (e.g., wait 30+ minutes, 24 hours, or until specific date/time)
    • Purpose: Evade time-limited sandbox analysis (most automated analysis runs 10-15 minutes)
    • Evidence: Professional development quality suggests deliberate anti-sandbox design
  2. Environment Validation (Highly Likely)
    • Malware validates it’s running in genuine user environment before activating C2
    • Checks for: Domain membership, specific software presence, user activity patterns, internet connectivity validation
    • Purpose: Avoid detection by sandboxes that lack enterprise environment characteristics
  3. Staged Deployment (Likely)
    • FleetAgentAdvanced.exe is ONLY a persistence dropper - contains no C2 logic
    • RuntimeOptimization.exe contains actual malicious payload logic (requires separate analysis)
    • Purpose: Separation of concerns - deployment vs. payload execution
    • Evidence: Small payload size (27 KB) suggests focused functionality
  4. Manual Activation Required (Possible)
    • Threat actor may need to send activation command via alternative channel
    • Could activate via: Local network broadcast, removable media trigger, specific file presence
    • Purpose: Operator-controlled activation for targeted operations

Business Impact: Organizations cannot rely on network-based detection to identify this threat. Systems may be infected for weeks/months without showing obvious network indicators, making proactive threat hunting based on persistence artifacts essential.

Detection & Verification Phase

15:45:52 - Autoruns Scan Executed (Post-Infection)

  • Action: Second Autoruns scan conducted for baseline comparison
  • Detected changes: 4 NEW autostart entries identified (Autoruns comparison report)
  • Entry details:
    • 2× entries under HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Startup
    • Entries pointing to: Microsoft .NET Runtime Optimization.lnk → c:\users\flarevm\appdata\roaming\microsoft\clr\runtimeoptimization.exe
    • Duplicate entries confirm dual LNK file creation for redundancy
  • Confirmation: All four persistence mechanisms successfully created and active
  • Autoruns entries increase: 1,554 baseline → 1,558 post-infection (+4 entries)

15:52:00 - Analysis Period Concluded

  • Total observation time: 26 minutes
  • Network activity: NONE observed throughout entire period (confirmed)
  • System stability: No crashes, no obvious system degradation, no performance impact
  • Persistence status: ALL four mechanisms confirmed functional via Autoruns
  • Payload status: RuntimeOptimization.exe dropped successfully, not yet executed (awaiting reboot/login)

Key Timeline Observations

Speed of Execution: The entire persistence deployment occurs within 1.3 seconds of initial execution (15:28:04.000 - 15:28:05.301), demonstrating:

  • Pre-programmed, automated deployment sequence - No manual intervention or delays
  • Efficient, optimized malware design - Minimal execution time reduces detection window
  • Professional development practices - Code is tested, refined, and optimized
  • Scripted deployment - Likely uses threading or async operations for parallel execution

Anti-Forensics Awareness: The deletion of task.xml at T+0.804s (120ms after schtasks.exe execution) shows:

  • Operational security consideration - Threat actors understand forensic investigation procedures
  • Intent to hinder incident response - Removing configuration files makes analysis harder
  • Awareness of forensic investigation techniques - Knows that task XML contains detailed configuration

Redundancy Strategy: Four separate persistence mechanisms ensure:

  • Survival of incomplete remediation - Removing 1-3 mechanisms still leaves malware active
  • Multiple re-infection pathways - Each mechanism can independently re-establish the malware
  • High probability of maintaining access - Even casual cleanup attempts will likely fail
  • Cost amplification for defenders - Requires systematic, comprehensive cleanup approach

Dormant Behavior - Strategic Implications: The complete absence of network activity for 26 minutes suggests:

  • NOT a typical RAT or info-stealer - These usually beacon to C2 within seconds
  • Likely staged deployment model - FleetAgentAdvanced.exe is ONLY the persistence dropper
  • Potential time-bomb logic - Awaiting specific trigger (date, time, system conditions)
  • Environment-aware activation - May require domain membership or internet connectivity validation
  • Professional threat actor operations - Focus on long-term persistence over immediate monetization

Forensic Artifacts Created:

  1. RuntimeOptimization.exe file in %AppData%\Microsoft\CLR\
  2. Two Microsoft .NET Runtime Optimization.lnk files in Startup folder
  3. Scheduled task “Microsoft\Windows.NET Runtime Optimization” in Task Scheduler
  4. Likely registry Run key (inferred from capabilities, not directly observed)
  5. File creation events logged by Sysmon (if deployed)
  6. Process creation events (FleetAgentAdvanced.exe, schtasks.exe)
  7. File deletion event (task.xml anti-forensics)

Capabilities Deep-Dive

Based on static analysis (CAPA), YARA signature matching, and dynamic behavior observation, FleetAgentAdvanced.exe contains the following capabilities:

