flyagent | 171a8cdd0ea86922b9dd2ec3e89601969939fec5d33a53b1448c24fe2a9672ba

Analysis

max time kernel
149s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/05/2026, 06:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
171a8cdd0ea86922b9dd2ec3e89601969939fec5d33a53b1448c24fe2a9672ba.exe
Size 1.1MB
Sample260506-gr57lsa131
SHA256 171a8cdd0ea86922b9dd2ec3e89601969939fec5d33a53b1448c24fe2a9672ba
MD5 000ff26bd4a49c298f5c0c474be2cc43
SHA1 f4d4925ac238d0fb014c4b79f20b8c0ab19cca19
SHA512 0b6e988ec5f61b0df3170aed355378c98deaad6977750ef6d12c36bc5f7dde987edac1c1a019ae3c9b9d3e4bab2d928c6d2208e3df0408cb3c7d34421f3e1b10
SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7QAkiu5xM:acallSllG4ZM7QAMU
TLSH
T150458C13F292C0F1E61C227124FB6339BE749B450A71CAC7EB95DD791C32691AB6720E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery flyagent

Malware Config

Signatures

Family: FlyAgent
FlyAgent is a backdoor written in C++.
backdoor flyagent

Detects FlyAgent Backdoor 2 IoCs

resource	yara_rule
behavioral2/memory/4448-0-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/4448-2-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5652	4448	WerFault.exe	78

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	171a8cdd0ea86922b9dd2ec3e89601969939fec5d33a53b1448c24fe2a9672ba.exe

C:\Users\Admin\AppData\Local\Temp\171a8cdd0ea86922b9dd2ec3e89601969939fec5d33a53b1448c24fe2a9672ba.exe
"C:\Users\Admin\AppData\Local\Temp\171a8cdd0ea86922b9dd2ec3e89601969939fec5d33a53b1448c24fe2a9672ba.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4448
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 592
  2⤵
  - Program crash
  PID:5652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4448 -ip 4448
1⤵
PID:1756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4448-0-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/4448-2-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/4448-1-0x0000000000C00000-0x0000000000E8B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads