flyagent | 768540e333fb1f2da65a2dcb87b6183cc980725ba6d449b34cc9f3a918e0916f

Analysis

max time kernel
110s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/04/2026, 09:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
768540e333fb1f2da65a2dcb87b6183cc980725ba6d449b34cc9f3a918e0916f.exe
Size 1.1MB
Sample260416-lr1pcaft2y
SHA256 768540e333fb1f2da65a2dcb87b6183cc980725ba6d449b34cc9f3a918e0916f
MD5 8fd685d27ff98941a66c9182ef126072
SHA1 2ee9f2e6ea5004096634e91a2f9ede67b64959ff
SHA512 5e053c46db1d5c464d8b3d5097c335652098039885f8448788bd1995fde9f1d5d5fd7d53e5381bace5af4144c4ed59053ab12cd2a2c8fb0db4f4a31a1c6c6df7
SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5QF:acallSllG4ZM7QzMs
TLSH
T1AB458D13F292C0F1E61C227124FB6739BE749B450A71CAC7EB94DD791C32691AB6720E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery flyagent

Malware Config

Signatures

Family: FlyAgent
FlyAgent is a backdoor written in C++.
backdoor flyagent

Detects FlyAgent Backdoor 14 IoCs

resource	yara_rule
behavioral2/memory/2912-0-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/2912-12-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/2912-15-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/files/0x001b00000002b3cc-16.dat	flyagent
behavioral2/memory/3192-28-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/3192-29-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/files/0x001b00000002b3d0-30.dat	flyagent
behavioral2/files/0x001c00000002b3cc-36.dat	flyagent
behavioral2/memory/5484-45-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/5484-47-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/4464-52-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/2440-50-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/4464-53-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/2440-56-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent

Deletes itself 1 IoCs

pid	Process
3192	svchcst.exe

Executes dropped EXE 2 IoCs

pid	Process
3192	svchcst.exe
5484	svchcst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	768540e333fb1f2da65a2dcb87b6183cc980725ba6d449b34cc9f3a918e0916f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings	svchcst.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings	768540e333fb1f2da65a2dcb87b6183cc980725ba6d449b34cc9f3a918e0916f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings	svchcst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2912	768540e333fb1f2da65a2dcb87b6183cc980725ba6d449b34cc9f3a918e0916f.exe
2912	768540e333fb1f2da65a2dcb87b6183cc980725ba6d449b34cc9f3a918e0916f.exe
2912	768540e333fb1f2da65a2dcb87b6183cc980725ba6d449b34cc9f3a918e0916f.exe
2912	768540e333fb1f2da65a2dcb87b6183cc980725ba6d449b34cc9f3a918e0916f.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe
3192	svchcst.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2912	768540e333fb1f2da65a2dcb87b6183cc980725ba6d449b34cc9f3a918e0916f.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2912	768540e333fb1f2da65a2dcb87b6183cc980725ba6d449b34cc9f3a918e0916f.exe
2912	768540e333fb1f2da65a2dcb87b6183cc980725ba6d449b34cc9f3a918e0916f.exe
3192	svchcst.exe
3192	svchcst.exe
5484	svchcst.exe
5484	svchcst.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 3304	2912	768540e333fb1f2da65a2dcb87b6183cc980725ba6d449b34cc9f3a918e0916f.exe	80
PID 2912 wrote to memory of 5132	2912	768540e333fb1f2da65a2dcb87b6183cc980725ba6d449b34cc9f3a918e0916f.exe	79
PID 3304 wrote to memory of 3192	3304	WScript.exe	82
PID 3192 wrote to memory of 5888	3192	svchcst.exe	84
PID 3192 wrote to memory of 6084	3192	svchcst.exe	83
PID 6084 wrote to memory of 5484	6084	WScript.exe	85
PID 5484 wrote to memory of 4300	5484	svchcst.exe	86
PID 5484 wrote to memory of 1316	5484	svchcst.exe	87

C:\Users\Admin\AppData\Local\Temp\768540e333fb1f2da65a2dcb87b6183cc980725ba6d449b34cc9f3a918e0916f.exe
"C:\Users\Admin\AppData\Local\Temp\768540e333fb1f2da65a2dcb87b6183cc980725ba6d449b34cc9f3a918e0916f.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5132
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3304
- - C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
    3⤵
    - Deletes itself
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3192
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:6084
    - - C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5484
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4300
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        7⤵
        
        PID:4464
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1316
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        7⤵
        
        PID:2440
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:5888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Config.ini

Path C:\Users\Admin\AppData\Roaming\Microsoft\Config.ini
Size 92B
SHA256 44063c266686263f14cd2a83fee124fb3e61a9171a6aab69709464f49511011d
MD5 67b9b3e2ded7086f393ebbc36c5e7bca
SHA1 e6299d0450b9a92a18cc23b5704a2b475652c790
SHA512 826fbc9481f46b1ae3db828a665c55c349023caf563e6e8c17321f5f3af3e4c3914955db6f0eebfc6defe561315435d47310b4d0499ab9c2c85bb61264dedc09
MD5 SHA1 SHA512

