Analysis
- max time kernel
125s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
15/04/2026, 21:02
Behavioral task
behavioral1
Sample
730ad8d79aa87b06256f2bbffdcc6455380b7e96f967897dc28a8089b433f9f4.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 730ad8d79aa87b06256f2bbffdcc6455380b7e96f967897dc28a8089b433f9f4.exe
- Size 1.3MB
- Sample260415-zvf11acx21
- SHA256 730ad8d79aa87b06256f2bbffdcc6455380b7e96f967897dc28a8089b433f9f4
- MD5 83843d7c3eb003a33a2e0a1c36532c27
- SHA1 1b0d9f058d8ec144f709f24c41ce1e787450949d
- SHA512 db16a39d1719fff67a9c0ecb09d7b82be86ee3389323af44e03fbed187d30e94335e167d790b4f74c19cbb136e3c3918003f687f262ce2972b75654288e47e86
- SSDEEP 24576:WBS9qQEK6QywlBqH82QoXFkrzkmmlSgRDko0lG4Z8r7Qfd7iu5i:WZaClSFlG4ZM7QlV0
- TLSH T1B2557C13F692C0F1E61C227124FB6339BE7497450A71CACBE794DD791C32691ABA720E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects FlyAgent Backdoor 3 IoCs
resource yara_rule behavioral2/memory/2780-8-0x0000000000400000-0x0000000000551000-memory.dmp flyagent behavioral2/memory/2780-9-0x0000000000400000-0x0000000000551000-memory.dmp flyagent behavioral2/files/0x002100000002b1e5-10.dat flyagent - Deletes itself 1 IoCs
pid Process 2028 svchcst.exe - Executes dropped EXE 1 IoCs
pid Process 2028 svchcst.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 730ad8d79aa87b06256f2bbffdcc6455380b7e96f967897dc28a8089b433f9f4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe - Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings svchcst.exe Key created \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings 730ad8d79aa87b06256f2bbffdcc6455380b7e96f967897dc28a8089b433f9f4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2780 730ad8d79aa87b06256f2bbffdcc6455380b7e96f967897dc28a8089b433f9f4.exe 2780 730ad8d79aa87b06256f2bbffdcc6455380b7e96f967897dc28a8089b433f9f4.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe 2028 svchcst.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 2780 730ad8d79aa87b06256f2bbffdcc6455380b7e96f967897dc28a8089b433f9f4.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2780 730ad8d79aa87b06256f2bbffdcc6455380b7e96f967897dc28a8089b433f9f4.exe 2780 730ad8d79aa87b06256f2bbffdcc6455380b7e96f967897dc28a8089b433f9f4.exe 2028 svchcst.exe 2028 svchcst.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2780 wrote to memory of 3160 2780 730ad8d79aa87b06256f2bbffdcc6455380b7e96f967897dc28a8089b433f9f4.exe 79 PID 3160 wrote to memory of 2028 3160 WScript.exe 81 PID 2028 wrote to memory of 4832 2028 svchcst.exe 82 PID 2028 wrote to memory of 4828 2028 svchcst.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\730ad8d79aa87b06256f2bbffdcc6455380b7e96f967897dc28a8089b433f9f4.exe"C:\Users\Admin\AppData\Local\Temp\730ad8d79aa87b06256f2bbffdcc6455380b7e96f967897dc28a8089b433f9f4.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"4⤵
- System Location Discovery: System Language Discovery
PID:4832
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"4⤵
- System Location Discovery: System Language Discovery
PID:4828
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Config.ini
- Size 92B
- SHA256 44063c266686263f14cd2a83fee124fb3e61a9171a6aab69709464f49511011d
- MD5 67b9b3e2ded7086f393ebbc36c5e7bca
- SHA1 e6299d0450b9a92a18cc23b5704a2b475652c790
- SHA512 826fbc9481f46b1ae3db828a665c55c349023caf563e6e8c17321f5f3af3e4c3914955db6f0eebfc6defe561315435d47310b4d0499ab9c2c85bb61264dedc09
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
- Size 696B
- SHA256 054ccb4671ec5693715c290f0bed875878cda62addcb38ef21257c59037fe30a
- MD5 57e51d7e4374cd875109b11b9b8deb29
- SHA1 aa5554bdcf8417f4b5fc9242f1de625e2fb820bf
- SHA512 6f58d52a71466d92d7da68e1bfdd91db03619d810eae2622b4e5623d2ad4e30e294d885c8c5405b775aa3256e3acbd0442a3bb2a4b6eb50001ee5f8848d66da3
- TLSH T12F019900DD4C8258503553B62432A40FF7AA1553B303ACE9B899D0B52F707689CB4A36
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
- Size 753B
- SHA256 e0ab33fedc823acd929d2d5d9c027842eb266e33867dff2cf5082d06237e42b6
- MD5 54a5bd826bc32b42727331d59895f854
- SHA1 0c40b86edb16e6180a3efebbca4cdd10217a58e2
- SHA512 95fb6bcd39a95da561fe22be222f6a8f1ee0f94146f1fa9de5cf76d0494f482adb1518be725eef4927c02b49bf91566af0e01f56247480b93f1ce0bbbfae9017
- TLSH T12201C000DD5CC259503953B52572A40EE7AA1553A3039CD9B85AD4752F70768CCB4A77
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
- Size 1.3MB
- SHA256 69ee0936d0d957e502e7ab4544e743a50b99694009f90430234e3862ba6ff8c6
- MD5 6c5b2eaa4193e8b76e9547c2fec0e7b6
- SHA1 ce27d2893365a16ae1a3f805d20e6cefc537afe4
- SHA512 94d9e2e7374dade11ad5026e2ef9f78ad5b483efce3634270a50803777d9e6a0a498f1c0c9a7c4bfdbfdc666b93f32f0c1bc29f2c9ecb2b9a55199fd3993651f
- SSDEEP 24576:WBS9qQEK6QywlBqH82QoXFkrzkmmlSgRDko0lG4Z8r7Qfd7iu5P:WZaClSFlG4ZM7QlV9
- TLSH T1E2557C13F692C0F1E61C227124FB6339BE7497450A71CACBE794DD791C32691ABA720E
- MD5 SHA1 SHA512 SSDEEP TLSH