flyagent | 358415cd6b6f54827deea8e25dc35594001b452b88ddeef53aaaed967e780bdc

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 10:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
358415cd6b6f54827deea8e25dc35594001b452b88ddeef53aaaed967e780bdc.exe
Size 1.1MB
Sample260415-mgd82aex4x
SHA256 358415cd6b6f54827deea8e25dc35594001b452b88ddeef53aaaed967e780bdc
MD5 6fbc3478a37ee4382f17a867f14ecdd7
SHA1 b63dbe2d7cbceeea454258fc0deaacbe8ad123c9
SHA512 aabe2e1c5a2526c54a7f79647658b97cff0ad78b34bd6be10c39c152ced5e937121350437f52dbedf6e88c33250afc42bc64ecc6c226738d27138cd54a923ed9
SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5QI:acallSllG4ZM7QzMB
TLSH
T17C458D13F292C0F1E61C227124FB6739BE749B450A71CAC7EB94DD791C32691AB6720E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery flyagent

Malware Config

Signatures

Family: FlyAgent
FlyAgent is a backdoor written in C++.
backdoor flyagent

Detects FlyAgent Backdoor 13 IoCs

resource	yara_rule
behavioral2/memory/2912-0-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/2912-12-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/2912-14-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/files/0x001b00000002b3cc-15.dat	flyagent
behavioral2/memory/1864-25-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/1864-27-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/files/0x001b00000002b3d0-28.dat	flyagent
behavioral2/files/0x001c00000002b3cc-32.dat	flyagent
behavioral2/memory/3824-41-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/3520-46-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/3116-45-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/3520-49-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/3116-52-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent

Deletes itself 1 IoCs

pid	Process
1864	svchcst.exe

Executes dropped EXE 4 IoCs

pid	Process
1864	svchcst.exe
3824	svchcst.exe
3520	svchcst.exe
3116	svchcst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	358415cd6b6f54827deea8e25dc35594001b452b88ddeef53aaaed967e780bdc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings	svchcst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings	358415cd6b6f54827deea8e25dc35594001b452b88ddeef53aaaed967e780bdc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings	svchcst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2912	358415cd6b6f54827deea8e25dc35594001b452b88ddeef53aaaed967e780bdc.exe
2912	358415cd6b6f54827deea8e25dc35594001b452b88ddeef53aaaed967e780bdc.exe
2912	358415cd6b6f54827deea8e25dc35594001b452b88ddeef53aaaed967e780bdc.exe
2912	358415cd6b6f54827deea8e25dc35594001b452b88ddeef53aaaed967e780bdc.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe
1864	svchcst.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2912	358415cd6b6f54827deea8e25dc35594001b452b88ddeef53aaaed967e780bdc.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2912	358415cd6b6f54827deea8e25dc35594001b452b88ddeef53aaaed967e780bdc.exe
2912	358415cd6b6f54827deea8e25dc35594001b452b88ddeef53aaaed967e780bdc.exe
1864	svchcst.exe
1864	svchcst.exe
3824	svchcst.exe
3824	svchcst.exe
3116	svchcst.exe
3116	svchcst.exe
3520	svchcst.exe
3520	svchcst.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 3252	2912	358415cd6b6f54827deea8e25dc35594001b452b88ddeef53aaaed967e780bdc.exe	80
PID 2912 wrote to memory of 1456	2912	358415cd6b6f54827deea8e25dc35594001b452b88ddeef53aaaed967e780bdc.exe	79
PID 3252 wrote to memory of 1864	3252	WScript.exe	82
PID 1864 wrote to memory of 4144	1864	svchcst.exe	83
PID 4144 wrote to memory of 3824	4144	WScript.exe	84
PID 3824 wrote to memory of 3988	3824	svchcst.exe	85
PID 3824 wrote to memory of 3900	3824	svchcst.exe	86
PID 3988 wrote to memory of 3520	3988	WScript.exe	88
PID 3900 wrote to memory of 3116	3900	WScript.exe	87

C:\Users\Admin\AppData\Local\Temp\358415cd6b6f54827deea8e25dc35594001b452b88ddeef53aaaed967e780bdc.exe
"C:\Users\Admin\AppData\Local\Temp\358415cd6b6f54827deea8e25dc35594001b452b88ddeef53aaaed967e780bdc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1456
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3252
- - C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
    3⤵
    - Deletes itself
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1864
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4144
    - - C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3824
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        6⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3988
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3520
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        6⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3900
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Config.ini

Path C:\Users\Admin\AppData\Roaming\Microsoft\Config.ini
Size 92B
SHA256 44063c266686263f14cd2a83fee124fb3e61a9171a6aab69709464f49511011d
MD5 67b9b3e2ded7086f393ebbc36c5e7bca
SHA1 e6299d0450b9a92a18cc23b5704a2b475652c790
SHA512 826fbc9481f46b1ae3db828a665c55c349023caf563e6e8c17321f5f3af3e4c3914955db6f0eebfc6defe561315435d47310b4d0499ab9c2c85bb61264dedc09
MD5 SHA1 SHA512

