flyagent | 7b75c820e88e604a28bda151ea53067e3dab6ca9347ac608e4ea477d7ecd332f

Analysis

max time kernel
117s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/04/2026, 10:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7b75c820e88e604a28bda151ea53067e3dab6ca9347ac608e4ea477d7ecd332f.exe
Size 1.4MB
Sample260428-mpff3ab13l
SHA256 7b75c820e88e604a28bda151ea53067e3dab6ca9347ac608e4ea477d7ecd332f
MD5 61ea47f46729c102ef97ec508ebea1b7
SHA1 6d0e00ffa8305d756983f29ba807c810982a6895
SHA512 f0f2d56327534caba2e25ea9fc211236905b91b8d111fc755e07fa3ed5954d348edab4a65473034508918ad89a33f42578c61b37a5b38aa70cd7b08d71de79d8
SSDEEP 24576:GH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Qq:GcallSllG4ZM7QzMZ
TLSH
T199658D13F292C0F1E61C227124FB6339BE749B450A71CAC7EB95DD791C32691AB6720E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery flyagent

Malware Config

Signatures

Family: FlyAgent
FlyAgent is a backdoor written in C++.
backdoor flyagent

Detects FlyAgent Backdoor 2 IoCs

resource	yara_rule
behavioral1/memory/4408-0-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral1/memory/4408-11-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Control Panel\International\Geo\Nation	7b75c820e88e604a28bda151ea53067e3dab6ca9347ac608e4ea477d7ecd332f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7b75c820e88e604a28bda151ea53067e3dab6ca9347ac608e4ea477d7ecd332f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings	7b75c820e88e604a28bda151ea53067e3dab6ca9347ac608e4ea477d7ecd332f.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4408	7b75c820e88e604a28bda151ea53067e3dab6ca9347ac608e4ea477d7ecd332f.exe
4408	7b75c820e88e604a28bda151ea53067e3dab6ca9347ac608e4ea477d7ecd332f.exe
4408	7b75c820e88e604a28bda151ea53067e3dab6ca9347ac608e4ea477d7ecd332f.exe
4408	7b75c820e88e604a28bda151ea53067e3dab6ca9347ac608e4ea477d7ecd332f.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4408	7b75c820e88e604a28bda151ea53067e3dab6ca9347ac608e4ea477d7ecd332f.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4408	7b75c820e88e604a28bda151ea53067e3dab6ca9347ac608e4ea477d7ecd332f.exe
4408	7b75c820e88e604a28bda151ea53067e3dab6ca9347ac608e4ea477d7ecd332f.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4408 wrote to memory of 1612	4408	7b75c820e88e604a28bda151ea53067e3dab6ca9347ac608e4ea477d7ecd332f.exe	83
PID 4408 wrote to memory of 1120	4408	7b75c820e88e604a28bda151ea53067e3dab6ca9347ac608e4ea477d7ecd332f.exe	84

C:\Users\Admin\AppData\Local\Temp\7b75c820e88e604a28bda151ea53067e3dab6ca9347ac608e4ea477d7ecd332f.exe
"C:\Users\Admin\AppData\Local\Temp\7b75c820e88e604a28bda151ea53067e3dab6ca9347ac608e4ea477d7ecd332f.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1612
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 753B
SHA256 76afa5b70084238237d6b761b3cb5e45aac68862f3386b92f32774ddf5d87481
MD5 853750d9c30b2e7f93dfec9e823cf785
SHA1 57445119cf782bc1d3cc81d83436327a30db7139
SHA512 c7c9cecb93d4f9d643ec5dcbc4564cedb1612257358b28a8ef81baee86a567b8469ce33215f60ec7e797d7c3bc4e1b769dc0ecd9a4232098a5125e9db6e71145
TLSH
T1ED01C001DD4C825D507593752532D40BF7EA15236303ACD8B959D1B12F707A89D75A33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1120-14-0x00000000018C0000-0x000000000191F000-memory.dmp

Download

memory/1612-13-0x0000000000190000-0x00000000001EF000-memory.dmp

Download

memory/4408-0-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/4408-11-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/4408-12-0x00000000023F0000-0x000000000244F000-memory.dmp

Download