flyagent | 767417e46147fc9255098922c33c308ef76563e30640a98e88e63e67e405b4e2

Analysis

max time kernel
149s
max time network
116s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/04/2026, 00:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
767417e46147fc9255098922c33c308ef76563e30640a98e88e63e67e405b4e2.exe
Size 1.1MB
Sample260427-adjccsav81
SHA256 767417e46147fc9255098922c33c308ef76563e30640a98e88e63e67e405b4e2
MD5 f4e438584d80d696b760d442458caff1
SHA1 8dbe4768551a5d593f407a809fd96149dfb5178f
SHA512 1369b04d1354fc24c40ed35673ae1e993ea8dd548fbf1616fe28c27efe3f6c7ae5e3a77245b5b360332c39c5b97aa01a43b84d6d3c1bbb0f37bc25fe4364e5ed
SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Q/:acallSllG4ZM7QzMy
TLSH
T168458D13F292C0F1E61C227124FB6739BE749B450A71CAC7E794DD791C32691ABA720E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery flyagent

Malware Config

Signatures

Family: FlyAgent
FlyAgent is a backdoor written in C++.
backdoor flyagent

Detects FlyAgent Backdoor 12 IoCs

resource	yara_rule
behavioral2/memory/3240-0-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/3240-12-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/3240-14-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/3240-21-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/files/0x001d00000002b22a-22.dat	flyagent
behavioral2/memory/4192-34-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/4192-35-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/files/0x002200000002b2dc-36.dat	flyagent
behavioral2/memory/952-40-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/2516-39-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/952-41-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/2516-45-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent

Deletes itself 1 IoCs

pid	Process
4192	svchcst.exe

Executes dropped EXE 3 IoCs

pid	Process
4192	svchcst.exe
2516	svchcst.exe
952	svchcst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	767417e46147fc9255098922c33c308ef76563e30640a98e88e63e67e405b4e2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings	767417e46147fc9255098922c33c308ef76563e30640a98e88e63e67e405b4e2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings	svchcst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3240	767417e46147fc9255098922c33c308ef76563e30640a98e88e63e67e405b4e2.exe
3240	767417e46147fc9255098922c33c308ef76563e30640a98e88e63e67e405b4e2.exe
3240	767417e46147fc9255098922c33c308ef76563e30640a98e88e63e67e405b4e2.exe
3240	767417e46147fc9255098922c33c308ef76563e30640a98e88e63e67e405b4e2.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe
4192	svchcst.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3240	767417e46147fc9255098922c33c308ef76563e30640a98e88e63e67e405b4e2.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3240	767417e46147fc9255098922c33c308ef76563e30640a98e88e63e67e405b4e2.exe
3240	767417e46147fc9255098922c33c308ef76563e30640a98e88e63e67e405b4e2.exe
4192	svchcst.exe
4192	svchcst.exe
2516	svchcst.exe
2516	svchcst.exe
952	svchcst.exe
952	svchcst.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3240 wrote to memory of 4132	3240	767417e46147fc9255098922c33c308ef76563e30640a98e88e63e67e405b4e2.exe	80
PID 3240 wrote to memory of 2476	3240	767417e46147fc9255098922c33c308ef76563e30640a98e88e63e67e405b4e2.exe	81
PID 4132 wrote to memory of 4192	4132	WScript.exe	83
PID 4192 wrote to memory of 1268	4192	svchcst.exe	84
PID 4192 wrote to memory of 1680	4192	svchcst.exe	85
PID 1268 wrote to memory of 2516	1268	WScript.exe	86
PID 1680 wrote to memory of 952	1680	WScript.exe	87

C:\Users\Admin\AppData\Local\Temp\767417e46147fc9255098922c33c308ef76563e30640a98e88e63e67e405b4e2.exe
"C:\Users\Admin\AppData\Local\Temp\767417e46147fc9255098922c33c308ef76563e30640a98e88e63e67e405b4e2.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3240
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4132
- - C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
    3⤵
    - Deletes itself
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4192
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1268
    - - C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2516
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1680
    - - C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:952
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:2476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Config.ini

