Analysis
- max time kernel
112s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
28/04/2026, 14:20
General
- Target 7bdab5bc5bb41546562e415da9e82b49351cbcacec400fbab03852e39204e92c.exe
- Size 1.4MB
- Sample260428-rntphsaw7z
- SHA256 7bdab5bc5bb41546562e415da9e82b49351cbcacec400fbab03852e39204e92c
Malware Config
Signatures
- Family: FlyAgent
FlyAgent is a backdoor written in C++.
- Detects FlyAgent Backdoor 17 IoCs
- Deletes itself 1 IoCs
- Executes dropped EXE 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 7 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7bdab5bc5bb41546562e415da9e82b49351cbcacec400fbab03852e39204e92c.exe"C:\Users\Admin\AppData\Local\Temp\7bdab5bc5bb41546562e415da9e82b49351cbcacec400fbab03852e39204e92c.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"4⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"4⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"6⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"7⤵
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"6⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"7⤵
-
-
-
-
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Config.ini
VBS3.vbs
VBS3.vbs
VBS3.vbs
svchcst.exe
svchcst.exe
svchcst.exe
memory/400-103-0x0000000005150000-0x000000000552E000-memory.dmp
memory/400-102-0x00000000056E0000-0x0000000005768000-memory.dmp
memory/400-82-0x0000000002C30000-0x0000000002C94000-memory.dmp
memory/1464-13-0x0000000002200000-0x0000000002264000-memory.dmp
memory/1772-60-0x0000000000400000-0x000000000055F000-memory.dmp
memory/1772-45-0x0000000002380000-0x00000000023E4000-memory.dmp
memory/1772-46-0x0000000000400000-0x000000000055F000-memory.dmp
memory/1772-59-0x0000000002380000-0x00000000023E4000-memory.dmp
memory/1772-32-0x0000000000400000-0x000000000055F000-memory.dmp
memory/2892-104-0x0000000002380000-0x00000000023E4000-memory.dmp
memory/2892-105-0x0000000000400000-0x000000000055F000-memory.dmp
memory/2892-95-0x0000000000400000-0x000000000055F000-memory.dmp
memory/3152-28-0x00000000024D0000-0x0000000002534000-memory.dmp
memory/3152-0-0x0000000000400000-0x000000000055F000-memory.dmp
memory/3152-15-0x0000000000400000-0x000000000055F000-memory.dmp
memory/3152-29-0x0000000000400000-0x000000000055F000-memory.dmp
memory/3152-12-0x00000000024D0000-0x0000000002534000-memory.dmp
memory/3152-11-0x0000000000400000-0x000000000055F000-memory.dmp
memory/3388-69-0x0000000005470000-0x00000000054F8000-memory.dmp
memory/3388-48-0x00000000029B0000-0x0000000002A14000-memory.dmp
memory/4148-65-0x0000000000400000-0x000000000055F000-memory.dmp
memory/4148-79-0x00000000021D0000-0x0000000002234000-memory.dmp
memory/4148-89-0x00000000021D0000-0x0000000002234000-memory.dmp
memory/4148-90-0x0000000000400000-0x000000000055F000-memory.dmp
memory/4148-80-0x0000000000400000-0x000000000055F000-memory.dmp
memory/4740-99-0x00000000075D0000-0x00000000079AE000-memory.dmp
memory/4740-81-0x0000000003000000-0x0000000003064000-memory.dmp
memory/4740-98-0x0000000005C10000-0x0000000005C98000-memory.dmp
memory/4756-67-0x0000000004E10000-0x0000000004E98000-memory.dmp
memory/4756-47-0x0000000000910000-0x0000000000974000-memory.dmp
memory/4780-14-0x0000000000B60000-0x0000000000BC4000-memory.dmp
memory/4820-100-0x0000000000400000-0x000000000055F000-memory.dmp
memory/4820-94-0x0000000000400000-0x000000000055F000-memory.dmp
memory/4820-97-0x0000000000AC0000-0x0000000000B24000-memory.dmp