Analysis
- max time kernel
101s - max time network
98s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
15/04/2026, 11:13
General
- Target 0706144c91666ba5b7dd45a57e2cc6b2a1b4fc2b786336dd9563192392c7becd.exe
- Size 1.1MB
- Sample260415-nbtbfafs91
- SHA256 0706144c91666ba5b7dd45a57e2cc6b2a1b4fc2b786336dd9563192392c7becd
Malware Config
Signatures
- Family: FlyAgent
FlyAgent is a backdoor written in C++.
- Detects FlyAgent Backdoor 12 IoCs
- Deletes itself 1 IoCs
- Executes dropped EXE 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0706144c91666ba5b7dd45a57e2cc6b2a1b4fc2b786336dd9563192392c7becd.exe"C:\Users\Admin\AppData\Local\Temp\0706144c91666ba5b7dd45a57e2cc6b2a1b4fc2b786336dd9563192392c7becd.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"5⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"6⤵
-
-
-
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Config.ini
VBS3.vbs
VBS3.vbs
VBS3.vbs
svchcst.exe
svchcst.exe
svchcst.exe
memory/1768-66-0x0000000000A20000-0x0000000000B32000-memory.dmp
memory/1768-67-0x0000000000400000-0x000000000055F000-memory.dmp
memory/3344-28-0x0000000000400000-0x000000000055F000-memory.dmp
memory/3344-0-0x0000000000400000-0x000000000055F000-memory.dmp
memory/3344-11-0x0000000000400000-0x000000000055F000-memory.dmp
memory/3344-12-0x0000000000AC0000-0x0000000000BD2000-memory.dmp
memory/3344-13-0x0000000000400000-0x000000000055F000-memory.dmp
memory/3344-18-0x0000000000AC0000-0x0000000000BD2000-memory.dmp
memory/3344-29-0x0000000000AC0000-0x0000000000BD2000-memory.dmp
memory/3356-37-0x0000000000400000-0x000000000055F000-memory.dmp
memory/3356-36-0x0000000000980000-0x0000000000A92000-memory.dmp
memory/3356-34-0x0000000000400000-0x000000000055F000-memory.dmp
memory/5108-32-0x0000000003420000-0x0000000003A22000-memory.dmp
memory/5116-35-0x0000000003740000-0x0000000003D42000-memory.dmp
memory/5876-58-0x0000000005590000-0x00000000055DB000-memory.dmp
memory/5876-57-0x00000000054E0000-0x0000000005568000-memory.dmp
memory/5876-56-0x0000000003190000-0x0000000003792000-memory.dmp
memory/6116-52-0x00000000009B0000-0x0000000000AC2000-memory.dmp
memory/6116-53-0x0000000000400000-0x000000000055F000-memory.dmp
memory/6116-49-0x00000000009B0000-0x0000000000AC2000-memory.dmp
memory/6116-48-0x0000000000400000-0x000000000055F000-memory.dmp