flyagent | e0c1d5a8d12c050df62565271d9ef5ef9067e0d06dde9569e0de1b41b3e5e32c

Analysis

max time kernel
149s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
21/04/2026, 23:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e0c1d5a8d12c050df62565271d9ef5ef9067e0d06dde9569e0de1b41b3e5e32c.exe
Size 1.1MB
Sample260421-2zfbdagy3t
SHA256 e0c1d5a8d12c050df62565271d9ef5ef9067e0d06dde9569e0de1b41b3e5e32c
MD5 bc10b165887b361e39c15045fc8a1cae
SHA1 3402a0bd30daa2deea5392825857aca6dbd1ea73
SHA512 f97538519bd654cf65bbd056a857a636176e4d8318f2a8e2d9b9f56f9ac5fecb1155094a7567d76f3e1144014bb2541cb7d36cc49ae69429945766ec31736a47
SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Qe:acallSllG4ZM7QzMr
TLSH
T1B5458D13F292C0F1E61C227124FB6739BE749B450A71CAC7E794DD791C32691AB6720E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery flyagent

Malware Config

Signatures

Family: FlyAgent
FlyAgent is a backdoor written in C++.
backdoor flyagent

Detects FlyAgent Backdoor 8 IoCs

resource	yara_rule
behavioral2/memory/3052-0-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/3052-11-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/3052-21-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/files/0x001a00000002b463-22.dat	flyagent
behavioral2/memory/1740-26-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/684-25-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/1740-28-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/684-30-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent

Deletes itself 1 IoCs

pid	Process
684	svchcst.exe

Executes dropped EXE 2 IoCs

pid	Process
684	svchcst.exe
1740	svchcst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e0c1d5a8d12c050df62565271d9ef5ef9067e0d06dde9569e0de1b41b3e5e32c.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings	e0c1d5a8d12c050df62565271d9ef5ef9067e0d06dde9569e0de1b41b3e5e32c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3052	e0c1d5a8d12c050df62565271d9ef5ef9067e0d06dde9569e0de1b41b3e5e32c.exe
3052	e0c1d5a8d12c050df62565271d9ef5ef9067e0d06dde9569e0de1b41b3e5e32c.exe
3052	e0c1d5a8d12c050df62565271d9ef5ef9067e0d06dde9569e0de1b41b3e5e32c.exe
3052	e0c1d5a8d12c050df62565271d9ef5ef9067e0d06dde9569e0de1b41b3e5e32c.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe
684	svchcst.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3052	e0c1d5a8d12c050df62565271d9ef5ef9067e0d06dde9569e0de1b41b3e5e32c.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3052	e0c1d5a8d12c050df62565271d9ef5ef9067e0d06dde9569e0de1b41b3e5e32c.exe
3052	e0c1d5a8d12c050df62565271d9ef5ef9067e0d06dde9569e0de1b41b3e5e32c.exe
1740	svchcst.exe
1740	svchcst.exe
684	svchcst.exe
684	svchcst.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 4292	3052	e0c1d5a8d12c050df62565271d9ef5ef9067e0d06dde9569e0de1b41b3e5e32c.exe	80
PID 3052 wrote to memory of 4892	3052	e0c1d5a8d12c050df62565271d9ef5ef9067e0d06dde9569e0de1b41b3e5e32c.exe	81
PID 4892 wrote to memory of 1740	4892	WScript.exe	83
PID 4292 wrote to memory of 684	4292	WScript.exe	84

C:\Users\Admin\AppData\Local\Temp\e0c1d5a8d12c050df62565271d9ef5ef9067e0d06dde9569e0de1b41b3e5e32c.exe
"C:\Users\Admin\AppData\Local\Temp\e0c1d5a8d12c050df62565271d9ef5ef9067e0d06dde9569e0de1b41b3e5e32c.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4292
- - C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
    3⤵
    - Deletes itself
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:684
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 753B
SHA256 364d07f9f53e4b58f4615d1c56ca9153d1c603d7c980031b2b4226ee0d34f280
MD5 95837526a0c73d8e7813ecf08996b564
SHA1 c956bd7e32b474d4200e40faab17490a782a5063
SHA512 e0d34fd647feb91395dab1d9251c795fab141debd4e3a6f235fe8e64e0a1585a5a09222a96ba1276d253a60ceb9d70340ad4d65b7141b1463c5aa533068b4c51
TLSH
T17801CB00DE8C821E903593763433A84EF7AA1553A303ACD8B855C1A63FB0668DCB4A32
MD5 SHA1 SHA512 TLSH

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.1MB
SHA256 212bc1a468e6603183384afab0373f02dfd8c06ee38a3cd97b97245f639b878d
MD5 4d288e2d977b5ae5aa913182d5ae8932
SHA1 918ff6ce3362c95261279245f6f43a765476f8bb
SHA512 d8a6675bd52a9a814545c5749a76ceadee7be550b0e5e693994f319f4acb36974a98b3df0f4199683f19fcc96d60b85dfc54eb19c63f117654a77256247f33a3
SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Qb:acallSllG4ZM7QzM+
TLSH
T1B6458D13F292C0F1E61C227124FB6739BE749B450A71CAC7E794DD791C32691ABA720E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/684-25-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/684-30-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/1740-26-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/1740-28-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/3052-0-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/3052-11-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/3052-21-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/4292-12-0x00000000030F0000-0x0000000003141000-memory.dmp

Download

memory/4892-13-0x0000000003130000-0x0000000003181000-memory.dmp

Download