flyagent | afc48d7f77259ae257bad9ae2ec0939c1c09c20e018406cac4e934ca7717099b

Analysis

max time kernel
133s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/05/2026, 07:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
afc48d7f77259ae257bad9ae2ec0939c1c09c20e018406cac4e934ca7717099b.exe
Size 1.4MB
Sample260507-jndpasds4r
SHA256 afc48d7f77259ae257bad9ae2ec0939c1c09c20e018406cac4e934ca7717099b
MD5 086cddd7f5818f2b6e19cbf14bf56214
SHA1 b339c23b4d5d47ccf37f029535a728d2d8dec93a
SHA512 a8bd2aa165d468e5cc5700f27f980b8a97b285d4b9f1bf3b58aef8b4b97657f22f04b469ec498f9c7375ea5786fa4201d621bc751369ef7c59b7e1bc862fee15
SSDEEP 24576:GH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5QX:GcallSllG4ZM7QzMg
TLSH
T1CF658D13F292C0F1E61C227124FB6339BE749B450A71CAC7EB95DD791C32691AB6720E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery flyagent

Malware Config

Signatures

Family: FlyAgent
FlyAgent is a backdoor written in C++.
backdoor flyagent

Detects FlyAgent Backdoor 11 IoCs

resource	yara_rule
behavioral2/memory/2832-0-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/2832-9-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/2832-28-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/files/0x000500000000d444-29.dat	flyagent
behavioral2/memory/3284-42-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/files/0x000500000000d45c-43.dat	flyagent
behavioral2/memory/2868-45-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/files/0x000600000000d444-49.dat	flyagent
behavioral2/memory/2868-59-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/2868-61-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/2500-76-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent

Deletes itself 1 IoCs

pid	Process
3284	svchcst.exe

Executes dropped EXE 3 IoCs

pid	Process
3284	svchcst.exe
2868	svchcst.exe
2500	svchcst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	afc48d7f77259ae257bad9ae2ec0939c1c09c20e018406cac4e934ca7717099b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings	afc48d7f77259ae257bad9ae2ec0939c1c09c20e018406cac4e934ca7717099b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings	svchcst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings	svchcst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings	svchcst.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2832	afc48d7f77259ae257bad9ae2ec0939c1c09c20e018406cac4e934ca7717099b.exe
2832	afc48d7f77259ae257bad9ae2ec0939c1c09c20e018406cac4e934ca7717099b.exe
2832	afc48d7f77259ae257bad9ae2ec0939c1c09c20e018406cac4e934ca7717099b.exe
2832	afc48d7f77259ae257bad9ae2ec0939c1c09c20e018406cac4e934ca7717099b.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe
3284	svchcst.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2832	afc48d7f77259ae257bad9ae2ec0939c1c09c20e018406cac4e934ca7717099b.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2832	afc48d7f77259ae257bad9ae2ec0939c1c09c20e018406cac4e934ca7717099b.exe
2832	afc48d7f77259ae257bad9ae2ec0939c1c09c20e018406cac4e934ca7717099b.exe
3284	svchcst.exe
3284	svchcst.exe
2868	svchcst.exe
2868	svchcst.exe
2500	svchcst.exe
2500	svchcst.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 5052	2832	afc48d7f77259ae257bad9ae2ec0939c1c09c20e018406cac4e934ca7717099b.exe	79
PID 5052 wrote to memory of 3284	5052	WScript.exe	81
PID 3284 wrote to memory of 3896	3284	svchcst.exe	82
PID 3284 wrote to memory of 3292	3284	svchcst.exe	83
PID 3896 wrote to memory of 2868	3896	WScript.exe	84
PID 2868 wrote to memory of 4752	2868	svchcst.exe	85
PID 2868 wrote to memory of 396	2868	svchcst.exe	86
PID 4752 wrote to memory of 2500	4752	WScript.exe	87
PID 2500 wrote to memory of 5464	2500	svchcst.exe	88
PID 2500 wrote to memory of 5288	2500	svchcst.exe	89

C:\Users\Admin\AppData\Local\Temp\afc48d7f77259ae257bad9ae2ec0939c1c09c20e018406cac4e934ca7717099b.exe
"C:\Users\Admin\AppData\Local\Temp\afc48d7f77259ae257bad9ae2ec0939c1c09c20e018406cac4e934ca7717099b.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5052
- - C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
    3⤵
    - Deletes itself
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3284
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3896
    - - C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2868
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        6⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4752
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2500
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5464
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5288
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:396
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Config.ini

Path C:\Users\Admin\AppData\Roaming\Microsoft\Config.ini
Size 92B
SHA256 44063c266686263f14cd2a83fee124fb3e61a9171a6aab69709464f49511011d
MD5 67b9b3e2ded7086f393ebbc36c5e7bca
SHA1 e6299d0450b9a92a18cc23b5704a2b475652c790
SHA512 826fbc9481f46b1ae3db828a665c55c349023caf563e6e8c17321f5f3af3e4c3914955db6f0eebfc6defe561315435d47310b4d0499ab9c2c85bb61264dedc09
MD5 SHA1 SHA512

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 753B
SHA256 bea35be53d334dd0cbe675aae7432aaac8a5d13ed66b2dd542c2fc467ee37b51
MD5 4d24a9064211b91ee0d218a44271bd71
SHA1 c81b39f9dcde6cce317b6d489e98b421a536fe77
SHA512 a4b5f2a26581c7dd8c6f9d56e83e89a3241eddb2624005195d6686de59a76aab7517c8127a5d76e2ae1638d6877bba9617e03847451a9361ad8fbcabc4a56fcb
TLSH
T19401CB00EE4CC22D503553B32432E44EF7AE1943A303ACE9B899D0662FB07689CB0E33
MD5 SHA1 SHA512 TLSH