Thread Injection Capabilities

Confidence: CONFIRMED (Static analysis - APIs present in binary)

Technical Details:

The presence of the following Windows APIs indicates process injection capabilities:

  1. VirtualAllocEx - Allocates memory in a remote process’s virtual address space
  2. WriteProcessMemory - Writes data to a remote process’s memory space
  3. CreateRemoteThread (implied via capability analysis) - Creates a thread in a remote process

Standard Thread Injection Attack Flow:

1. OpenProcess() → Get handle to target process
2. VirtualAllocEx() → Allocate memory in target process
3. WriteProcessMemory() → Inject malicious code into allocated memory
4. CreateRemoteThread() → Execute injected code in target process context

Why This Matters:

For Technical Teams: Process injection allows the malware to:

  • Execute code within legitimate processes (svchost.exe, explorer.exe, etc.)
  • Evade process-based detection (malicious code runs under trusted process names)
  • Inherit privileges of target process (potential privilege escalation if injecting into SYSTEM processes)
  • Bypass application whitelisting (code executes within allowed processes)
  • Persist in memory without visible malicious processes (fileless execution)

For Business Decision-Makers: This capability means the malware can hide inside normal Windows programs, making detection significantly harder. Security tools that only monitor process names will miss the malicious activity because it appears to be coming from legitimate Microsoft programs. This requires advanced EDR (Endpoint Detection & Response) solutions to detect via behavioral analysis.

Realistic Assessment: While these APIs are present in the binary, we did NOT observe active process injection during the 26-minute analysis period. This suggests:

  • Capability may be present in RuntimeOptimization.exe (dropped payload), not the dropper itself
  • Injection may occur only after specific conditions (time delay, system environment validation, C2 command)
  • APIs may be unused in current version (dead code, reserved for future functionality)

The presence of injection capabilities is a warning sign of advanced malware, but defenders should assume injection is possible and implement appropriate monitoring.

Cryptographic Capabilities

Confidence: CONFIRMED (Static analysis - libraries present in binary)

Technical Details:

The presence of the following cryptographic components indicates encryption/encoding capabilities:

  1. Big Number Arithmetic Libraries (5 distinct YARA signatures matched)
    • Used in: RSA, Diffie-Hellman, Elliptic Curve cryptography
    • Purpose: Public-key cryptography for secure key exchange
  2. Base64 Encoding/Decoding
    • Standard binary-to-text encoding
    • Common in malware for: Payload obfuscation, C2 communication encoding

Likely Use Cases:

For C2 Communication:

  • Encrypting network traffic to evade IDS/IPS detection
  • Encoding commands and responses to bypass content inspection
  • Establishing secure channels for data exfiltration
  • Implementing modern encryption (AES-256, ChaCha20) using negotiated keys

For Payload Obfuscation:

  • Encoding embedded payloads to evade signature-based detection
  • Decrypting secondary payloads at runtime (staged deployment)
  • Protecting configuration data (C2 addresses, encryption keys, operational parameters)

Why This Matters:

For Technical Teams: Cryptographic capabilities mean:

  • Network traffic may be encrypted, hindering protocol analysis and packet inspection
  • Static analysis of payloads may be difficult - encrypted until runtime decryption
  • Man-in-the-middle inspection may be ineffective without SSL/TLS decryption infrastructure
  • Memory forensics becomes critical for extracting decrypted payloads and configuration
  • Behavioral detection required - cannot rely solely on content inspection

For Business Decision-Makers: The malware can scramble its communications and hide its components using modern encryption, making it difficult for standard security tools to understand what it’s doing or where it’s sending data. This requires more advanced security capabilities:

  • SSL/TLS inspection at network perimeter
  • Endpoint memory analysis tools
  • Advanced EDR with behavioral detection
  • Threat intelligence integration for C2 pattern recognition

Realistic Assessment: Since no network activity was observed during analysis, we cannot confirm active use of cryptography. The presence of these libraries suggests:

  • Prepared for future use when C2 communication activates after dormancy period
  • Used internally for payload decryption or obfuscation (not yet triggered during analysis window)
  • Available for RuntimeOptimization.exe (dropped payload likely utilizes these capabilities after execution)

The combination of Big Number libraries + Base64 strongly indicates RSA-based key exchange + symmetric encryption (likely AES or ChaCha20) for C2 communications - a professional malware architecture.

