flyagent | 94b4def0e023cc84e13852a6d360f4d5885c2d8bc502a8d380cb2ccdfdc739d7

Analysis

max time kernel
137s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20250502-en
resource tags

arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system
submitted
05/10/2025, 12:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
94b4def0e023cc84e13852a6d360f4d5885c2d8bc502a8d380cb2ccdfdc739d7.exe
Size 1.1MB
Sample251005-p7dfjafk2s
SHA256 94b4def0e023cc84e13852a6d360f4d5885c2d8bc502a8d380cb2ccdfdc739d7
MD5 ec6ba19b25ea656c79db91991786f279
SHA1 04c78769c74317a269f88986c26c6407c7eef83a
SHA512 871f8b75243719f589adee560aa5e687032942d7be746967ccb92db886bdd17c4bd9ae44d1eb35f4703a010d5e3f9333f7ad74c369df4360cf0c7fe4136f3b54
SSDEEP 24576:4qg8zeKPja85nd0T9RAN0P30mqym6hzsGoRlG4qqjwg1mRWRu3:44zeI/0XqymkulG4qmxmiu3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

backdoor discovery flyagent persistence

Malware Config

Signatures

Detects FlyAgent Backdoor 11 IoCs

resource	yara_rule
behavioral2/memory/864-0-0x0000000000400000-0x0000000000553000-memory.dmp	flyagent
behavioral2/memory/864-1-0x0000000000400000-0x0000000000553000-memory.dmp	flyagent
behavioral2/files/0x001000000002ad97-12.dat	flyagent
behavioral2/memory/4608-20-0x0000000000400000-0x0000000000553000-memory.dmp	flyagent
behavioral2/memory/864-22-0x0000000000400000-0x0000000000553000-memory.dmp	flyagent
behavioral2/memory/864-26-0x0000000000400000-0x0000000000553000-memory.dmp	flyagent
behavioral2/memory/864-29-0x0000000000400000-0x0000000000553000-memory.dmp	flyagent
behavioral2/memory/864-33-0x0000000000400000-0x0000000000553000-memory.dmp	flyagent
behavioral2/memory/864-36-0x0000000000400000-0x0000000000553000-memory.dmp	flyagent
behavioral2/memory/864-39-0x0000000000400000-0x0000000000553000-memory.dmp	flyagent
behavioral2/memory/864-42-0x0000000000400000-0x0000000000553000-memory.dmp	flyagent

FlyAgent
FlyAgent is a backdoor written in C++.
backdoor flyagent
Flyagent family
flyagent

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.lnk	94b4def0e023cc84e13852a6d360f4d5885c2d8bc502a8d380cb2ccdfdc739d7.exe

Executes dropped EXE 1 IoCs

pid	Process
4608	svchcst.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\360safo = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\svchcst.exe"	94b4def0e023cc84e13852a6d360f4d5885c2d8bc502a8d380cb2ccdfdc739d7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	94b4def0e023cc84e13852a6d360f4d5885c2d8bc502a8d380cb2ccdfdc739d7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330179853-1108322181-418488014-1000_Classes\Local Settings	94b4def0e023cc84e13852a6d360f4d5885c2d8bc502a8d380cb2ccdfdc739d7.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
864	94b4def0e023cc84e13852a6d360f4d5885c2d8bc502a8d380cb2ccdfdc739d7.exe
864	94b4def0e023cc84e13852a6d360f4d5885c2d8bc502a8d380cb2ccdfdc739d7.exe
864	94b4def0e023cc84e13852a6d360f4d5885c2d8bc502a8d380cb2ccdfdc739d7.exe
864	94b4def0e023cc84e13852a6d360f4d5885c2d8bc502a8d380cb2ccdfdc739d7.exe
864	94b4def0e023cc84e13852a6d360f4d5885c2d8bc502a8d380cb2ccdfdc739d7.exe
864	94b4def0e023cc84e13852a6d360f4d5885c2d8bc502a8d380cb2ccdfdc739d7.exe
864	94b4def0e023cc84e13852a6d360f4d5885c2d8bc502a8d380cb2ccdfdc739d7.exe
864	94b4def0e023cc84e13852a6d360f4d5885c2d8bc502a8d380cb2ccdfdc739d7.exe
864	94b4def0e023cc84e13852a6d360f4d5885c2d8bc502a8d380cb2ccdfdc739d7.exe
864	94b4def0e023cc84e13852a6d360f4d5885c2d8bc502a8d380cb2ccdfdc739d7.exe
864	94b4def0e023cc84e13852a6d360f4d5885c2d8bc502a8d380cb2ccdfdc739d7.exe
864	94b4def0e023cc84e13852a6d360f4d5885c2d8bc502a8d380cb2ccdfdc739d7.exe
864	94b4def0e023cc84e13852a6d360f4d5885c2d8bc502a8d380cb2ccdfdc739d7.exe
864	94b4def0e023cc84e13852a6d360f4d5885c2d8bc502a8d380cb2ccdfdc739d7.exe
864	94b4def0e023cc84e13852a6d360f4d5885c2d8bc502a8d380cb2ccdfdc739d7.exe
864	94b4def0e023cc84e13852a6d360f4d5885c2d8bc502a8d380cb2ccdfdc739d7.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
864	94b4def0e023cc84e13852a6d360f4d5885c2d8bc502a8d380cb2ccdfdc739d7.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
864	94b4def0e023cc84e13852a6d360f4d5885c2d8bc502a8d380cb2ccdfdc739d7.exe
864	94b4def0e023cc84e13852a6d360f4d5885c2d8bc502a8d380cb2ccdfdc739d7.exe
4608	svchcst.exe
4608	svchcst.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 864 wrote to memory of 1940	864	94b4def0e023cc84e13852a6d360f4d5885c2d8bc502a8d380cb2ccdfdc739d7.exe	78
PID 864 wrote to memory of 1940	864	94b4def0e023cc84e13852a6d360f4d5885c2d8bc502a8d380cb2ccdfdc739d7.exe	78
PID 864 wrote to memory of 1940	864	94b4def0e023cc84e13852a6d360f4d5885c2d8bc502a8d380cb2ccdfdc739d7.exe	78
PID 864 wrote to memory of 6088	864	94b4def0e023cc84e13852a6d360f4d5885c2d8bc502a8d380cb2ccdfdc739d7.exe	79
PID 864 wrote to memory of 6088	864	94b4def0e023cc84e13852a6d360f4d5885c2d8bc502a8d380cb2ccdfdc739d7.exe	79
PID 864 wrote to memory of 6088	864	94b4def0e023cc84e13852a6d360f4d5885c2d8bc502a8d380cb2ccdfdc739d7.exe	79
PID 5204 wrote to memory of 4608	5204	cmd.exe	82
PID 5204 wrote to memory of 4608	5204	cmd.exe	82
PID 5204 wrote to memory of 4608	5204	cmd.exe	82

