flyagent | 6df9b6c1b80c591242afafc6cf6a6a214e07e4cf91fcc670a2f5e9a7655d3c2e

Analysis

max time kernel
132s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/05/2026, 11:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6df9b6c1b80c591242afafc6cf6a6a214e07e4cf91fcc670a2f5e9a7655d3c2e.exe
Size 1.4MB
Sample260501-m4wrlaey21
SHA256 6df9b6c1b80c591242afafc6cf6a6a214e07e4cf91fcc670a2f5e9a7655d3c2e
MD5 3b61ae6fececccc4f74e21dbcaaa015a
SHA1 96edbaec8e9b84e4d85364196d18c82a32130167
SHA512 6574551dbdc00b51469ae4f0ea8e6a1b2f6c082a54a1e70727b143b6ddfd94e0d219d9a3696b23d686c9755e4f9dd30b49df2755044657d2bad66dd9f2dbce97
SSDEEP 24576:GH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Qj:GcallSllG4ZM7QzME
TLSH
T14A658D13F292C0F1E61C227124FB6339BE749B450A71CAC7EB95DD791C32691AB6720E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery flyagent

Malware Config

Signatures

Family: FlyAgent
FlyAgent is a backdoor written in C++.
backdoor flyagent

Detects FlyAgent Backdoor 3 IoCs

resource	yara_rule
behavioral1/memory/4688-0-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral1/memory/4688-12-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral1/memory/4688-11-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Control Panel\International\Geo\Nation	6df9b6c1b80c591242afafc6cf6a6a214e07e4cf91fcc670a2f5e9a7655d3c2e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6df9b6c1b80c591242afafc6cf6a6a214e07e4cf91fcc670a2f5e9a7655d3c2e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings	6df9b6c1b80c591242afafc6cf6a6a214e07e4cf91fcc670a2f5e9a7655d3c2e.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4688	6df9b6c1b80c591242afafc6cf6a6a214e07e4cf91fcc670a2f5e9a7655d3c2e.exe
4688	6df9b6c1b80c591242afafc6cf6a6a214e07e4cf91fcc670a2f5e9a7655d3c2e.exe
4688	6df9b6c1b80c591242afafc6cf6a6a214e07e4cf91fcc670a2f5e9a7655d3c2e.exe
4688	6df9b6c1b80c591242afafc6cf6a6a214e07e4cf91fcc670a2f5e9a7655d3c2e.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4688	6df9b6c1b80c591242afafc6cf6a6a214e07e4cf91fcc670a2f5e9a7655d3c2e.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4688	6df9b6c1b80c591242afafc6cf6a6a214e07e4cf91fcc670a2f5e9a7655d3c2e.exe
4688	6df9b6c1b80c591242afafc6cf6a6a214e07e4cf91fcc670a2f5e9a7655d3c2e.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 5820	4688	6df9b6c1b80c591242afafc6cf6a6a214e07e4cf91fcc670a2f5e9a7655d3c2e.exe	84
PID 4688 wrote to memory of 4404	4688	6df9b6c1b80c591242afafc6cf6a6a214e07e4cf91fcc670a2f5e9a7655d3c2e.exe	85

C:\Users\Admin\AppData\Local\Temp\6df9b6c1b80c591242afafc6cf6a6a214e07e4cf91fcc670a2f5e9a7655d3c2e.exe
"C:\Users\Admin\AppData\Local\Temp\6df9b6c1b80c591242afafc6cf6a6a214e07e4cf91fcc670a2f5e9a7655d3c2e.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5820
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 753B
SHA256 863bf0be1fe50a8106f77f96305909902b24f13a3c9fe6aa59e89ff67d58ce20
MD5 e4d442bf846ef7daf5e2e97eba986620
SHA1 7324febcadce75d3eac3ae7146356373159dc630
SHA512 cb026be8b762a4ad8dba06a286ae5d85e2bfbf247cb647ef32a0624e6852725661ef56a52d264e36e4a14f804a9b03330823eb930c3ea8c10b9305d3185b96df
TLSH
T16C01CB10DE4CC22A613457B66972E40EF7EA2553A303ACD8B859D4A12F707A88CB4A33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4688-0-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/4688-12-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/4688-11-0x0000000000400000-0x000000000055F000-memory.dmp

Download