flyagent | 0c16a169a8ffcde43cd7bd59b157cb161795283d05be77135f8c4e44f79ac106

Analysis

max time kernel
149s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 21:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0c16a169a8ffcde43cd7bd59b157cb161795283d05be77135f8c4e44f79ac106.exe
Size 1.3MB
Sample260415-1frdvsc12v
SHA256 0c16a169a8ffcde43cd7bd59b157cb161795283d05be77135f8c4e44f79ac106
MD5 f1b813a5d43b5f3ae5407570adf74b0f
SHA1 0928687c7faea758ac33aef94c4a55eeb692e1c0
SHA512 28d73b33f575b899ed5750f7761b1bea5439a58b0579433c65b20c1a832e6a7a85cff2dc55d465a36d825e256bfe6358bbbf0af69ad8dda9de651b5a9590625a
SSDEEP 24576:WBS9qQEK6QywlBqH82QoXFkrzkmmlSgRDko0lG4Z8r7Qfd7iu5v:WZaClSFlG4ZM7QlVd
TLSH
T1AB557C13F692C0F1E61C227124FB6339BE7497450A71CACBE794DD791C32691ABA720E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery flyagent

Malware Config

Signatures

Family: FlyAgent
FlyAgent is a backdoor written in C++.
backdoor flyagent

Detects FlyAgent Backdoor 4 IoCs

resource	yara_rule
behavioral2/memory/2700-10-0x0000000000400000-0x0000000000551000-memory.dmp	flyagent
behavioral2/memory/2700-14-0x0000000000400000-0x0000000000551000-memory.dmp	flyagent
behavioral2/files/0x000600000000d3e8-16.dat	flyagent
behavioral2/files/0x002400000002b3a3-30.dat	flyagent

Deletes itself 1 IoCs

pid	Process
3944	svchcst.exe

Executes dropped EXE 3 IoCs

pid	Process
3944	svchcst.exe
2308	svchcst.exe
3460	svchcst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0c16a169a8ffcde43cd7bd59b157cb161795283d05be77135f8c4e44f79ac106.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings	0c16a169a8ffcde43cd7bd59b157cb161795283d05be77135f8c4e44f79ac106.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings	svchcst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2700	0c16a169a8ffcde43cd7bd59b157cb161795283d05be77135f8c4e44f79ac106.exe
2700	0c16a169a8ffcde43cd7bd59b157cb161795283d05be77135f8c4e44f79ac106.exe
2700	0c16a169a8ffcde43cd7bd59b157cb161795283d05be77135f8c4e44f79ac106.exe
2700	0c16a169a8ffcde43cd7bd59b157cb161795283d05be77135f8c4e44f79ac106.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe
3944	svchcst.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2700	0c16a169a8ffcde43cd7bd59b157cb161795283d05be77135f8c4e44f79ac106.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2700	0c16a169a8ffcde43cd7bd59b157cb161795283d05be77135f8c4e44f79ac106.exe
2700	0c16a169a8ffcde43cd7bd59b157cb161795283d05be77135f8c4e44f79ac106.exe
3944	svchcst.exe
3944	svchcst.exe
3460	svchcst.exe
3460	svchcst.exe
2308	svchcst.exe
2308	svchcst.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 1992	2700	0c16a169a8ffcde43cd7bd59b157cb161795283d05be77135f8c4e44f79ac106.exe	80
PID 2700 wrote to memory of 1644	2700	0c16a169a8ffcde43cd7bd59b157cb161795283d05be77135f8c4e44f79ac106.exe	81
PID 1644 wrote to memory of 3944	1644	WScript.exe	83
PID 3944 wrote to memory of 2256	3944	svchcst.exe	84
PID 3944 wrote to memory of 740	3944	svchcst.exe	85
PID 740 wrote to memory of 2308	740	WScript.exe	86
PID 2256 wrote to memory of 3460	2256	WScript.exe	87

C:\Users\Admin\AppData\Local\Temp\0c16a169a8ffcde43cd7bd59b157cb161795283d05be77135f8c4e44f79ac106.exe
"C:\Users\Admin\AppData\Local\Temp\0c16a169a8ffcde43cd7bd59b157cb161795283d05be77135f8c4e44f79ac106.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:1992
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1644
- - C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
    3⤵
    - Deletes itself
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3944
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2256
    - - C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3460
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:740
    - - C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Config.ini

Path C:\Users\Admin\AppData\Roaming\Microsoft\Config.ini
Size 92B
SHA256 44063c266686263f14cd2a83fee124fb3e61a9171a6aab69709464f49511011d
MD5 67b9b3e2ded7086f393ebbc36c5e7bca
SHA1 e6299d0450b9a92a18cc23b5704a2b475652c790
SHA512 826fbc9481f46b1ae3db828a665c55c349023caf563e6e8c17321f5f3af3e4c3914955db6f0eebfc6defe561315435d47310b4d0499ab9c2c85bb61264dedc09
MD5 SHA1 SHA512

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 696B
SHA256 bd9f06dbb8f2165c3b75da289ad7983f0c57328d236b2c68a2b5798188874fb3
MD5 9e8dca236ce949019c46b94428612ac9
SHA1 0917050afcbb7b94fce6fbb9827fb57de7432b0b
SHA512 23ce9deba9286cbb24c1725503542b63d7e44ea7ada302e5aba6595f84398e2162008d7431f842cccfb2b8fae126216d85c566931d5fcc8c8c5625e2c05f44d6
TLSH
T117019910DD4C8258503553B62432E44FF7EA1553A303ACE8B899D0A52FB07689CB4A37
MD5 SHA1 SHA512 TLSH

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 753B
SHA256 0973689503dbaa2774841fed4f9d0e3e9d2f17d4291032c55b8a85a257257173
MD5 f0d7142f12c62601e4cc77e377138dfc
SHA1 a2ecbd67a1f372129d4ce276e62b54af868f98c6
SHA512 fdc8906912aaa51a20aaa8d554592a3d321a58d9b55b0adecc7d5b5cb35960112d11c27053a16c9068f4dd3d02b4c71a19a4ab5bd35c71bc48b42327b9862298
TLSH
T15001C000DD8CC25D503547B62533A44EF7A91553A3039CD97859D5A12F7075C5CB4A37
MD5 SHA1 SHA512 TLSH

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.3MB
SHA256 4cf195be054383d18a7857833297a06396ec01bea3e5332adb23c50b64e912d4
MD5 39a9d57f6ed02207d31e165c943e3b4d
SHA1 c75b69752de8de6e863627bc5783c25d1e6beb89
SHA512 061317438de42b29c7020f7c8a83f0d094252455176cb5600bcc48e85e410958d31b538b4071744c1dd24efc2223edcc434d5c9b829c9812bf71ad6d8b1cc05e
SSDEEP 24576:WBS9qQEK6QywlBqH82QoXFkrzkmmlSgRDko0lG4Z8r7Qfd7iu58:WZaClSFlG4ZM7QlV6
TLSH
T18E557C13F692C0F1E61C227124FB6339BE7497450A71CACBE794DD791C32691ABA720E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.3MB
SHA256 0b71f4e5a1a951caccf4a999e4690f0689430c2ac3b273b5f8d64ec928783077
MD5 f87b4b34213162c745cc9b3a3fe4e615
SHA1 020f1097f4df7c25017e52460b4519054a72f3df
SHA512 e25cbe18b6734a7114211ebc636b465a545b7c5213aba4d899e43604ee8a56c3bda9c28bfe5ddfafe92e05e5ff5263aafcaa42f384b8ee55ebf2db6f6f2964ec
SSDEEP 24576:WBS9qQEK6QywlBqH82QoXFkrzkmmlSgRDko0lG4Z8r7Qfd7iu5r:WZaClSFlG4ZM7QlVp
TLSH
T129557C13F692C0F1E61C227124FB6339BE7497450A71CACBE794DD791C32691ABA720E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/740-37-0x0000000004510000-0x000000000452D000-memory.dmp

Download

memory/740-36-0x0000000004EB0000-0x0000000004F38000-memory.dmp

Download

memory/2256-33-0x00000000055F0000-0x0000000005678000-memory.dmp

Download

memory/2256-34-0x0000000005680000-0x000000000569D000-memory.dmp

Download

memory/2308-35-0x0000000000990000-0x00000000009DA000-memory.dmp

Download

memory/2700-15-0x0000000000C10000-0x0000000000C5A000-memory.dmp

Download

memory/2700-14-0x0000000000400000-0x0000000000551000-memory.dmp

Download

memory/2700-11-0x0000000000C10000-0x0000000000C5A000-memory.dmp

Download

memory/2700-10-0x0000000000400000-0x0000000000551000-memory.dmp

Download

memory/3460-38-0x00000000009A0000-0x00000000009EA000-memory.dmp

Download

memory/3944-29-0x00000000009C0000-0x0000000000A0A000-memory.dmp

Download

memory/3944-28-0x00000000009C0000-0x0000000000A0A000-memory.dmp

Download