Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
29/04/2026, 10:02
General
- Target b70d1b30552e0cdf9d45b6812efd22336218fa785a369c72153f6f4e77677b65.exe
- Size 1.4MB
- Sample260429-l2whdaev4m
- SHA256 b70d1b30552e0cdf9d45b6812efd22336218fa785a369c72153f6f4e77677b65
Malware Config
Signatures
- Family: FlyAgent
FlyAgent is a backdoor written in C++.
- Detects FlyAgent Backdoor 13 IoCs
- Deletes itself 1 IoCs
- Executes dropped EXE 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 8 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b70d1b30552e0cdf9d45b6812efd22336218fa785a369c72153f6f4e77677b65.exe"C:\Users\Admin\AppData\Local\Temp\b70d1b30552e0cdf9d45b6812efd22336218fa785a369c72153f6f4e77677b65.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"4⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"4⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"6⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"6⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Config.ini
VBS3.vbs
VBS3.vbs
VBS3.vbs
svchcst.exe
svchcst.exe
svchcst.exe
memory/236-73-0x0000000002380000-0x000000000245A000-memory.dmp
memory/236-74-0x0000000000400000-0x000000000055F000-memory.dmp
memory/848-9-0x0000000000400000-0x000000000055F000-memory.dmp
memory/848-20-0x0000000000400000-0x000000000055F000-memory.dmp
memory/848-0-0x0000000000400000-0x000000000055F000-memory.dmp
memory/848-19-0x0000000002390000-0x000000000246A000-memory.dmp
memory/848-10-0x0000000002390000-0x000000000246A000-memory.dmp
memory/888-34-0x0000000002450000-0x000000000252A000-memory.dmp
memory/888-35-0x0000000000400000-0x000000000055F000-memory.dmp
memory/888-45-0x0000000000400000-0x000000000055F000-memory.dmp
memory/888-44-0x0000000002450000-0x000000000252A000-memory.dmp
memory/1856-11-0x00000000027E0000-0x00000000028BA000-memory.dmp
memory/1956-64-0x00000000028D0000-0x00000000029AA000-memory.dmp
memory/1956-76-0x0000000005070000-0x00000000050F8000-memory.dmp
memory/2916-36-0x0000000002EE0000-0x0000000002FBA000-memory.dmp
memory/2916-49-0x0000000005580000-0x00000000055E8000-memory.dmp
memory/3060-63-0x00000000027A0000-0x000000000287A000-memory.dmp
memory/3060-72-0x0000000004660000-0x00000000046E8000-memory.dmp
memory/3268-51-0x00000000056E0000-0x0000000005748000-memory.dmp
memory/3268-37-0x0000000003060000-0x000000000313A000-memory.dmp
memory/4912-69-0x0000000000400000-0x000000000055F000-memory.dmp
memory/4912-77-0x0000000002450000-0x000000000252A000-memory.dmp
memory/4912-78-0x0000000000400000-0x000000000055F000-memory.dmp
memory/4972-61-0x00000000023A0000-0x000000000247A000-memory.dmp
memory/4972-62-0x0000000000400000-0x000000000055F000-memory.dmp
memory/4972-66-0x0000000000400000-0x000000000055F000-memory.dmp
memory/4972-65-0x00000000023A0000-0x000000000247A000-memory.dmp