flyagent | 1dcd7e2e68be1edb145e77c6fb2a4ced167e8241de5da0caf03f19b23eb4faae

Analysis

max time kernel
124s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/04/2026, 22:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1dcd7e2e68be1edb145e77c6fb2a4ced167e8241de5da0caf03f19b23eb4faae.exe
Size 1.3MB
Sample260421-131wtacz2n
SHA256 1dcd7e2e68be1edb145e77c6fb2a4ced167e8241de5da0caf03f19b23eb4faae
MD5 02089e0925b19cb7a44e4f98e229e037
SHA1 b089b1c1aa310794a8c601347f139cb209de8084
SHA512 0cad1f92940b529786f31b1c5338e177130e1900c9b6df649ebc40e0b7298a6b21b38e1c422ac6ecc24cad96c8909cd923963e520b609e5fb2a803ae425a06c8
SSDEEP 24576:WBS9qQEK6QywlBqH82QoXFkrzkmmlSgRDko0lG4Z8r7Qfd7iu57:WZaClSFlG4ZM7QlVZ
TLSH
T157557C13F692C0F1E61C227124FB6339BE7497450A71CACBE794DD791C32691ABA720E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery flyagent

Malware Config

Signatures

Family: FlyAgent
FlyAgent is a backdoor written in C++.
backdoor flyagent

Detects FlyAgent Backdoor 1 IoCs

resource	yara_rule
behavioral1/memory/4380-10-0x0000000000400000-0x0000000000551000-memory.dmp	flyagent

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Control Panel\International\Geo\Nation	1dcd7e2e68be1edb145e77c6fb2a4ced167e8241de5da0caf03f19b23eb4faae.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1dcd7e2e68be1edb145e77c6fb2a4ced167e8241de5da0caf03f19b23eb4faae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings	1dcd7e2e68be1edb145e77c6fb2a4ced167e8241de5da0caf03f19b23eb4faae.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4380	1dcd7e2e68be1edb145e77c6fb2a4ced167e8241de5da0caf03f19b23eb4faae.exe
4380	1dcd7e2e68be1edb145e77c6fb2a4ced167e8241de5da0caf03f19b23eb4faae.exe
4380	1dcd7e2e68be1edb145e77c6fb2a4ced167e8241de5da0caf03f19b23eb4faae.exe
4380	1dcd7e2e68be1edb145e77c6fb2a4ced167e8241de5da0caf03f19b23eb4faae.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4380	1dcd7e2e68be1edb145e77c6fb2a4ced167e8241de5da0caf03f19b23eb4faae.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4380	1dcd7e2e68be1edb145e77c6fb2a4ced167e8241de5da0caf03f19b23eb4faae.exe
4380	1dcd7e2e68be1edb145e77c6fb2a4ced167e8241de5da0caf03f19b23eb4faae.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 5996	4380	1dcd7e2e68be1edb145e77c6fb2a4ced167e8241de5da0caf03f19b23eb4faae.exe	83
PID 4380 wrote to memory of 3916	4380	1dcd7e2e68be1edb145e77c6fb2a4ced167e8241de5da0caf03f19b23eb4faae.exe	84

C:\Users\Admin\AppData\Local\Temp\1dcd7e2e68be1edb145e77c6fb2a4ced167e8241de5da0caf03f19b23eb4faae.exe
"C:\Users\Admin\AppData\Local\Temp\1dcd7e2e68be1edb145e77c6fb2a4ced167e8241de5da0caf03f19b23eb4faae.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5996
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 753B
SHA256 db30617d9388b0577f26dc923cac1c81a7886502e35ee5df1f8aebb094cddfe9
MD5 7e14474da488e1a9a5782fcd0a14160f
SHA1 338d5efd3d3e848a9a4ef947448f3d867cd6a43e
SHA512 24578f1167188ad65b5a6c589cf99c735a72a3b50e29989084fbf0af8ce921b5502b19e01f66de1a38c60748b96f3df5b8077ebd921ca05f04dfa5515f684775
TLSH
T11A011000DD4C8218503553791532944AE7ED1003A303ACD8B899C5A52F707688CB0A33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3916-13-0x00000000007F0000-0x000000000084F000-memory.dmp

Download

memory/4380-10-0x0000000000400000-0x0000000000551000-memory.dmp

Download

memory/4380-11-0x0000000000C20000-0x0000000000C7F000-memory.dmp

Download

memory/5996-12-0x00000000007A0000-0x00000000007FF000-memory.dmp

Download