flyagent | 86e0267ee6ea6907b2e8521ddf20fa30f50b786b76ca1537bbaea4277e05b1ca

Analysis

max time kernel
114s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/04/2026, 11:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
86e0267ee6ea6907b2e8521ddf20fa30f50b786b76ca1537bbaea4277e05b1ca.exe
Size 1.4MB
Sample260423-nyfc4aby3x
SHA256 86e0267ee6ea6907b2e8521ddf20fa30f50b786b76ca1537bbaea4277e05b1ca
MD5 301723753366e50a27f3586731646e3a
SHA1 64a16b35c53fb9307bd4175e658d2d61c27940d0
SHA512 570d5cf2548911d8931d631b62b8f70b831cdd98efa31ff2f5ec028d53faf21c1f9b9f08a49f99c3ac22e878c44081b632ae3c67e9ef36a64ebd5b0ba87e2672
SSDEEP 24576:GH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Q3:GcallSllG4ZM7QzMQ
TLSH
T1A0658D13F292C0F1E61C227124FB6339BE749B450A71CAC7EB95DD791C32691AB6720E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery flyagent

Malware Config

Signatures

Family: FlyAgent
FlyAgent is a backdoor written in C++.
backdoor flyagent

Detects FlyAgent Backdoor 6 IoCs

resource	yara_rule
behavioral2/memory/484-0-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/484-11-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/484-13-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/484-23-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/files/0x000d00000001047e-24.dat	flyagent
behavioral2/memory/2312-36-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent

Executes dropped EXE 1 IoCs

pid	Process
2312	svchcst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	86e0267ee6ea6907b2e8521ddf20fa30f50b786b76ca1537bbaea4277e05b1ca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings	86e0267ee6ea6907b2e8521ddf20fa30f50b786b76ca1537bbaea4277e05b1ca.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
484	86e0267ee6ea6907b2e8521ddf20fa30f50b786b76ca1537bbaea4277e05b1ca.exe
484	86e0267ee6ea6907b2e8521ddf20fa30f50b786b76ca1537bbaea4277e05b1ca.exe
484	86e0267ee6ea6907b2e8521ddf20fa30f50b786b76ca1537bbaea4277e05b1ca.exe
484	86e0267ee6ea6907b2e8521ddf20fa30f50b786b76ca1537bbaea4277e05b1ca.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
484	86e0267ee6ea6907b2e8521ddf20fa30f50b786b76ca1537bbaea4277e05b1ca.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
484	86e0267ee6ea6907b2e8521ddf20fa30f50b786b76ca1537bbaea4277e05b1ca.exe
484	86e0267ee6ea6907b2e8521ddf20fa30f50b786b76ca1537bbaea4277e05b1ca.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 484 wrote to memory of 1944	484	86e0267ee6ea6907b2e8521ddf20fa30f50b786b76ca1537bbaea4277e05b1ca.exe	80
PID 484 wrote to memory of 2344	484	86e0267ee6ea6907b2e8521ddf20fa30f50b786b76ca1537bbaea4277e05b1ca.exe	79
PID 2344 wrote to memory of 2312	2344	WScript.exe	82

C:\Users\Admin\AppData\Local\Temp\86e0267ee6ea6907b2e8521ddf20fa30f50b786b76ca1537bbaea4277e05b1ca.exe
"C:\Users\Admin\AppData\Local\Temp\86e0267ee6ea6907b2e8521ddf20fa30f50b786b76ca1537bbaea4277e05b1ca.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:484
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2344
- - C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2312
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      4⤵
      PID:4596
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      4⤵
      PID:2300
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:1944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Config.ini

Path C:\Users\Admin\AppData\Roaming\Microsoft\Config.ini
Size 92B
SHA256 44063c266686263f14cd2a83fee124fb3e61a9171a6aab69709464f49511011d
MD5 67b9b3e2ded7086f393ebbc36c5e7bca
SHA1 e6299d0450b9a92a18cc23b5704a2b475652c790
SHA512 826fbc9481f46b1ae3db828a665c55c349023caf563e6e8c17321f5f3af3e4c3914955db6f0eebfc6defe561315435d47310b4d0499ab9c2c85bb61264dedc09
MD5 SHA1 SHA512

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 696B
SHA256 99940aede45164365f56d6948655491bf5e5eaf8cc50400fe99620b5d3cd29c8
MD5 f8db619ebe2f315356d8a3c1cb7ce863
SHA1 6a7be253323ec01b077ec2632a10159e39c17b2b
SHA512 6abc38a731254105c4f336ef9954159d7711889c704002838872473450f9077a940b4817cf36ae7fa04f08439a2acb53c9ab37c85e21c2981eab353379bf431a
TLSH
T1FC019900DD4C8258503553B62432A40FF7AA1553A303ACE8B899D0B52F707689CB4A32
MD5 SHA1 SHA512 TLSH

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 753B
SHA256 1761b6795e1909d254f3415a16daedca1843defd2293d0ba5cfc3168c890c2ee
MD5 ffceeddde67aea3fe4b80a991c19259c
SHA1 3f69dfb747b1d85f6e49ce6422b29574db6ca836
SHA512 f3dae66abbc99549dc569ce7e0bd1a20841a4f15f598c7ef04590e8bd2409058004509c05f5a0dd932f5e880003960fbb079130c45bf207bef83451d6982f69e
TLSH
T1F901CB10DD4C862C503653B62472E40AF7EA1593B303ACD9B899D0B52F707589CB8A37
MD5 SHA1 SHA512 TLSH

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.4MB
SHA256 f790f197a376bf098e0e3b450249638ef4ea57f68affecf001b7de6c2951091a
MD5 7d952d38b0524fe10038e49ef61a59dc
SHA1 51c7da9b60f22e98425362a4b7dddbaddf5983a6
SHA512 1674cbdf2f47436141744f65883e83f2262ff4c9af6c89490f1fcc9365f1713bc65ac9537045d805276740064b94587265803e60044f27827b28f7e9863c284a
SSDEEP 24576:GH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5QZ:GcallSllG4ZM7QzMa
TLSH
T1AE658D13F292C0F1E61C227124FB6339BE749B450A71CAC7EB95DD791C32691AB6720E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/484-0-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/484-11-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/484-13-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/484-23-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/2312-36-0x0000000000400000-0x000000000055F000-memory.dmp

Download