Analysis
- max time kernel
149s - max time network
131s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
20/04/2026, 23:16
General
- Target d1f90be9e3f07af59fa1e381d20abea7ee54025e10fc8ec696bbeaa24822f03c.exe
- Size 1.3MB
- Sample260420-285ydsft2n
- SHA256 d1f90be9e3f07af59fa1e381d20abea7ee54025e10fc8ec696bbeaa24822f03c
Malware Config
Signatures
- Family: FlyAgent
FlyAgent is a backdoor written in C++.
- Detects FlyAgent Backdoor 5 IoCs
- Deletes itself 1 IoCs
- Executes dropped EXE 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 5 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of SetWindowsHookEx 8 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d1f90be9e3f07af59fa1e381d20abea7ee54025e10fc8ec696bbeaa24822f03c.exe"C:\Users\Admin\AppData\Local\Temp\d1f90be9e3f07af59fa1e381d20abea7ee54025e10fc8ec696bbeaa24822f03c.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"4⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"4⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Config.ini
VBS3.vbs
VBS3.vbs
svchcst.exe
svchcst.exe
memory/572-67-0x0000000000A10000-0x0000000000B22000-memory.dmp
memory/760-68-0x0000000000AE0000-0x0000000000BF2000-memory.dmp
memory/1300-46-0x0000000000C60000-0x0000000000DAD000-memory.dmp
memory/1300-61-0x0000000000C60000-0x0000000000DAD000-memory.dmp
memory/1300-62-0x00000000050F0000-0x000000000510D000-memory.dmp
memory/1300-63-0x0000000005110000-0x000000000511B000-memory.dmp
memory/2704-34-0x0000000000E90000-0x0000000000FDD000-memory.dmp
memory/2704-10-0x0000000000E90000-0x0000000000FDD000-memory.dmp
memory/3400-64-0x0000000001510000-0x000000000165D000-memory.dmp
memory/3400-66-0x0000000005920000-0x000000000592B000-memory.dmp
memory/3400-65-0x0000000005900000-0x000000000591D000-memory.dmp
memory/3400-47-0x0000000001510000-0x000000000165D000-memory.dmp
memory/3644-45-0x0000000000B20000-0x0000000000C32000-memory.dmp
memory/3644-57-0x0000000000B20000-0x0000000000C32000-memory.dmp
memory/3644-51-0x0000000000B20000-0x0000000000C32000-memory.dmp
memory/4808-31-0x0000000000C60000-0x0000000000D72000-memory.dmp
memory/4808-30-0x0000000000400000-0x0000000000551000-memory.dmp
memory/4808-18-0x0000000000C60000-0x0000000000D72000-memory.dmp
memory/4808-11-0x0000000000400000-0x0000000000551000-memory.dmp
memory/4808-9-0x0000000000C60000-0x0000000000D72000-memory.dmp
memory/4808-8-0x0000000000400000-0x0000000000551000-memory.dmp