Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
28/05/2026, 02:50
Behavioral task
behavioral1
Sample
ba748fbf4ac06c8e159cb7f2a222931e5287d4a49a0d2fb08463b62fde1e6519.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target ba748fbf4ac06c8e159cb7f2a222931e5287d4a49a0d2fb08463b62fde1e6519.exe
- Size 1.4MB
- Sample260528-dbt8maes2n
- SHA256 ba748fbf4ac06c8e159cb7f2a222931e5287d4a49a0d2fb08463b62fde1e6519
- MD5 63762fcd8a79ceb7c0da2a5951b62272
- SHA1 3e409afc8a14342ef86503b40f8e39f68d714878
- SHA512 04239acd4781c6fc6f2909fbfee8274c74d842e864141b9239abfd336d457427435eef113c2c70271a19729fd80c24b53fad7ac9b3320a47f1ea1b4c1536fc50
- SSDEEP 24576:GH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Qi:GcallSllG4ZM7QzMh
- TLSH T1A5658D13F292C0F1E61C227124FB6339BE749B450A71CAC7E795DD791C32691AB6720E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects FlyAgent Backdoor 7 IoCs
resource yara_rule behavioral2/memory/716-0-0x0000000000400000-0x000000000055F000-memory.dmp flyagent behavioral2/memory/716-11-0x0000000000400000-0x000000000055F000-memory.dmp flyagent behavioral2/memory/716-13-0x0000000000400000-0x000000000055F000-memory.dmp flyagent behavioral2/files/0x000600000002a956-14.dat flyagent behavioral2/memory/2236-17-0x0000000000400000-0x000000000055F000-memory.dmp flyagent behavioral2/memory/2236-18-0x0000000000400000-0x000000000055F000-memory.dmp flyagent behavioral2/memory/3904-19-0x0000000000400000-0x000000000055F000-memory.dmp flyagent - Deletes itself 1 IoCs
pid Process 3904 svchcst.exe - Executes dropped EXE 2 IoCs
pid Process 3904 svchcst.exe 2236 svchcst.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ba748fbf4ac06c8e159cb7f2a222931e5287d4a49a0d2fb08463b62fde1e6519.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe - Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings ba748fbf4ac06c8e159cb7f2a222931e5287d4a49a0d2fb08463b62fde1e6519.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 716 ba748fbf4ac06c8e159cb7f2a222931e5287d4a49a0d2fb08463b62fde1e6519.exe 716 ba748fbf4ac06c8e159cb7f2a222931e5287d4a49a0d2fb08463b62fde1e6519.exe 716 ba748fbf4ac06c8e159cb7f2a222931e5287d4a49a0d2fb08463b62fde1e6519.exe 716 ba748fbf4ac06c8e159cb7f2a222931e5287d4a49a0d2fb08463b62fde1e6519.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 716 ba748fbf4ac06c8e159cb7f2a222931e5287d4a49a0d2fb08463b62fde1e6519.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 716 ba748fbf4ac06c8e159cb7f2a222931e5287d4a49a0d2fb08463b62fde1e6519.exe 716 ba748fbf4ac06c8e159cb7f2a222931e5287d4a49a0d2fb08463b62fde1e6519.exe 2236 svchcst.exe 3904 svchcst.exe 3904 svchcst.exe 2236 svchcst.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 716 wrote to memory of 1060 716 ba748fbf4ac06c8e159cb7f2a222931e5287d4a49a0d2fb08463b62fde1e6519.exe 80 PID 716 wrote to memory of 4772 716 ba748fbf4ac06c8e159cb7f2a222931e5287d4a49a0d2fb08463b62fde1e6519.exe 81 PID 4772 wrote to memory of 3904 4772 WScript.exe 83 PID 1060 wrote to memory of 2236 1060 WScript.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba748fbf4ac06c8e159cb7f2a222931e5287d4a49a0d2fb08463b62fde1e6519.exe"C:\Users\Admin\AppData\Local\Temp\ba748fbf4ac06c8e159cb7f2a222931e5287d4a49a0d2fb08463b62fde1e6519.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:716 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2236
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3904
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
- Size 753B
- SHA256 69a7a326fa71699cf82173b315c53886e0aff4f54bf400d7c364c6714b0e9e7e
- MD5 b2d363891bd4518ef0655ff750e4c094
- SHA1 3d39d65539e64c1aa064a5beb1548213ae59e9fb
- SHA512 9c856144a067b6d751841d9c969e6857ce788a736a30f9a4691472dbadea7d5bed2352ee531f31bf8914ee1cc3c408d5d9a2319395687159c9b75e2cdccd1174
- TLSH T16C019710DD5CC269507443B52532E84AE3AA1453A343ACD8B99AD1A23B707689CB4E33
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
- Size 1.4MB
- SHA256 12c20f10fa6e5b4782192cd728c0dde76cd4c9589c87acaf4a7be5a50e924dd9
- MD5 7dbf2e74d9d16228cf29a60e49be4dca
- SHA1 07d9b31da37861af7aed77c433bd616429632735
- SHA512 e26626793411cbddf08659c1790337b9f9943101a7e0b19ae4e5900e528a891146b4a07efe051c8d8818931fbe5597058223c80311bc3e389c3338cc5e3e020e
- SSDEEP 24576:GH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Qn:GcallSllG4ZM7QzMg
- TLSH T1F4658D13F292C0F1E61C227124FB6339BE749B450A71CAC7E795DD791C32691AB6720E
- MD5 SHA1 SHA512 SSDEEP TLSH