flyagent | 4100ba7f46b2a75a773ae3997f21be97cebd18a4fc7b249e5bfd989b7fae97d4

Analysis

max time kernel
149s
max time network
114s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 09:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4100ba7f46b2a75a773ae3997f21be97cebd18a4fc7b249e5bfd989b7fae97d4.exe
Size 1.1MB
Sample260511-laf9dad16s
SHA256 4100ba7f46b2a75a773ae3997f21be97cebd18a4fc7b249e5bfd989b7fae97d4
MD5 bc33a14529e15076490e3248cc2304ad
SHA1 beb399228a200ba218c52ef96cc91ffcd7f0628b
SHA512 69d53603c989627a757c546293b12eddd5f5ca3ebe9f0cf2d0acbe6e30ea1675c26bd7b4e27daa284bd8d446ba8e64d33691e03438574f218f96acca44a06631
SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Qj:acallSllG4ZM7QzM2
TLSH
T1BA458D13F292C0F1E61C227124FB6739BE749B450A71CAC7E794DD791C32691AB6720E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery flyagent

Malware Config

Signatures

Family: FlyAgent
FlyAgent is a backdoor written in C++.
backdoor flyagent

Detects FlyAgent Backdoor 9 IoCs

resource	yara_rule
behavioral2/memory/892-0-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/892-11-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/892-13-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/892-15-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/files/0x003200000002b1cf-16.dat	flyagent
behavioral2/memory/5612-20-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/1292-19-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/1292-21-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/5612-22-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent

Deletes itself 1 IoCs

pid	Process
5612	svchcst.exe

Executes dropped EXE 2 IoCs

pid	Process
1292	svchcst.exe
5612	svchcst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4100ba7f46b2a75a773ae3997f21be97cebd18a4fc7b249e5bfd989b7fae97d4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings	4100ba7f46b2a75a773ae3997f21be97cebd18a4fc7b249e5bfd989b7fae97d4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
892	4100ba7f46b2a75a773ae3997f21be97cebd18a4fc7b249e5bfd989b7fae97d4.exe
892	4100ba7f46b2a75a773ae3997f21be97cebd18a4fc7b249e5bfd989b7fae97d4.exe
892	4100ba7f46b2a75a773ae3997f21be97cebd18a4fc7b249e5bfd989b7fae97d4.exe
892	4100ba7f46b2a75a773ae3997f21be97cebd18a4fc7b249e5bfd989b7fae97d4.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe
5612	svchcst.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
892	4100ba7f46b2a75a773ae3997f21be97cebd18a4fc7b249e5bfd989b7fae97d4.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
892	4100ba7f46b2a75a773ae3997f21be97cebd18a4fc7b249e5bfd989b7fae97d4.exe
892	4100ba7f46b2a75a773ae3997f21be97cebd18a4fc7b249e5bfd989b7fae97d4.exe
5612	svchcst.exe
5612	svchcst.exe
1292	svchcst.exe
1292	svchcst.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 892 wrote to memory of 2596	892	4100ba7f46b2a75a773ae3997f21be97cebd18a4fc7b249e5bfd989b7fae97d4.exe	80
PID 892 wrote to memory of 996	892	4100ba7f46b2a75a773ae3997f21be97cebd18a4fc7b249e5bfd989b7fae97d4.exe	81
PID 2596 wrote to memory of 1292	2596	WScript.exe	83
PID 996 wrote to memory of 5612	996	WScript.exe	84

C:\Users\Admin\AppData\Local\Temp\4100ba7f46b2a75a773ae3997f21be97cebd18a4fc7b249e5bfd989b7fae97d4.exe
"C:\Users\Admin\AppData\Local\Temp\4100ba7f46b2a75a773ae3997f21be97cebd18a4fc7b249e5bfd989b7fae97d4.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:892
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2596
- - C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1292
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:996
- - C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
    3⤵
    - Deletes itself
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:5612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 753B
SHA256 4b627ecf27af641300c6f910195f969604dbf6d111eadd3c1f5d70b66a6b6882
MD5 720d73a9e14d4464268158cfefbea843
SHA1 336483a2b876880332a0adf862c5bb16e8f5f544
SHA512 6f3d1ebc38a8b36ed989122205140e597e1bd033c97f14f06cddab91a2bdf4e3aa2a2c41125d97a19c5c8fe2a19635390e2a3b2f7564e5f95b3a790354c74bf7
TLSH
T1B101C000DD4C826C507657B22432E44EF7AA1443A303ACE8B899D0752F7076C9CB0A37
MD5 SHA1 SHA512 TLSH

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.1MB
SHA256 50c7745ad85a17c0f4868df20ba459585802cc1da052e1a3bb4b758075cef0a3
MD5 955d16d1ccba320b6388f4aafcce6135
SHA1 22c92ca1a82b5149b066e791eb8aa63c1a623b5c
SHA512 f5cbbdcfe1c4a3137a4d624b35f5d2eefd3b2a4dd5b9ffb812667e26796d3c5fe01a5bbcc7162727a1fcf6ac27c94db767dd3bab571703091356abfbd73d6ef5
SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Q3:acallSllG4ZM7QzMK
TLSH
T193458D13F292C0F1E61C227124FB6739BE749B450A71CAC7E794DD791C32691AB6720E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/892-0-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/892-11-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/892-13-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/892-15-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/1292-19-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/1292-21-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/5612-20-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/5612-22-0x0000000000400000-0x000000000055F000-memory.dmp

Download