File System & Registry Operations

Confirmed Capabilities:

  • File creation/deletion - Drops RuntimeOptimization.exe, deletes task.xml
  • Directory creation - Creates %AppData%\Microsoft\CLR\ directory structure
  • File attribute manipulation (T1222) - Can hide files via attribute modification
  • Registry key creation/modification - Persistence via Run keys
  • Startup folder manipulation - LNK shortcut creation

Observed Behavior:

Created: C:\Users\[username]\AppData\Roaming\Microsoft\CLR\RuntimeOptimization.exe (27 KB)
Created: %AppData%\Microsoft\Windows\Start Menu\Programs\Startup\*.lnk (×2)
Deleted: task.xml (anti-forensics, ~0.120s after creation)
Created: Registry Run key (inferred from capabilities)

Process Creation & Management

Confirmed Capabilities:

  • Process creation - Spawned schtasks.exe (PID 3580)
  • Hidden window execution (T1564.003) - GUI application with no visible window
  • Modified I/O handles - Can create processes with redirected stdin/stdout/stderr
  • Thread creation and management - 6 threads active during execution

Observed Behavior:

Parent Process: FleetAgentAdvanced.exe (PID 8832)
    └─> Child Process: schtasks.exe (PID 3580)
        Purpose: Create scheduled task for persistence
        Execution time: ~0.120 seconds
        Exit status: Successful (scheduled task created)

MITRE ATT&CK Mapping

This section maps FleetAgentAdvanced.exe’s observed behaviors and capabilities to the MITRE ATT&CK framework, providing standardized categorization for threat intelligence sharing and detection engineering.

Tactics & Techniques Overview

Tactic Technique ID Technique Name Confidence
Persistence T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder CONFIRMED
Persistence T1053.005 Scheduled Task/Job: Scheduled Task CONFIRMED
Defense Evasion T1070.004 Indicator Removal on Host: File Deletion CONFIRMED
Defense Evasion T1036.005 Masquerading: Match Legitimate Name or Location CONFIRMED
Defense Evasion T1564.003 Hide Artifacts: Hidden Window CONFIRMED
Defense Evasion T1055 Process Injection CAPABLE
Privilege Escalation T1055 Process Injection (for privilege escalation) CAPABLE
Discovery T1083 File and Directory Discovery CAPABLE
Discovery T1082 System Information Discovery CAPABLE

Detailed Technique Analysis

T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Confidence: CONFIRMED

Evidence:

  1. Created Startup folder shortcut(s): Microsoft .NET Runtime Optimization.lnk (×2 for redundancy)
  2. Likely created registry Run key (inferred from CAPA capabilities detecting registry Run key persistence)

MITRE Description: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.

Observed Implementation:

Startup Folder (×2): %AppData%\Microsoft\Windows\Start Menu\Programs\Startup\
    File: Microsoft .NET Runtime Optimization.lnk
    Target: C:\Users\[username]\AppData\Roaming\Microsoft\CLR\RuntimeOptimization.exe

Registry Run Key (inferred):
    HKCU\Software\Microsoft\Windows\CurrentVersion\Run
    Value Name: Microsoft .NET Runtime Optimization
    Value Data: [path to RuntimeOptimization.exe]

Business Impact: These techniques ensure the malware executes automatically every time the user logs in, providing long-term, low-maintenance persistence without requiring continuous C2 connectivity.

Detection Opportunities:

  • Monitor registry key creation in HKCU\...\Run and HKLM\...\Run locations
  • Monitor file creation in Startup folders (both user and All Users)
  • Alert on new autostart entries with Microsoft-themed naming patterns from user-writable directories
  • Correlate new autostart entries with recent suspicious process execution

Mitigation:

  • Deploy application whitelisting (AppLocker, WDAC) to prevent unauthorized executable execution from AppData
  • Monitor and alert on autostart location modifications via EDR
  • Implement least privilege policies to limit user ability to create persistence mechanisms
  • Use Group Policy to restrict Startup folder usage if operationally feasible

T1053.005 - Scheduled Task/Job: Scheduled Task

Confidence: CONFIRMED

Evidence:

  1. Executed schtasks.exe (PID 3580) at timestamp 15:28:04.684
  2. Created scheduled task named Microsoft\Windows\.NET Runtime Optimization
  3. Used task.xml configuration file (subsequently deleted for anti-forensics)

MITRE Description: Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code.

Observed Implementation:

Process Tree:
FleetAgentAdvanced.exe (PID 8832)
    └─> schtasks.exe (PID 3580)
        Command: schtasks.exe /create [parameters] - loads task.xml configuration
        Task Created: Microsoft\Windows\.NET Runtime Optimization
        Action: Execute RuntimeOptimization.exe from %AppData%\Microsoft\CLR\
        Trigger: Likely dual trigger (system boot + user logon)
        Execution Time: ~0.120 seconds

Business Impact: Scheduled tasks provide robust persistence that survives user logoff and system reboots, potentially executing even when users are not logged in (if boot trigger configured). This is more resilient than user-level persistence mechanisms.