Path C:\Users\Admin\AppData\Roaming\Microsoft\Config.ini
Size 92B
SHA256 44063c266686263f14cd2a83fee124fb3e61a9171a6aab69709464f49511011d
MD5 67b9b3e2ded7086f393ebbc36c5e7bca
SHA1 e6299d0450b9a92a18cc23b5704a2b475652c790
SHA512 826fbc9481f46b1ae3db828a665c55c349023caf563e6e8c17321f5f3af3e4c3914955db6f0eebfc6defe561315435d47310b4d0499ab9c2c85bb61264dedc09
MD5 SHA1 SHA512

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 696B
SHA256 f20592c5d5216a153e7d9fc67c87e2d3346f3781014162462e824a5dbc4c7aef
MD5 f262d0722b88145e786399f42047785d
SHA1 9f4426b6ac52bb0456945b0619fcd355d118a0b7
SHA512 da8aa8fd4f84c224f7c6f3fe483b030e2307f3313c003f17f6b9c943f9ea9d052d9d9297f93fdf49428eedd235ef6d7efe0199e1620e55cb052f2ca3cb492eb1
TLSH
T1F8019910DD4CC258503553B62432A44FF7EA1553A303ACE8B899D0B52F70768DDB4A32
MD5 SHA1 SHA512 TLSH

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 753B
SHA256 e3e06f09e89530cb19b93713cb513f4ea481407440f1da3cb1f24e55646aad79
MD5 ff7f68e3d10ea3b0ba623374e6e8c883
SHA1 a0f190de121853ccf638e77ffce66d4bde364991
SHA512 ca3f904a5c6a953ba84b5d75fce8d870372f73d8ae78a46f8c59b97a38134b828c62f7240cfbbcc798b2b766ab87dee41247e00b48fcec7093cdf5308e675479
TLSH
T11501C000DD4C835D603553B65432940EF3EA1553A303ACD97C99D0B12F707588C74E36
MD5 SHA1 SHA512 TLSH

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.1MB
SHA256 41acee932014c0d8ad75c3f5511108beb92187425fa097ec67d733855452efaf
MD5 d541ab3b6dbd7be42f31d1c1ff9265de
SHA1 5d7eb64712482e5edad2038eb3772d2b9c713fd1
SHA512 9c689a25fac7300f241c271f0a59434d30ee0eafde8944fb720e888707ca4d506e8ce33705f01cab43716a8944922dbaa25c549247fd57b8a8393cb4faabc5b4
SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Q6:acallSllG4ZM7QzMH
TLSH
T189458D13F292C0F1E61C227124FB6739BE749B450A71CAC7E794DD791C32691ABA720E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.1MB
SHA256 4a7e0330b5aa03083a5764ca7a1aa07c1e699dd8ccd6359d21f31bdf597ce6f2
MD5 999c0a7cc2333dc9bddd5b92242e3cbb
SHA1 f917343f00fcfde0428ffb93e5c41ae99c554360
SHA512 17e3e9ea54810ff7638badcf0ebc70de2fcb3a000deb1c2e4b4ccdcd4add330b4305f08e7acf446ee1094a5c678589b564e42f214c79499f85fac8093b3dd2f8
SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Q+:acallSllG4ZM7QzMb
TLSH
T18D458D13F292C0F1E61C227124FB6739BE749B450A71CAC7E794DD791C32691ABA720E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/952-40-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/952-41-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/1268-42-0x00000000057C0000-0x0000000005848000-memory.dmp

Download

memory/1268-43-0x0000000005850000-0x000000000586D000-memory.dmp

Download

memory/1268-44-0x0000000005870000-0x000000000587B000-memory.dmp

Download

memory/1680-46-0x0000000004CA0000-0x0000000004D28000-memory.dmp

Download

memory/1680-47-0x0000000004D30000-0x0000000004D4D000-memory.dmp

Download

memory/1680-48-0x0000000004D50000-0x0000000004D5B000-memory.dmp

Download

memory/2516-39-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/2516-45-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/3240-12-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/3240-14-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/3240-21-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/3240-0-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/4192-34-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/4192-35-0x0000000000400000-0x000000000055F000-memory.dmp

Download