flyagent | 14a3f959b9660fb4db972b53c83b0b7f06a83e121cf8884dabc4d47a06704395

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/04/2026, 22:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
14a3f959b9660fb4db972b53c83b0b7f06a83e121cf8884dabc4d47a06704395.exe
Size 1.4MB
Sample260417-14sltscx21
SHA256 14a3f959b9660fb4db972b53c83b0b7f06a83e121cf8884dabc4d47a06704395
MD5 ff78e213fc07173f899194ce9a89979a
SHA1 d38c9bdb8d40d9eb7f975d50da35c493e7965536
SHA512 05b7a2626a479c2a347e879dea6e63d50b573245604b1e0b3967db7bc021b9464b64dc2d472c7939c827736f67426808244f04a8df8221e309976e09f063899e
SSDEEP 24576:GH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5QJ:GcallSllG4ZM7QzMq
TLSH
T146658D13F292C0F1E61C227124FB6339BE749B450A71CAC7EB95DD791C32691AB6720E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery flyagent

Malware Config

Signatures

Family: FlyAgent
FlyAgent is a backdoor written in C++.
backdoor flyagent

Detects FlyAgent Backdoor 3 IoCs

resource	yara_rule
behavioral1/memory/4652-0-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral1/memory/4652-11-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral1/memory/4652-13-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\International\Geo\Nation	14a3f959b9660fb4db972b53c83b0b7f06a83e121cf8884dabc4d47a06704395.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	14a3f959b9660fb4db972b53c83b0b7f06a83e121cf8884dabc4d47a06704395.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings	14a3f959b9660fb4db972b53c83b0b7f06a83e121cf8884dabc4d47a06704395.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4652	14a3f959b9660fb4db972b53c83b0b7f06a83e121cf8884dabc4d47a06704395.exe
4652	14a3f959b9660fb4db972b53c83b0b7f06a83e121cf8884dabc4d47a06704395.exe
4652	14a3f959b9660fb4db972b53c83b0b7f06a83e121cf8884dabc4d47a06704395.exe
4652	14a3f959b9660fb4db972b53c83b0b7f06a83e121cf8884dabc4d47a06704395.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4652	14a3f959b9660fb4db972b53c83b0b7f06a83e121cf8884dabc4d47a06704395.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4652	14a3f959b9660fb4db972b53c83b0b7f06a83e121cf8884dabc4d47a06704395.exe
4652	14a3f959b9660fb4db972b53c83b0b7f06a83e121cf8884dabc4d47a06704395.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 5048	4652	14a3f959b9660fb4db972b53c83b0b7f06a83e121cf8884dabc4d47a06704395.exe	86
PID 4652 wrote to memory of 1352	4652	14a3f959b9660fb4db972b53c83b0b7f06a83e121cf8884dabc4d47a06704395.exe	85

C:\Users\Admin\AppData\Local\Temp\14a3f959b9660fb4db972b53c83b0b7f06a83e121cf8884dabc4d47a06704395.exe
"C:\Users\Admin\AppData\Local\Temp\14a3f959b9660fb4db972b53c83b0b7f06a83e121cf8884dabc4d47a06704395.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1352
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 753B
SHA256 cd0304cd4aee7ab13e7db76c07b2920e6eff3efd9c9a62db9ad3cd36fa8be272
MD5 e9796347a84458473e8deb7139714fee
SHA1 f1d1d66c3f1a573ab36ccbc026e65bff8db6dd42
SHA512 c0ccd1e055d65804a3e0672e90d27960a39f1c68d163a3c8b380e1b4a8cc31cf244277bb6af4231bb5e5ada1e7cc8df0c8a774c12abf866b9d3af57bbbdc84d7
TLSH
T10E011B01DD0CC2A8603543B22932E00EF7AA1183A3039CD9B895C0702FB03AC8CB0A33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4652-0-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/4652-11-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/4652-12-0x0000000000B30000-0x0000000000BDF000-memory.dmp

Download

memory/4652-13-0x0000000000400000-0x000000000055F000-memory.dmp

Download