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 753B
SHA256 402ff9af0348718ba2e4a70a06ca0601e7324e4a410ecd8e28c89f598281e4d6
MD5 a4823e8100c20ba9256f2ca216e05480
SHA1 d7b3d52ca8cdd18b217ad0981eee0fd5143cebaa
SHA512 345773b054bee09fdd3bffc1ae9c236a85c5bbf91ac20175edd9fa5243df63a825d22ca9d5f8c05987df548e0493b42d5897244d321ccb2ddcf6edc58129315c
TLSH
T15801C000DD5CC259513953B62432A44EF79E1503B3039CD87859D1612F707689DB4A37
MD5 SHA1 SHA512 TLSH

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 696B
SHA256 c844bc25686320e65c1b5259a6d0d6d47f61709f46e2c8eb2ad3f9c3b9333d84
MD5 379619305716718fbeeab2f364946c39
SHA1 b663cf106c4673549692fa39d25e9e8f4561cd64
SHA512 b2c91d0f1cbc9e253bb3bb339acbab0e31eef31188cc00132c423fee2a85c7a91132c9259b99b23a149f6ba1172b8522e2d8350f88dbb735ad8d7a32f71e2ed8
TLSH
T194019900DD4C8258503553B62432A40FF7AA1553A303ACE8B899D1A52F707689CB4A36
MD5 SHA1 SHA512 TLSH

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 696B
SHA256 5af7cfef4fc0b02f32178caf67f947bc09a9631a5ec201ffa67b2f4f470bbed2
MD5 b9f42b67196579be4b48ef3493e40a6d
SHA1 f0a798a4aa9401ce637b3016829d6bc178b46b36
SHA512 875207383356da783c8f932da091d7c1316a0859406a388a6a4b0e641cc15326ac5134a5dc3e5299cccd6c245456483db86f5f9652fec2fa049996259d166284
TLSH
T199019400DD4CC268603953B62432A40FF7AA1563A303ACE8B899D1A52FB07689DB4A36
MD5 SHA1 SHA512 TLSH

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.1MB
SHA256 e6b7c747beb6c0e84c188662eebb9beff6bbd9fd23555522ef40960108969885
MD5 1e196264adddfa4a5d79f8b3c2bd35e2
SHA1 e9f7f12998af87a62513c8c2ac7c306a9dce6b7b
SHA512 1bff8030d1091e87fa7c5968975d3593aeb07a534ca14588bd5527ab30d58730d7bbcb8d821642f59e8b91b120be8a551b01a1188ca13bc7c415c5e1c6d87ec1
SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5QY:acallSllG4ZM7QzMR
TLSH
T1A6458D13F292C0F1E61C227124FB6739BE749B450A71CAC7EB94DD791C32691AB6720E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.1MB
SHA256 56a93bfbcb1b08099b989b91906f26b925c9d56f1c1a21f5908b6a0e273ebe11
MD5 c565a70dc9449184b5fde05add5bef6b
SHA1 5a0ea68ce89b78c31a5a4875ee07945fc97346c5
SHA512 9faf0a6ab3c7b5362b0701106c0766555809b16e05b44904e52998301eea9aba9fc4fc9d03167a9cc6afe5db827f001d1631f33cadc888de10aa049586e7e4a0
SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5QQ:acallSllG4ZM7QzMJ
TLSH
T1FE458D13F292C0F1E61C227124FB6739BE749B450A71CAC7EB94DD791C32691AB6720E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.1MB
SHA256 1e42b09aca1ff203f4f6c9b350ae4e44baa3bcc091da11ffc814e635e7e6bae3
MD5 88c2cda9f50f6eaa0cf604cc7c6bb463
SHA1 29de78c2a943606e3e4b2ada6c25a773fdeb1234
SHA512 dbc0f5361f2df5eb6f640c664336ed3fbd997a97e5cf173f4df2b275de3aa77bb0e2a4f0654feecf79c586a930af430798aa8b605db0366094f2efb248f4eeb2
SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5QS:acallSllG4ZM7QzMv
TLSH
T1D3458D13F292C0F1E61C227124FB6739BE749B450A71CAC7EB94DD791C32691AB6720E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1316-54-0x0000000004C70000-0x0000000004CF8000-memory.dmp

Download

memory/2440-56-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/2440-50-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/2912-0-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/2912-15-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/2912-12-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/3192-29-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/3192-28-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/4300-55-0x0000000005640000-0x00000000056C8000-memory.dmp

Download

memory/4464-52-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/4464-53-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/5484-47-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/5484-45-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/5888-35-0x0000000004C90000-0x0000000004CAD000-memory.dmp

Download

memory/5888-34-0x0000000004C20000-0x0000000004C88000-memory.dmp

Download

memory/6084-32-0x0000000005150000-0x00000000051B8000-memory.dmp

Download

memory/6084-33-0x00000000051C0000-0x00000000051DD000-memory.dmp

Download