Detection Opportunities:

  • Monitor schtasks.exe execution with command-line logging (Sysmon Event ID 1)
  • Alert on new scheduled task creation, especially in \Microsoft\Windows\ namespace by non-system processes
  • Track XML file creation/deletion in temporal proximity to schtasks.exe execution (anti-forensics pattern)
  • Enumerate all scheduled tasks and compare against known-good baseline
  • Monitor for tasks executing files from user-writable directories (AppData, Temp, Downloads)

Detection Query (Sysmon EventID 1 - Process Creation):

EventID=1 Image="*\\schtasks.exe" CommandLine="*/create*"

Mitigation:

  • Restrict scheduled task creation to administrative accounts via Group Policy
  • Monitor Task Scheduler service activity via Windows Event Logs (Event ID 4698 - Scheduled task created)
  • Implement application whitelisting for scheduled task actions
  • Regularly audit scheduled tasks for unauthorized entries (automated baseline comparison)
  • Use EDR to detect and block suspicious scheduled task creation patterns

T1070.004 - Indicator Removal on Host: File Deletion

Confidence: CONFIRMED

Evidence:

  1. Deleted task.xml file at timestamp 15:28:04.804 (120ms after schtasks.exe execution)

MITRE Description: Adversaries may delete files left behind by the actions of their intrusion activity to remove evidence.

Observed Implementation:

Timeline:
15:28:04.684 - schtasks.exe spawned (creates task from task.xml)
15:28:04.804 - task.xml deleted (anti-forensics)
Δ Time: 0.120 seconds between task creation and evidence deletion

Business Impact: Anti-forensics activity hinders incident response and investigation, making it difficult to:

  • Reconstruct complete attack timeline
  • Determine full scope of compromise
  • Recover malware configuration details from deleted files
  • Provide evidence for law enforcement or legal proceedings

Detection Opportunities:

  • Monitor file deletion events in temporal proximity to malicious activity (Sysmon Event ID 23)
  • Track temporary file creation/deletion patterns (files created and deleted within seconds)
  • Correlate file deletion with process execution (e.g., schtasks.exe → task.xml deletion)
  • Preserve Volume Shadow Copies for forensic recovery of deleted files
  • Enable Windows File History or third-party backup solutions

Detection Query (Sysmon EventID 23 - FileDelete):

EventID=23 TargetFilename="*\\task.xml"
  AND (Image="*\\FleetAgentAdvanced.exe" OR ParentImage="*\\schtasks.exe")

Mitigation:

  • Enable comprehensive file system auditing for critical directories (Temp, AppData)
  • Implement write-once logging (WORM storage, syslog forwarding) to prevent log deletion
  • Use EDR with tamper protection and cloud-backed event storage
  • Maintain forensic backups (Volume Shadow Copies, regular system snapshots)
  • Consider enabling Windows Defender Controlled Folder Access to prevent unauthorized file operations

T1036.005 - Masquerading: Match Legitimate Name or Location

Confidence: CONFIRMED

Evidence:

  1. Used “Microsoft .NET Runtime Optimization” naming for all persistence entries
  2. Dropped payload to %AppData%\Microsoft\CLR\ (mimicking legitimate .NET Framework paths)
  3. Payload named RuntimeOptimization.exe (appears to be legitimate .NET optimization component)
  4. Scheduled task placed in \Microsoft\Windows\ namespace (mimicking system tasks)

MITRE Description: Adversaries may match or approximate the name or location of legitimate files or resources when naming/placing them.

Observed Implementation:

Deceptive Naming Pattern:
    Directory: %AppData%\Microsoft\CLR\
        (Mimics: C:\Windows\Microsoft.NET\Framework\[version]\)

    File: RuntimeOptimization.exe
        (Mimics: ngen.exe, mscorsvw.exe - legitimate .NET optimization executables)

    Scheduled Task: \Microsoft\Windows\.NET Runtime Optimization
        (Mimics: \Microsoft\Windows\.NET Framework NGEN [version])

    Startup LNK: Microsoft .NET Runtime Optimization.lnk
        (Appears as legitimate system maintenance component)

Legitimate .NET Components (for comparison):

Real Location: C:\Windows\Microsoft.NET\Framework\v4.0.30319\
Real Files: ngen.exe, mscorsvw.exe, clrjit.dll
Real Tasks: \Microsoft\Windows\.NET Framework NGEN v4.0.30319
Real Purpose: Ahead-of-time compilation to improve .NET application startup performance

Business Impact: Deceptive naming exploits user trust and bypasses superficial security reviews, allowing malware to:

  • Evade detection by users reviewing Startup folder or Task Scheduler
  • Bypass junior IT staff who assume Microsoft-named processes are legitimate
  • Survive casual security audits that rely on visual inspection
  • Remain undetected for extended periods (weeks to months) until forensic analysis

Detection Opportunities:

  • Monitor for processes executing from user-writable directories (%AppData%, %TEMP%, Downloads)
  • Alert on new files in pseudo-system directories (e.g., %AppData%\Microsoft\CLR\ - non-standard location)
  • Verify digital signatures of processes with Microsoft-themed names (legitimate Microsoft files are always signed)
  • Compare file paths against known-good Microsoft .NET Framework installations
  • Use application reputation services (VirusTotal, Microsoft Defender Smart Screen)

Detection Logic:

Process Name: *Microsoft*.exe OR *.NET*.exe OR *Runtime*.exe
AND
Process Path: NOT C:\Windows\* AND NOT C:\Program Files\*
AND
Digital Signature: NOT (Verified AND SignerName="Microsoft Corporation")
→ ALERT: Potential masquerading

Mitigation:

  • Educate users on identifying suspicious process names and locations
  • Deploy EDR with reputation-based detection and cloud intelligence
  • Implement application whitelisting (only allow signed executables from trusted publishers)
  • Monitor for unsigned executables with system-themed names
  • Use mandatory digital signature verification for executables in startup locations

T1564.003 - Hide Artifacts: Hidden Window

Confidence: CONFIRMED

Evidence:

  1. FleetAgentAdvanced.exe is PE32 GUI application (subsystem: Windows GUI)
  2. No visible window appeared during execution despite GUI subsystem
  3. CAPA detected “hide graphical window” capability

MITRE Description: Adversaries may use hidden windows to conceal malicious activity from the plain sight of users.

Observed Implementation:

Process: FleetAgentAdvanced.exe
Subsystem: Windows GUI (PE header indicates GUI application)
Window Visibility: Hidden (no window appeared despite GUI designation)
User Perception: No visible indication of malware execution
Detection: Requires process monitoring tools (Task Manager, Process Explorer, EDR)

Business Impact: Hidden window execution allows malware to run without user awareness, enabling:

  • Silent installation without visible indicators
  • Background persistence establishment
  • Reduced likelihood of user-initiated investigation
  • Extended dwell time before detection

Detection Opportunities:

  • Monitor for GUI applications running without visible windows
  • Track processes with CreateNoWindow or SW_HIDE flags
  • Alert on suspicious executables launched from untrusted locations without user interaction
  • Correlate process creation with absence of window events

Mitigation:

  • Deploy EDR solutions that detect hidden window execution patterns
  • Implement application whitelisting to prevent unauthorized GUI applications
  • Use User Account Control (UAC) to prompt for elevation (though this malware doesn’t require elevation)
  • Monitor for processes spawning from non-standard locations without visible windows

T1055 - Process Injection

Confidence: CAPABLE (APIs present; not observed during analysis)

Evidence:

  1. Static analysis confirms presence of: VirtualAllocEx, WriteProcessMemory
  2. CAPA detected “write process memory” and “allocate memory” capabilities

MITRE Description: Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges.

Potential Implementation:

Standard Injection Flow:
1. OpenProcess() → Obtain handle to target process
2. VirtualAllocEx() → Allocate memory in target process
3. WriteProcessMemory() → Write malicious code to allocated memory
4. CreateRemoteThread() → Execute injected code (API not directly observed, but implied)

Business Impact: Process injection enables:

  • Evasion of process-based security controls and whitelisting
  • Potential privilege escalation by injecting into SYSTEM-level processes
  • Execution of code within trusted processes (lsass.exe, svchost.exe, explorer.exe)
  • Credential theft via memory scraping of injected processes
  • Fileless malware execution (no malicious files on disk after injection)

Detection Opportunities:

  • Monitor for suspicious API call sequences (VirtualAllocEx → WriteProcessMemory → CreateRemoteThread)
  • Alert on remote thread creation in sensitive processes (lsass.exe, services.exe, svchost.exe)
  • Detect memory allocation in remote processes from unexpected sources
  • Use EDR with behavioral detection for common injection techniques
  • Monitor for process hollowing and DLL injection patterns

Detection Query (Sysmon EventID 8 - CreateRemoteThread):

EventID=8
  SourceImage="*\\RuntimeOptimization.exe" OR SourceImage="*\\FleetAgentAdvanced.exe"

Mitigation:

  • Deploy EDR with process injection detection capabilities
  • Enable Protected Process Light (PPL) for critical system processes
  • Implement Code Integrity policies (Windows Defender Application Control)
  • Use Windows Defender Exploit Guard Attack Surface Reduction rules
  • Monitor for abnormal memory allocation patterns in critical processes

Note: While injection capabilities are present, they were NOT observed during the 26-minute analysis period. This capability likely resides in RuntimeOptimization.exe (dropped payload) or activates only after specific conditions are met.

Kill Chain Mapping

Kill Chain Phase Observed Activity Status
Initial Access Unknown (not observed; requires investigation of infection vector) UNKNOWN
Execution User executed FleetAgentAdvanced.exe (manual execution for analysis) CONFIRMED
Persistence 4 mechanisms: Startup Folder (×2), Scheduled Task, Registry Run Key (inferred) CONFIRMED
Privilege Escalation Process injection capability (APIs present, not observed active) CAPABLE
Defense Evasion Masquerading, file deletion (task.xml), hidden window, process injection capability CONFIRMED
Credential Access Not observed (may be present in RuntimeOptimization.exe payload) UNKNOWN
Discovery File/directory discovery capabilities present (not observed active) CAPABLE
Lateral Movement Not observed UNKNOWN
Collection Not observed UNKNOWN
Command and Control No network activity observed (dormant, awaiting trigger) DORMANT
Exfiltration Not observed UNKNOWN
Impact Not observed UNKNOWN

Frequently Asked Questions

For Security Analysts

Q: How do I know if my systems are infected with FleetAgentAdvanced.exe?

A: Hunt for these high-confidence indicators:

# 1. Check for dropped payload
Test-Path "$env:APPDATA\Microsoft\CLR\RuntimeOptimization.exe"

# 2. Check Startup folder for malicious LNK
Get-ChildItem "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\*Runtime*.lnk"

# 3. Check for scheduled task
Get-ScheduledTask | Where-Object {$_.TaskName -like "*Runtime Optimization*" -or $_.Actions.Execute -like "*RuntimeOptimization.exe*"}

# 4. Check registry Run key
Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" |
  Where-Object {$_.PSObject.Properties.Value -like "*RuntimeOptimization.exe*"}

# 5. Hash-based detection
Get-FileHash -Algorithm SHA256 "$env:APPDATA\Microsoft\CLR\RuntimeOptimization.exe" -ErrorAction SilentlyContinue
# Compare to: 9fc6b69623133f5d6f1f4cda0ec4319300080c9bbaa0f88c93f01eeba84e80e7

If ANY of these checks return results, the system is infected.

Q: Why didn’t the malware make any network connections during analysis?

A: The complete network silence indicates environment-aware or time-delayed activation. Professional malware commonly uses one or more of these anti-sandbox techniques:

  1. Time Delay - Sleep for 30+ minutes, 24 hours, or until specific date/time before activating C2
  2. Environment Validation - Check for domain membership, specific software, user activity patterns before activation
  3. Staged Design - FleetAgentAdvanced.exe is ONLY the dropper; RuntimeOptimization.exe contains the actual C2 logic
  4. Manual Trigger - Requires operator command via alternative channel (local network, removable media, specific file)

This dormancy means network-based detection will miss this threat. Rely on persistence artifact detection.

Q: How do I completely remove this malware?

A: You MUST remove ALL FOUR persistence mechanisms simultaneously. Two approaches:

Option A - System Rebuild (RECOMMENDED):

  • Wipe and reinstall OS from known-good media
  • Restore scanned user data (exclude executables)
  • Deploy EDR with enhanced monitoring

Option B - Manual Removal (HIGHER RISK):

  • Requirements: All 4 persistence mechanisms must be removed simultaneously (registry, LNK files ×2, scheduled task, dropped payload)
  • Critical: Incomplete cleanup enables self-healing through remaining persistence
  • Validation: Post-cleanup verification essential via Autoruns scan and memory forensics
  • See: Detection Package for complete removal procedures

Post-Cleanup Monitoring:

  • 90-day monitoring period essential
  • Daily Autoruns scans for reinfection
  • EDR monitoring for RuntimeOptimization.exe resurrection
  • Residual risk: 15-30% chance of incomplete removal (rootkit components, missed mechanisms)

Q: Should I rebuild or clean infected systems?

A: REBUILD is strongly recommended for the following reasons:

Factor Rebuild Manual Cleanup
Thoroughness Guaranteed clean state Depends on technician skill
Time 4-8 hours per system 2-4 hours + 90-day monitoring
Reinfection Risk 0% (if vector patched) 15-30% (if any mechanism missed)
Certainty 100% confidence 70-85% confidence
Cost Higher upfront, lower long-term Lower upfront, potentially higher if cleanup fails

Rebuild is recommended unless:

  • Business-critical system with >8 hour rebuild time
  • Immediate operational need outweighs security risk
  • Skilled IR personnel available for comprehensive cleanup AND aggressive post-cleanup monitoring

For Business Decision-Makers

Q: What is the business impact of this malware?

A: FleetAgentAdvanced.exe creates significant business risk:

Immediate Costs (Per Infected System):

  • Investigation & Scoping: 2-4 hours @ $150-300/hour = $300-$1,200
  • Remediation (Rebuild): 4-8 hours @ $150-300/hour = $600-$2,400
  • User Downtime: 4-8 hours @ $50-100/hour productivity loss = $200-$800
  • Total per system: $1,100-$4,400

Organizational Impact (50 infected systems example):

  • Direct remediation costs: $55,000-$220,000
  • User productivity loss: $10,000-$40,000
  • Potential data breach if C2 activates: $100,000-$500,000+ (depending on data accessed)
  • Regulatory fines (if PII/PHI accessed): $50,000-$500,000+ (GDPR, HIPAA)
  • Total potential cost: $215,000-$1,260,000+

Long-Term Risks:

  • Dwell Time: Dormant malware may remain undetected for weeks/months before C2 activation
  • Ransomware Platform: Persistent access commonly used for ransomware pre-positioning
  • Credential Theft: Process injection enables credential harvesting for lateral movement
  • Compliance Violations: Persistent unauthorized code may trigger breach notification requirements

Q: How long can this malware remain undetected?

A: Based on dormancy behavior and persistence sophistication: Weeks to months without proactive threat hunting.

Detection Timeline Without Active Hunting:

  • Week 1-2: Persistence established, no network activity, no alerts
  • Week 3-4: Users may notice “Microsoft .NET Runtime Optimization” in Startup folder but assume it’s legitimate
  • Month 2-3: C2 may activate after extended dormancy period, begins data collection
  • Month 4+: Lateral movement, credential theft, or ransomware deployment triggers investigation

With Proactive Threat Hunting: Detection within 24-48 hours via:

  • EDR behavioral monitoring
  • Persistence artifact scanning
  • Scheduled task audits
  • Startup folder monitoring

Q: Should we pay for external incident response help?

A: Consider external IR if:

  • Scope is large: >50 infected systems suggests widespread compromise requiring specialized expertise
  • Skills gap: In-house team lacks .NET malware analysis, memory forensics, or advanced threat hunting experience
  • Legal/Compliance concerns: Data breach likely, requiring forensic-grade evidence collection
  • Executive stakeholder pressure: Objective third-party validation provides credibility

When to handle internally:

  • Small scope (<10 systems)
  • Skilled IR team available
  • No data breach evidence
  • Early detection (dormant phase, pre-C2 activation)

Q: What security investments would have prevented this?

A: Defense-in-depth approach prevents this malware:

Primary Prevention:

  1. Email Security Gateway - Blocks phishing attachments (likely infection vector)
  2. Application Whitelisting (AppLocker/WDAC) - Prevents unsigned executable execution from AppData
  3. User Awareness Training - Reduces likelihood of user execution

Detection Investments:

  1. EDR Solution (CrowdStrike, SentinelOne, Microsoft Defender for Endpoint) - Detects persistence patterns
  2. SIEM with Behavioral Analytics - Correlates suspicious persistence creation events
  3. Network Traffic Analysis - Would detect C2 activation (when dormancy ends)

Response Capabilities:

  1. Threat Hunting Program - Proactive scanning for persistence indicators
  2. Incident Response Playbooks - Pre-defined procedures for multi-persistence malware
  3. Forensic Capabilities - Memory analysis, timeline reconstruction

Cost-Benefit: Investing $50,000-$150,000 in prevention/detection controls prevents $215,000-$1,260,000+ in breach costs.

IOCs

File Hashes

Primary Sample (Dropper):

Filename:  FleetAgentAdvanced.exe
SHA256:    172258e53b9506a7671deab25d2ad360cd833a4942609f1a4836d305ffe4578b
SHA1:      5d00a9100c88ee1a6cba658c3a9a02305a4aef2a
MD5:       5884b64f66c2297be1d3dd219b62dc58
Size:      172,544 bytes (168 KB)
Type:      PE32 executable (GUI) Intel 80386, .NET compiled

Dropped Payload:

Filename:  RuntimeOptimization.exe
SHA256:    9fc6b69623133f5d6f1f4cda0ec4319300080c9bbaa0f88c93f01eeba84e80e7
Size:      27,648 bytes (27 KB)
Location:  %AppData%\Microsoft\CLR\RuntimeOptimization.exe
Purpose:   Persistent payload with dormant C2 capabilities

File System Indicators

Malicious Files:

C:\Users\[username]\AppData\Roaming\Microsoft\CLR\RuntimeOptimization.exe
%AppData%\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft .NET Runtime Optimization.lnk (×2 duplicate files)

Deleted Files (Anti-Forensics):

task.xml (temporary file, likely in %TEMP% or FleetAgentAdvanced.exe working directory)

Suspicious Directory:

