flyagent | a0105b63cc3c3fb9d9801ebe43266da92afb66ebac554925c77c30166f8254de

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 10:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a0105b63cc3c3fb9d9801ebe43266da92afb66ebac554925c77c30166f8254de.exe
Size 1.1MB
Sample260415-l52hssev7y
SHA256 a0105b63cc3c3fb9d9801ebe43266da92afb66ebac554925c77c30166f8254de
MD5 0ca34746da266fe021f356c0174cf53f
SHA1 513dd5a6302e26974980f4b84d656a29f9daaed7
SHA512 5c032b60c3f80e1c74bddd7eec1555a968b195f68ec6e7c2e3292ade67db4d85483127df16640136e9ce637b877583dcbb25e630656a9b6847cd37352a10eebb
SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5QZ:acallSllG4ZM7QzMQ
TLSH
T1F1458D13F292C0F1E61C227124FB6739BE749B450A71CAC7EB94DD791C32691AB6720E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery flyagent

Malware Config

Signatures

Family: FlyAgent
FlyAgent is a backdoor written in C++.
backdoor flyagent

Detects FlyAgent Backdoor 7 IoCs

resource	yara_rule
behavioral2/memory/2888-0-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/2888-11-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/2888-14-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/files/0x002c00000002b1ab-15.dat	flyagent
behavioral2/memory/2404-18-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/2404-19-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/3984-20-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent

Deletes itself 1 IoCs

pid	Process
3984	svchcst.exe

Executes dropped EXE 2 IoCs

pid	Process
3984	svchcst.exe
2404	svchcst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a0105b63cc3c3fb9d9801ebe43266da92afb66ebac554925c77c30166f8254de.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings	a0105b63cc3c3fb9d9801ebe43266da92afb66ebac554925c77c30166f8254de.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2888	a0105b63cc3c3fb9d9801ebe43266da92afb66ebac554925c77c30166f8254de.exe
2888	a0105b63cc3c3fb9d9801ebe43266da92afb66ebac554925c77c30166f8254de.exe
2888	a0105b63cc3c3fb9d9801ebe43266da92afb66ebac554925c77c30166f8254de.exe
2888	a0105b63cc3c3fb9d9801ebe43266da92afb66ebac554925c77c30166f8254de.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe
3984	svchcst.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2888	a0105b63cc3c3fb9d9801ebe43266da92afb66ebac554925c77c30166f8254de.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2888	a0105b63cc3c3fb9d9801ebe43266da92afb66ebac554925c77c30166f8254de.exe
2888	a0105b63cc3c3fb9d9801ebe43266da92afb66ebac554925c77c30166f8254de.exe
3984	svchcst.exe
3984	svchcst.exe
2404	svchcst.exe
2404	svchcst.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 3988	2888	a0105b63cc3c3fb9d9801ebe43266da92afb66ebac554925c77c30166f8254de.exe	80
PID 2888 wrote to memory of 3396	2888	a0105b63cc3c3fb9d9801ebe43266da92afb66ebac554925c77c30166f8254de.exe	81
PID 3396 wrote to memory of 3984	3396	WScript.exe	83
PID 3988 wrote to memory of 2404	3988	WScript.exe	84

C:\Users\Admin\AppData\Local\Temp\a0105b63cc3c3fb9d9801ebe43266da92afb66ebac554925c77c30166f8254de.exe
"C:\Users\Admin\AppData\Local\Temp\a0105b63cc3c3fb9d9801ebe43266da92afb66ebac554925c77c30166f8254de.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3988
- - C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2404
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3396
- - C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
    3⤵
    - Deletes itself
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:3984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 753B
SHA256 b5083654ccb046a684041e93dbacd0620bd7a18402680c525e47f1b735f08f28
MD5 803bbc646002947aaf96f89abeee1fdf
SHA1 8ebed44dab0b5c7ceb3f6d679fdc9fd1d4940dac
SHA512 3a8d2bc890dda7a05a680da00bf007c2a89bf35356da5616001e4083a2e2957f4087f2b5ff49fdc58900cea955ba1a3c69f567dbeca9807550a246b765061e22
TLSH
T16001C010DE5CC229613553B66932A40FF7E9154363039CD97899D0613F706589C74B37
MD5 SHA1 SHA512 TLSH

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.1MB
SHA256 12964dfa737490a4d1557db70f4f976c3f0ca5b174ca7c854dfbfb6afc6d1d8e
MD5 e0e8e5c558c3794a5ac59f450a30e310
SHA1 f0ca7e240ccd7ac7bf7d4b4830e168852e78312d
SHA512 e2fcc36246a29cbbb74db72ba20a87e5a3bf1d8c9b6b1d3c75dff6ae4adc1fe8a28c6e273e7dfbd0bdea50afd3c8de3fe98418284703c965951624259a2c5200
SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5QU:acallSllG4ZM7QzM9
TLSH
T1DE458D13F292C0F1E61C227124FB6739BE749B450A71CAC7EB94DD791C32691AB6720E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2404-18-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/2404-19-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/2888-0-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/2888-11-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/2888-14-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/3984-20-0x0000000000400000-0x000000000055F000-memory.dmp

Download