flyagent | 6df9b6c1b80c591242afafc6cf6a6a214e07e4cf91fcc670a2f5e9a7655d3c2e

Analysis

max time kernel
149s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/05/2026, 11:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6df9b6c1b80c591242afafc6cf6a6a214e07e4cf91fcc670a2f5e9a7655d3c2e.exe
Size 1.4MB
Sample260501-m4wrlaey21
SHA256 6df9b6c1b80c591242afafc6cf6a6a214e07e4cf91fcc670a2f5e9a7655d3c2e
MD5 3b61ae6fececccc4f74e21dbcaaa015a
SHA1 96edbaec8e9b84e4d85364196d18c82a32130167
SHA512 6574551dbdc00b51469ae4f0ea8e6a1b2f6c082a54a1e70727b143b6ddfd94e0d219d9a3696b23d686c9755e4f9dd30b49df2755044657d2bad66dd9f2dbce97
SSDEEP 24576:GH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Qj:GcallSllG4ZM7QzME
TLSH
T14A658D13F292C0F1E61C227124FB6339BE749B450A71CAC7EB95DD791C32691AB6720E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery flyagent

Malware Config

Signatures

Family: FlyAgent
FlyAgent is a backdoor written in C++.
backdoor flyagent

Detects FlyAgent Backdoor 7 IoCs

resource	yara_rule
behavioral2/memory/2956-0-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/2956-12-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/2956-20-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/files/0x000400000002a765-21.dat	flyagent
behavioral2/memory/5180-24-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/5180-25-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/2424-26-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent

Deletes itself 1 IoCs

pid	Process
2424	svchcst.exe

Executes dropped EXE 2 IoCs

pid	Process
2424	svchcst.exe
5180	svchcst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6df9b6c1b80c591242afafc6cf6a6a214e07e4cf91fcc670a2f5e9a7655d3c2e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\Local Settings	6df9b6c1b80c591242afafc6cf6a6a214e07e4cf91fcc670a2f5e9a7655d3c2e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2956	6df9b6c1b80c591242afafc6cf6a6a214e07e4cf91fcc670a2f5e9a7655d3c2e.exe
2956	6df9b6c1b80c591242afafc6cf6a6a214e07e4cf91fcc670a2f5e9a7655d3c2e.exe
2956	6df9b6c1b80c591242afafc6cf6a6a214e07e4cf91fcc670a2f5e9a7655d3c2e.exe
2956	6df9b6c1b80c591242afafc6cf6a6a214e07e4cf91fcc670a2f5e9a7655d3c2e.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe
2424	svchcst.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2956	6df9b6c1b80c591242afafc6cf6a6a214e07e4cf91fcc670a2f5e9a7655d3c2e.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2956	6df9b6c1b80c591242afafc6cf6a6a214e07e4cf91fcc670a2f5e9a7655d3c2e.exe
2956	6df9b6c1b80c591242afafc6cf6a6a214e07e4cf91fcc670a2f5e9a7655d3c2e.exe
2424	svchcst.exe
2424	svchcst.exe
5180	svchcst.exe
5180	svchcst.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 5100	2956	6df9b6c1b80c591242afafc6cf6a6a214e07e4cf91fcc670a2f5e9a7655d3c2e.exe	80
PID 2956 wrote to memory of 5068	2956	6df9b6c1b80c591242afafc6cf6a6a214e07e4cf91fcc670a2f5e9a7655d3c2e.exe	79
PID 5068 wrote to memory of 2424	5068	WScript.exe	82
PID 5100 wrote to memory of 5180	5100	WScript.exe	83

C:\Users\Admin\AppData\Local\Temp\6df9b6c1b80c591242afafc6cf6a6a214e07e4cf91fcc670a2f5e9a7655d3c2e.exe
"C:\Users\Admin\AppData\Local\Temp\6df9b6c1b80c591242afafc6cf6a6a214e07e4cf91fcc670a2f5e9a7655d3c2e.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5068
- - C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
    3⤵
    - Deletes itself
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2424
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5100
- - C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 753B
SHA256 a5fb4f45955c5958c03f5dcb4303b630e8e18c332ca2fa9ad1777eee0f7fe467
MD5 8ea0f01abbc127570c80c76b0233fb02
SHA1 1286f3e2eefbb8ad98f4ba14d48a5dec63466f4b
SHA512 d08145e61f8a88475ea6ec2647fb52903e964169b85b4c14a0b9e1305371369e758ddef4468c265f49df7a94d82f9e7913a9f51ed337a1f84c4eaab85d0115c7
TLSH
T10901FE10EE4CC329513557B66573A40EF7EA2553A303ACD8B859D0A13F707AC8CB4A33
MD5 SHA1 SHA512 TLSH

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.4MB
SHA256 a1665924cc4203a7dd9dc26b7e36221d18d82f036b3b59ee97525ee4e1e9ca79
MD5 e1ff6e6e889e60e4977db06066700539
SHA1 1202354eed3e7d4aed694144d538ae8da5592790
SHA512 7ddd5648bc43da7d43767622133f348b8b704901fa27a15999b7ab55ca5d2c4431683a3983b61e73753545620f80a4f98c9ad8703ceaa22e6a0412a4bb652e3e
SSDEEP 24576:GH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Q+:GcallSllG4ZM7QzMF
TLSH
T115658D13F292C0F1E61C227124FB6339BE749B450A71CAC7EB95DD791C32691AB6720E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2424-26-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/2956-0-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/2956-12-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/2956-20-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/5180-24-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/5180-25-0x0000000000400000-0x000000000055F000-memory.dmp

Download