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 696B
SHA256 fcea651549aa97e3646b2b5857daab87dfa90158918203ea713fbc3d8dc96d2b
MD5 4f1c3e04fe09c26eac61a6a5e73d41a6
SHA1 5d61ea8f22af3a41286cfd2e03bf0d5fe912527e
SHA512 23a253717242040b3497cc5dd9736a2a19adac084ebdf17f578f11a3c07aa584c78a8155ece8de4317293c4b75fca53b4cc225d05785f69e01d18ef6582e01f5
TLSH
T1EE019900DD4C8258503553B62532E40FF7AA1553A303ACE8B899D0A52F707689CB4A36
MD5 SHA1 SHA512 TLSH

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 696B
SHA256 3154f7fe0c77b8441733285f257a444605ca5badb1148288aa7275033f75d3f5
MD5 81911744d71ed066085116eec2026095
SHA1 47cfe383cd90c80f367d20667fa26cd160507a8f
SHA512 e64925ee682737251c7d5f42a378a4f6c23a50a07a6811882547567725b59c172da356b235afc977d4c1e8209f5c1ba696b9dd54e7739f67a71c099c031d7396
TLSH
T1A5019900DD4C8258503553B62432A44FF7EA1553A303ACE8B899D0B52F707689CB4A32
MD5 SHA1 SHA512 TLSH

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 696B
SHA256 d15af3885670c4fea9dd97da21025faa5fd2b42bddc310bad2893e23a3ed2bef
MD5 ebf405e49dade13da94f737cdc03dba1
SHA1 8a0c39e59beed0deb4e726566b235c42c70942bb
SHA512 bbdef781757a387898665650d8f951e7fc495770d34595d9badbe5a39d46ec49a06ec00cbe28ed5e2677e5eeea518241fb638580668baca8d7728c44f2069ea2
TLSH
T166019910DD4C8258503553B62432A44FF7EA1553A303ACE8B899D0B52F70768DCB4A32
MD5 SHA1 SHA512 TLSH

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.4MB
SHA256 89872ea7d47e3137c95730b2e6f4b7fee899adcf30f37bac2a2f8e94f7c8ab5a
MD5 de0ed2c28c1f72522390c4c1c2584ab8
SHA1 b4e0bdd4095789af9114954f154eefb8038ee075
SHA512 3fc1e388cddae45c1e87334d84cb8eaf9aafba9b7d2dc7f44231ee994b0a1b3e88a05dbcaee40bd9efdfe6e3b19841d5d7601d61660f1cda2ec20a5a3a052ccf
SSDEEP 24576:GH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5QN:GcallSllG4ZM7QzMG
TLSH
T1D3658D13F292C0F1E61C227124FB6339BE749B450A71CAC7EB95DD791C32691AB6720E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.4MB
SHA256 a00f379d8063d8634c371c04c06d479ed6dfd9f22a8dae75ef0f7c1be97d7c75
MD5 a71244c064b12198bc0f58d0fc338f66
SHA1 024f68519cb293d2a9cedbd8bd07185b456d74a5
SHA512 1f9115e06e36222d9278f97d52e5b6b214bb9a2451229953e64f64c323d12d583cd26b3c23b3bde12cddde4146978c40df596563895513fbfd817cd75f5cabe5
SSDEEP 24576:GH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Qo:GcallSllG4ZM7QzMf
TLSH
T1C5658D13F292C0F1E61C227124FB6339BE749B450A71CAC7EB95DD791C32691AB6720E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.4MB
SHA256 30105c96ecf7b13942555fcac187b3376c54c95f72e46ce66a84398e0635d9e1
MD5 fe7ba9524c53f095907394434bae0d62
SHA1 58d0d2d5f2a49683318b9f32c1e04083fccf28e9
SHA512 075e4d1111c30a6e6afa22bf3c16892d8111b94e903fff9b651f55557ba9b14376acf63e8bf9dc48c7096c52231d01f6ac7f83845e99e4b0e867c6b194f141f0
SSDEEP 24576:GH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5QC:GcallSllG4ZM7QzMx
TLSH
T18E658D13F292C0F1E61C227124FB6339BE749B450A71CAC7EB95DD791C32691AB6720E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2500-75-0x0000000000990000-0x0000000000A4F000-memory.dmp

Download

memory/2500-76-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/2832-27-0x0000000000C40000-0x0000000000CFF000-memory.dmp

Download

memory/2832-28-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/2832-0-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/2832-9-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/2832-10-0x0000000000C40000-0x0000000000CFF000-memory.dmp

Download

memory/2868-45-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/2868-58-0x0000000000A00000-0x0000000000ABF000-memory.dmp

Download

memory/2868-59-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/2868-60-0x0000000000A00000-0x0000000000ABF000-memory.dmp

Download

memory/2868-61-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/3284-42-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/3284-41-0x0000000000B80000-0x0000000000C3F000-memory.dmp

Download

memory/3292-48-0x0000000003940000-0x000000000394E000-memory.dmp

Download

memory/3896-47-0x0000000005590000-0x00000000055DB000-memory.dmp

Download

memory/3896-46-0x00000000031C0000-0x00000000031CE000-memory.dmp

Download

memory/4752-65-0x00000000056F0000-0x00000000056FB000-memory.dmp

Download

memory/4752-64-0x0000000005680000-0x00000000056E8000-memory.dmp

Download