Analysis
- max time kernel
116s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
26/04/2026, 03:20
General
- Target 27f00cd0add3c1cc9beee47c86c3f835e58bce92fd89123927c83760861f5720.exe
- Size 1.1MB
- Sample260426-dvtffacx5v
- SHA256 27f00cd0add3c1cc9beee47c86c3f835e58bce92fd89123927c83760861f5720
Malware Config
Signatures
- Family: FlyAgent
FlyAgent is a backdoor written in C++.
- Detects FlyAgent Backdoor 15 IoCs
- Deletes itself 1 IoCs
- Executes dropped EXE 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 5 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\27f00cd0add3c1cc9beee47c86c3f835e58bce92fd89123927c83760861f5720.exe"C:\Users\Admin\AppData\Local\Temp\27f00cd0add3c1cc9beee47c86c3f835e58bce92fd89123927c83760861f5720.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"4⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"6⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"7⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"8⤵
-
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"6⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"7⤵
-
-
-
-
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Config.ini
VBS3.vbs
VBS3.vbs
VBS3.vbs
VBS3.vbs
svchcst.exe
svchcst.exe
svchcst.exe
svchcst.exe
memory/396-14-0x0000000000DE0000-0x0000000000E44000-memory.dmp
memory/1324-87-0x00000000023B0000-0x0000000002414000-memory.dmp
memory/1324-64-0x00000000023B0000-0x0000000002414000-memory.dmp
memory/1324-88-0x0000000000400000-0x000000000055F000-memory.dmp
memory/1324-65-0x0000000000400000-0x000000000055F000-memory.dmp
memory/1324-50-0x0000000000400000-0x000000000055F000-memory.dmp
memory/2000-92-0x00000000051C0000-0x0000000005228000-memory.dmp
memory/2000-66-0x00000000025F0000-0x0000000002654000-memory.dmp
memory/2000-93-0x0000000005230000-0x000000000524D000-memory.dmp
memory/2000-94-0x0000000004820000-0x00000000049C2000-memory.dmp
memory/3068-111-0x0000000000400000-0x000000000055F000-memory.dmp
memory/3400-13-0x0000000002BE0000-0x0000000002C44000-memory.dmp
memory/3632-11-0x0000000000400000-0x000000000055F000-memory.dmp
memory/3632-12-0x0000000002480000-0x00000000024E4000-memory.dmp
memory/3632-21-0x0000000000400000-0x000000000055F000-memory.dmp
memory/3632-0-0x0000000000400000-0x000000000055F000-memory.dmp
memory/3632-20-0x0000000002480000-0x00000000024E4000-memory.dmp
memory/3964-109-0x0000000005540000-0x000000000555D000-memory.dmp
memory/3964-110-0x0000000004B30000-0x0000000004CD2000-memory.dmp
memory/3964-67-0x00000000028F0000-0x0000000002954000-memory.dmp
memory/3964-108-0x00000000054D0000-0x0000000005538000-memory.dmp
memory/4048-36-0x0000000000C00000-0x0000000000C64000-memory.dmp
memory/4048-37-0x0000000000400000-0x000000000055F000-memory.dmp
memory/4048-46-0x0000000000C00000-0x0000000000C64000-memory.dmp
memory/4048-47-0x0000000000400000-0x000000000055F000-memory.dmp
memory/4128-38-0x0000000000A50000-0x0000000000AB4000-memory.dmp
memory/4820-103-0x0000000000400000-0x000000000055F000-memory.dmp
memory/4820-104-0x0000000002250000-0x00000000022B4000-memory.dmp
memory/4820-106-0x0000000000400000-0x000000000055F000-memory.dmp
memory/4896-39-0x00000000030A0000-0x0000000003104000-memory.dmp
memory/4896-53-0x0000000005B70000-0x0000000005BD8000-memory.dmp
memory/4896-54-0x0000000005BE0000-0x0000000005BFD000-memory.dmp