C:\Users\Admin\AppData\Local\Temp\94b4def0e023cc84e13852a6d360f4d5885c2d8bc502a8d380cb2ccdfdc739d7.exe
"C:\Users\Admin\AppData\Local\Temp\94b4def0e023cc84e13852a6d360f4d5885c2d8bc502a8d380cb2ccdfdc739d7.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:864
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1940
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6088

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:5204
- C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Config.ini

Path C:\Users\Admin\AppData\Roaming\Microsoft\Config.ini
Size 92B
SHA256 8e59e3dc5427519534af0cfb2713d94388d03240f4f6d2c9ec6a13db1d9812ab
MD5 5611518085f0e601b7af262b73ca1e21
SHA1 679e284b4e15030b11e9fcab9e54090f6128c6c2
SHA512 0fc4c396d00386c7942366bab8bf30b59723f4a8b0d5bfe00dbc4a74df13acb68cd6616694a81de199bcd2409ff41b6dcaca931614165deefadd728350c52bcc
MD5 SHA1 SHA512

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 753B
SHA256 afd72bb079e749f95464593bbbd4cbd978e4109c88b973c0d1d306941d49cbbe
MD5 0a865b593e2baa0b8a312571f9a27142
SHA1 0e79950e757e9486521633e52d13c8e3f85d25b5
SHA512 003689c687c7903d793d19db3596b50a357829a1e612a04cf21b62349fb225bb4b9ffef3ff19e2ce49ebebc32c1f78c3f03573b98c24f9ad7699be840e88f1e7
MD5 SHA1 SHA512

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.1MB
SHA256 98d43392970de9d52bc73e1a8da5a5068363bd060668f265f049315451dceab1
MD5 320d24f3d0bd4c2205b640d2bf40dc6c
SHA1 0fec0e010dfcf954f18eeb9992fb16ffe401dde5
SHA512 faa3c62ee426cc37b29ffbaddab2f8c17a4340f524c5b1c9a9b5687aea64b8a394279d68d92b0ebd9cf658162bd2ce1b68e51f38055b9ac01fcc2f8132bd3a09
SSDEEP 24576:4qg8zeKPja85nd0T9RAN0P30mqym6hzsGoRlG4qqjwg1mRWRu4:44zeI/0XqymkulG4qmxmiu4
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/864-0-0x0000000000400000-0x0000000000553000-memory.dmp

Download

memory/864-22-0x0000000000400000-0x0000000000553000-memory.dmp

Download

memory/864-26-0x0000000000400000-0x0000000000553000-memory.dmp

Download

memory/864-29-0x0000000000400000-0x0000000000553000-memory.dmp

Download

memory/864-33-0x0000000000400000-0x0000000000553000-memory.dmp

Download

memory/864-1-0x0000000000400000-0x0000000000553000-memory.dmp

Download

memory/864-36-0x0000000000400000-0x0000000000553000-memory.dmp

Download

memory/864-39-0x0000000000400000-0x0000000000553000-memory.dmp

Download

memory/864-42-0x0000000000400000-0x0000000000553000-memory.dmp

Download

memory/4608-20-0x0000000000400000-0x0000000000553000-memory.dmp

Download