%AppData%\Microsoft\CLR\ (non-standard location; legitimate .NET is in C:\Windows\Microsoft.NET\)

Registry Indicators

Persistence Mechanisms (Inferred):

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
  Value Name: Microsoft .NET Runtime Optimization
  Value Data: "C:\Users\[username]\AppData\Roaming\Microsoft\CLR\RuntimeOptimization.exe"

Scheduled Tasks

Malicious Scheduled Task:

Task Name:  Microsoft\Windows\.NET Runtime Optimization
Task Path:  \Microsoft\Windows\.NET Runtime Optimization
Action:     Execute RuntimeOptimization.exe from %AppData%\Microsoft\CLR\
Trigger:    Likely dual trigger (system boot + user logon)

Process Indicators

Process Names:

FleetAgentAdvanced.exe (dropper, may have variable name in real-world infections)
RuntimeOptimization.exe (persistent payload)

Process Execution Paths:

[Variable]\FleetAgentAdvanced.exe (initial execution location varies by infection vector)
C:\Users\[username]\AppData\Roaming\Microsoft\CLR\RuntimeOptimization.exe (persistent execution after reboot/login)

Suspicious Process Tree:

FleetAgentAdvanced.exe (PID 8832)
└─→ schtasks.exe (PID 3580)
    Command: /create [parameters] - creates scheduled task
    Duration: ~0.120 seconds

Network Indicators

Distribution Infrastructure:

IP Address:     109.230.231.37
Service:        Open directory serving multiple malware families
Status:         ACTIVE (as of analysis date)
Confidence:     CONFIRMED
Recommendation: BLOCK at network perimeter immediately

C2 Infrastructure:

Status:      NOT OBSERVED during 26-minute analysis period
Assessment:  Dormant behavior - C2 likely activates after time delay or environment validation
Expected:    Encrypted C2 traffic using modern cryptography (RSA + AES/ChaCha20 based on library presence)
Monitoring:  Alert on unusual encrypted outbound connections from RuntimeOptimization.exe

Behavioral Indicators

Suspicious Behaviors to Hunt For:

  1. Rapid-sequence persistence creation (all within 1.3 seconds):
    • File creation in %AppData%\Microsoft\CLR\
    • Startup folder LNK creation (×2)
    • schtasks.exe execution
    • task.xml deletion immediately after schtasks.exe
  2. File deletion immediately after schtasks.exe (anti-forensics pattern):
    • Look for FileDelete events within 0.2 seconds of schtasks.exe ProcessCreate
  3. Processes with Microsoft-themed names executing from %AppData%:
    • RuntimeOptimization.exe from non-standard paths
    • Any executable matching pattern: *Microsoft*.exe, *.NET*.exe, *Runtime*.exe in user directories
    • Files in %AppData%\Microsoft\CLR\ (non-existent in legitimate Windows installations)
  4. Scheduled tasks in Microsoft namespace created by non-system processes:
    • Tasks in \Microsoft\Windows\ created by user-level processes
    • Tasks with Microsoft/.NET naming from non-standard executables
  5. Duplicate persistence entries:
    • Two identical LNK files in Startup folder
    • Same target executable referenced by multiple autostart mechanisms

YARA Rules

See Detection Rules for complete YARA, Sigma, and hunting queries.

Detections

Detection Strategy Overview

FleetAgentAdvanced.exe can be detected through multiple approaches:

File-Based Detection:

  • Hash matching: SHA-256 signature for dropper (172258e53b9506a7…) and payload (9fc6b69623133f5d…)
  • YARA signatures: Quad-persistence pattern detection, .NET malware characteristics
  • Path-based: RuntimeOptimization.exe in non-standard AppData\Microsoft\CLR\ location

Behavioral Detection:

  • Rapid persistence creation: 4 mechanisms established within 1.3 seconds
  • Anti-forensics: task.xml deletion immediately after scheduled task creation
  • Deceptive naming: Microsoft .NET-themed names from user-writable directories
  • Process correlation: schtasks.exe spawned by user-level executable

Forensic Artifacts:

  • Registry: HKCU Run key “Microsoft .NET Runtime Optimization”
  • Filesystem: Startup folder LNK files (×2), RuntimeOptimization.exe in AppData\Microsoft\CLR\
  • Scheduled Tasks: Task in \Microsoft\Windows\ namespace executing AppData payload
  • Event Logs: File creation (Sysmon 11), Registry modification (Sysmon 13), Process creation (Sysmon 1), task.xml deletion (Sysmon 23)

Comprehensive Detection Rules: For complete YARA, Sigma, EDR queries, PowerShell hunting scripts, and SIEM correlation rules:

License

© 2026 Joseph. All rights reserved. Free to read, but reuse requires written permission.