flyagent | 833b5377c74e28b1cdf64a9572dac14fd6ff3c15aed6928d9722d36a71ce9aed

Analysis

max time kernel
149s
max time network
99s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/04/2026, 08:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
833b5377c74e28b1cdf64a9572dac14fd6ff3c15aed6928d9722d36a71ce9aed.exe
Size 1.1MB
Sample260427-kjvyfsey7x
SHA256 833b5377c74e28b1cdf64a9572dac14fd6ff3c15aed6928d9722d36a71ce9aed
MD5 2a144f37be4c4eb21ffcca2bd7f742c3
SHA1 a09fc907c932fc76ea1d752d32302c41a7a97323
SHA512 b84d004bebaac74ee4feff8a5433d3ec0e6766964ef8e8e373280d0b47608d96774c3bd2bbf9d84737e7a4bf8522c16245e608a30ef08e068369c129555ee334
SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5QA:acallSllG4ZM7QzMp
TLSH
T18B458D13F292C0F1E61C227124FB6739BE749B450A71CAC7EB94DD791C32691AB6720E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery flyagent

Malware Config

Signatures

Family: FlyAgent
FlyAgent is a backdoor written in C++.
backdoor flyagent

Detects FlyAgent Backdoor 13 IoCs

resource	yara_rule
behavioral2/memory/4436-0-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/4436-11-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/4436-15-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/files/0x002b00000002b1d7-17.dat	flyagent
behavioral2/memory/1912-32-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/1912-48-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/files/0x001f00000002b36d-49.dat	flyagent
behavioral2/memory/2344-51-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/files/0x002c00000002b1d7-55.dat	flyagent
behavioral2/memory/2344-65-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/988-69-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/4872-73-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/988-77-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent

Deletes itself 1 IoCs

pid	Process
1912	svchcst.exe

Executes dropped EXE 4 IoCs

pid	Process
1912	svchcst.exe
2344	svchcst.exe
988	svchcst.exe
4872	svchcst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	833b5377c74e28b1cdf64a9572dac14fd6ff3c15aed6928d9722d36a71ce9aed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings	833b5377c74e28b1cdf64a9572dac14fd6ff3c15aed6928d9722d36a71ce9aed.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings	svchcst.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings	svchcst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4436	833b5377c74e28b1cdf64a9572dac14fd6ff3c15aed6928d9722d36a71ce9aed.exe
4436	833b5377c74e28b1cdf64a9572dac14fd6ff3c15aed6928d9722d36a71ce9aed.exe
4436	833b5377c74e28b1cdf64a9572dac14fd6ff3c15aed6928d9722d36a71ce9aed.exe
4436	833b5377c74e28b1cdf64a9572dac14fd6ff3c15aed6928d9722d36a71ce9aed.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe
1912	svchcst.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4436	833b5377c74e28b1cdf64a9572dac14fd6ff3c15aed6928d9722d36a71ce9aed.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
4436	833b5377c74e28b1cdf64a9572dac14fd6ff3c15aed6928d9722d36a71ce9aed.exe
4436	833b5377c74e28b1cdf64a9572dac14fd6ff3c15aed6928d9722d36a71ce9aed.exe
1912	svchcst.exe
1912	svchcst.exe
2344	svchcst.exe
2344	svchcst.exe
988	svchcst.exe
988	svchcst.exe
4872	svchcst.exe
4872	svchcst.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 4392	4436	833b5377c74e28b1cdf64a9572dac14fd6ff3c15aed6928d9722d36a71ce9aed.exe	81
PID 4436 wrote to memory of 4476	4436	833b5377c74e28b1cdf64a9572dac14fd6ff3c15aed6928d9722d36a71ce9aed.exe	80
PID 4476 wrote to memory of 1912	4476	WScript.exe	83
PID 1912 wrote to memory of 2560	1912	svchcst.exe	84
PID 1912 wrote to memory of 3164	1912	svchcst.exe	85
PID 3164 wrote to memory of 2344	3164	WScript.exe	86
PID 2344 wrote to memory of 3408	2344	svchcst.exe	87
PID 2344 wrote to memory of 4956	2344	svchcst.exe	88
PID 4956 wrote to memory of 988	4956	WScript.exe	89
PID 3408 wrote to memory of 4872	3408	WScript.exe	90

C:\Users\Admin\AppData\Local\Temp\833b5377c74e28b1cdf64a9572dac14fd6ff3c15aed6928d9722d36a71ce9aed.exe
"C:\Users\Admin\AppData\Local\Temp\833b5377c74e28b1cdf64a9572dac14fd6ff3c15aed6928d9722d36a71ce9aed.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4476
- - C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
    3⤵
    - Deletes itself
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1912
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2560
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3164
    - - C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2344
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        6⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3408
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4872
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        6⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4956
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:988
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:4392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Config.ini

Path C:\Users\Admin\AppData\Roaming\Microsoft\Config.ini
Size 92B
SHA256 44063c266686263f14cd2a83fee124fb3e61a9171a6aab69709464f49511011d
MD5 67b9b3e2ded7086f393ebbc36c5e7bca
SHA1 e6299d0450b9a92a18cc23b5704a2b475652c790
SHA512 826fbc9481f46b1ae3db828a665c55c349023caf563e6e8c17321f5f3af3e4c3914955db6f0eebfc6defe561315435d47310b4d0499ab9c2c85bb61264dedc09
MD5 SHA1 SHA512