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 753B
SHA256 1969d041e6fe2ea49b7b638d60ede046e6833fa7ab644f3c288979f132b5ba43
MD5 5b5ddad106143192f540b8b92b670740
SHA1 8fc9ee8d69bb299d8a70c5560bd38cfbe9b1d453
SHA512 0ca36fbf4310491446080ab505d687a1d30c3dc4a38915b42c030eb5241856389181c08e345305b0fedd0dc83208e7f2ab2c5aa8cb2eb420df9430a6f1677e33
TLSH
T18501F410DD5CC26D603543765532A44FF7DA15536303ACE47C59E0B52F707689C74A37
MD5 SHA1 SHA512 TLSH

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 696B
SHA256 3dc5ae697f3f5a3ffe053412e05a646883c49be29b179039ceadf5f71a595f9d
MD5 8cb32754e88999ece2a392d94875313e
SHA1 da0ef4e297872b82db206ebdc4cafefeed2a4e3d
SHA512 a331a2472d0ef04f4d6a9b41a147020a688c96977feec8d61878f31382af8c27b8e990dc404137475d48f0155d600cc0d6ebe0a5d1cbb60b1fecf364301ebaa7
TLSH
T169019900DD4CC258503553B62432E40FF7AA1553A303ACE8B899D0B52FB07689DB4A33
MD5 SHA1 SHA512 TLSH

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 696B
SHA256 5ed3aa382febd7a4e6c3a921a5add055f6e2bbea7558b21da46752f037d52b1a
MD5 608aea68519434d685c413b31a12c6ce
SHA1 7a62e13cab985d0588a0faea63751fd0355da7fc
SHA512 6ddca4b85fc1b6ecb6c1081b32067eb438ed5167b48565ea449e6babb1f27a01c75599c6b0f10b29ac9278e619891588d654466ce882d8080f4d2435f450d198
TLSH
T19C019900DD4CC258503553B62432A40FF7AA1553A303ACE8B899D1A52F707689CB4A36
MD5 SHA1 SHA512 TLSH

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.1MB
SHA256 a80bea8b348aefbcaf9bed99b300ec1f50eb2d4ba0de5729691f8f655450222f
MD5 8b2b048cdb8a4ca3645888de17282cf6
SHA1 ba817d3e0b2e73e774475a43ec64621caba1ef83
SHA512 67b7907e2996ee2b61293bd1aadd180395b1f20711c39439e8ea917856f14b5e793bc5535a9f94eeb7427c39d8aa1c7088ef3ba3dca5ba5098c75ff5e46c5327
SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Qp:acallSllG4ZM7QzMw
TLSH
T145458D13F292C0F1E61C227124FB6739BE749B450A71CAC7EB94DD791C32691AB6720E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.1MB
SHA256 2c8739ce21abada9f60d0a20e367cdabe54f611a19aa6f68e740d13350258ae3
MD5 ba3b279c13205c926b7ac8f3b1257d4b
SHA1 5bce598a666fb1ca60f416fb602295c81bcae390
SHA512 59aa0518cc1122f02f24df021f83e9639b605ceb9f134c9b400e944acf533b4fe835890b37fb98050d98d127a98c8244e6845555b7391f2270b6831b9ef0fb60
SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Qy:acallSllG4ZM7QzMP
TLSH
T13D458D13F292C0F1E61C227124FB6739BE749B450A71CAC7EB94DD791C32691AB6720E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.1MB
SHA256 75d8d4e4108582feabf201b8ef4f2287b8c17fa03ec9fc363147a255bb464119
MD5 cc4628472761cc195046f6f80af99b46
SHA1 fcc46849f96971a43bc6814242189a12cfab411d
SHA512 7ae684fd7bc23b2268f4560a53c82355e95fc657534c3fe6455d293ef286ef80f19f367331ddaf95b7f5e4742fe5b8eec827c15be338ec75481805b757e7183b
SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5QP:acallSllG4ZM7QzMi
TLSH
T18A458D13F292C0F1E61C227124FB6739BE749B450A71CAC7EB94DD791C32691AB6720E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1864-25-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/1864-27-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/2912-14-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/2912-0-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/2912-12-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/3116-52-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/3116-45-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/3520-46-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/3520-49-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/3824-41-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/3900-51-0x0000000005B50000-0x0000000005B69000-memory.dmp

Download

memory/3900-50-0x0000000005830000-0x00000000058B8000-memory.dmp

Download

memory/3988-48-0x0000000004C40000-0x0000000004C59000-memory.dmp

Download

memory/3988-47-0x0000000005350000-0x00000000053D8000-memory.dmp

Download

memory/4144-31-0x0000000005470000-0x000000000548D000-memory.dmp

Download

memory/4144-30-0x0000000005400000-0x0000000005468000-memory.dmp

Download