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 696B
SHA256 ecfe1904a389f25b460a8eec64349498fde06733fa12cd5ae8e0c49a9699154f
MD5 99c82369839776d3d954a85361e76565
SHA1 fe01d71a20a80f468e5fa4df991eacca97e650a1
SHA512 5deb6fd1534298cbc80f4653e60b9dcaba6cfd4af1f3b1e5369929472ab4f8cba7d50d3f63d7154170b5ea84f40f7511f1839f2e89340c6942fede255c93b69f
TLSH
T15B019900DD4C8258503553B62432A40FF7AA1553A303ACE8B899D0A52F707689CB4A36
MD5 SHA1 SHA512 TLSH

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 696B
SHA256 205412cd3d890bd070295ebf41e4a831de855a2b755c1a583b4dd2df66d5bc81
MD5 95cbcc068b61f14455af7f3daea5c57f
SHA1 7121bec25241666a150cd1a58eb7efb0b26eab96
SHA512 5ae57031bb2ce71bf93c683f07f82b521918ef8a145a80f8e488e403d7ca97079cb305bb3f9ad93f2b3a99f44954063447a5f9a2c0f6f276a2ef84beff5674a7
TLSH
T1C1019400DD4CC26C603953B62432A40FF7AA2553A303ACE8B899D0B52FB07689DB4A32
MD5 SHA1 SHA512 TLSH

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 753B
SHA256 2551c769a7ca889f055f395e0ebbc7e457153d1b7f36187b4890513356d65bd8
MD5 42f21ae57839156ac8b69718fc8c62a4
SHA1 da8662505ed951f1b3208fd6a6d9510b585c41f4
SHA512 e3ccea2f1f880ab2fedde89e29c80d6c6c187ddfab1586599026ea40e5b759757cbe06821d29987089476f9dfefe81f2bee3e8ffd617f3952b389ead2ffb0083
TLSH
T13D011B10DD6C825D903917B22132E40BF7AA1503A303ACD8B889D0613F707689CB4A3B
MD5 SHA1 SHA512 TLSH

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.1MB
SHA256 ed6c4e24acad89e778f137d2a29ad3cce83a2d60f944e2cb890edf3c8cd772c1
MD5 6e89599ff1874f77f40905f8c6662c52
SHA1 3798010d2cfd295ad85e9b421c2deca61870b983
SHA512 0fb05604bc9f5dfc6e9cd83ecf5fc71b6abf52920fa8c597ba5c54a5a92f755496dff4614d37c23dcdffae1b1494766fb8633f3aa9fc897c5927bf583d5c83a2
SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Q5:acallSllG4ZM7QzMw
TLSH
T1E9458D13F292C0F1E61C227124FB6739BE749B450A71CAC7EB94DD791C32691AB6720E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.1MB
SHA256 46d9c0f3443e69ef0df9f9b6c5ab05928a17c565c287f0608a718020a461907a
MD5 9c627a1dad9f55b07528ca1d472bc476
SHA1 a024f6ec738d2217c32825aa9e864df3ecde1f9f
SHA512 f5e7b4aade686da0afacec5b17c6fa85bd82ea305b7bc80e573282fc0605d0bd6439f158a76f55a7e4eb9dec15dbc3c7dd10ffac9df6ec6f2e5caa6c5205b6a7
SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Qw:acallSllG4ZM7QzMp
TLSH
T187458D13F292C0F1E61C227124FB6739BE749B450A71CAC7EB94DD791C32691AB6720E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.1MB
SHA256 f2e0d62dedb26a19da5661c0af667ecab5141e7d55c766a576ff5b0dba213ad6
MD5 4b4b3175536da16469e785c81c60b725
SHA1 e160b7f0cbe099ac0f9615338b466f1fe044a065
SHA512 0279c6e072ca34249fd58c1e56c589631f8cfb3ce929130d1d953fa201aaf156a4008b72290d815c8442da2cb841c382d02a3be86f2b398cbc6b2e7f9de25ec3
SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Qo:acallSllG4ZM7QzMR
TLSH
T1F0458D13F292C0F1E61C227124FB6739BE749B450A71CAC7EB94DD791C32691AB6720E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/988-69-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/988-76-0x0000000000990000-0x0000000000A0B000-memory.dmp

Download

memory/988-77-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/1912-32-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/1912-31-0x0000000000AD0000-0x0000000000B4B000-memory.dmp

Download

memory/1912-47-0x0000000000AD0000-0x0000000000B4B000-memory.dmp

Download

memory/1912-48-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/2344-65-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/2344-51-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/2344-64-0x00000000009D0000-0x0000000000A4B000-memory.dmp

Download

memory/2560-33-0x00000000010A0000-0x0000000001104000-memory.dmp

Download

memory/3164-34-0x0000000001540000-0x00000000015A4000-memory.dmp

Download

memory/3164-53-0x0000000005B10000-0x0000000005B98000-memory.dmp

Download

memory/3408-71-0x00000000053D0000-0x0000000005438000-memory.dmp

Download

memory/3408-70-0x0000000000E80000-0x0000000000EE4000-memory.dmp

Download

memory/4392-14-0x0000000002C00000-0x0000000002C64000-memory.dmp

Download

memory/4436-12-0x0000000000C00000-0x0000000000C7B000-memory.dmp

Download

memory/4436-0-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/4436-11-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/4436-16-0x0000000000C00000-0x0000000000C7B000-memory.dmp

Download

memory/4436-15-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/4476-13-0x0000000002D80000-0x0000000002DE4000-memory.dmp

Download

memory/4872-73-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/4872-72-0x0000000000990000-0x0000000000A0B000-memory.dmp

Download

memory/4956-75-0x0000000004E60000-0x0000000004EC8000-memory.dmp

Download

memory/4956-74-0x0000000000780000-0x00000000007E4000-memory.dmp

Download