flyagent | 40744732f9d40e17854ae1f6c018c4e7194927d3cff033a13b0838e8e6f7f822

Analysis

max time kernel
82s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 04:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
40744732f9d40e17854ae1f6c018c4e7194927d3cff033a13b0838e8e6f7f822.exe
Size 1.1MB
Sample260528-evmhkagy3x
SHA256 40744732f9d40e17854ae1f6c018c4e7194927d3cff033a13b0838e8e6f7f822
MD5 de67fd8ec3ea57c8dbcf8ecced038572
SHA1 50797c82b283515e5c04e45e15ac9735bfea4888
SHA512 e475f55938bef059af5e57b0f368129fbb9ad1be7d28ce971a2584a7bae05a512c7284a93d429e27d4f3ee55cf6549a520422a9d6725ca64ec431ee3a6e1b7e8
SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Qe:acallSllG4ZM7QzMb
TLSH
T102458D13F292C0F1E61C227124FB6739BE749B450A71CAC7E794DD791C32691ABA720E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery flyagent

Malware Config

Signatures

Family: FlyAgent
FlyAgent is a backdoor written in C++.
backdoor flyagent

Detects FlyAgent Backdoor 6 IoCs

resource	yara_rule
behavioral2/memory/2332-0-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/2332-11-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/2332-15-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/files/0x000600000000d34a-16.dat	flyagent
behavioral2/memory/2096-18-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/2096-29-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent

Deletes itself 1 IoCs

pid	Process
2096	svchcst.exe

Executes dropped EXE 1 IoCs

pid	Process
2096	svchcst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	40744732f9d40e17854ae1f6c018c4e7194927d3cff033a13b0838e8e6f7f822.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings	40744732f9d40e17854ae1f6c018c4e7194927d3cff033a13b0838e8e6f7f822.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings	svchcst.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2332	40744732f9d40e17854ae1f6c018c4e7194927d3cff033a13b0838e8e6f7f822.exe
2332	40744732f9d40e17854ae1f6c018c4e7194927d3cff033a13b0838e8e6f7f822.exe
2332	40744732f9d40e17854ae1f6c018c4e7194927d3cff033a13b0838e8e6f7f822.exe
2332	40744732f9d40e17854ae1f6c018c4e7194927d3cff033a13b0838e8e6f7f822.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe
2096	svchcst.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2332	40744732f9d40e17854ae1f6c018c4e7194927d3cff033a13b0838e8e6f7f822.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2332	40744732f9d40e17854ae1f6c018c4e7194927d3cff033a13b0838e8e6f7f822.exe
2332	40744732f9d40e17854ae1f6c018c4e7194927d3cff033a13b0838e8e6f7f822.exe
2096	svchcst.exe
2096	svchcst.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 3480	2332	40744732f9d40e17854ae1f6c018c4e7194927d3cff033a13b0838e8e6f7f822.exe	84
PID 2332 wrote to memory of 1504	2332	40744732f9d40e17854ae1f6c018c4e7194927d3cff033a13b0838e8e6f7f822.exe	83
PID 1504 wrote to memory of 2096	1504	WScript.exe	86
PID 2096 wrote to memory of 2356	2096	svchcst.exe	87
PID 2096 wrote to memory of 4320	2096	svchcst.exe	88

C:\Users\Admin\AppData\Local\Temp\40744732f9d40e17854ae1f6c018c4e7194927d3cff033a13b0838e8e6f7f822.exe
"C:\Users\Admin\AppData\Local\Temp\40744732f9d40e17854ae1f6c018c4e7194927d3cff033a13b0838e8e6f7f822.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1504
- - C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
    3⤵
    - Deletes itself
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2096
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2356
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4320
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Config.ini

Path C:\Users\Admin\AppData\Roaming\Microsoft\Config.ini
Size 92B
SHA256 44063c266686263f14cd2a83fee124fb3e61a9171a6aab69709464f49511011d
MD5 67b9b3e2ded7086f393ebbc36c5e7bca
SHA1 e6299d0450b9a92a18cc23b5704a2b475652c790
SHA512 826fbc9481f46b1ae3db828a665c55c349023caf563e6e8c17321f5f3af3e4c3914955db6f0eebfc6defe561315435d47310b4d0499ab9c2c85bb61264dedc09
MD5 SHA1 SHA512

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 753B
SHA256 0c11955859d7ab7ec47fc2ad3f44624cc2d102a07e8c6e0197efdaba8d7b0402
MD5 74046a296678da54d3b43b85d30f7548
SHA1 915082e431d11ce43c720962ac3a5c4ed0abe50e
SHA512 f384ee1e34c28d394d16ae64c33e59a2ccdba9b98728dd1343edc44409de75b98cf3b402f1ba66ff32af37e3affb1bd16dcc4396208722dabcc357171d3acbf1
TLSH
T1BF01CB10DD5C8258903553B66532E40EF7AA1853A303ECD87899D2A12F707589CB5A37
MD5 SHA1 SHA512 TLSH

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 696B
SHA256 c73b4e554a4ae515ae3aa320a19d752e3d848d00ed0cd8f084081ed530b8fc3d
MD5 73dd42e0ba8cff47f0542d7d8aa40f90
SHA1 ffbb1b56415be5abcf4613aed3136768f2edbc38
SHA512 efd0075f9e70dd557271bdbcd782a083ae2cde8cd5674bf7f8cf63064847951adfcbaa9c9cff91c57d19c7308d0b7bf4754bfbe8fce6ec0e41d920bde7f5a67e
TLSH
T101019900DD4C8258503553B62532A40FF7AA1553A303ACE8B899D0A52F707689CB4A36
MD5 SHA1 SHA512 TLSH

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.1MB
SHA256 bc21ebac88f03115d326cb99b83d32db81c4bb50f505af9b7269271280192513
MD5 cd180147b9dfeccb3c28154969e029aa
SHA1 afe6164ff7d30618ff740a4562cd79100baf0660
SHA512 6fad4202fffe4d041221b2d67c99f1c827e118693c1099a5af032e9bce60e14bedfaf64cffa435bef025cf98912e82147719468a4240ede08237e7acab028513
SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5QH:acallSllG4ZM7QzMa
TLSH
T14B458D13F292C0F1E61C227124FB6739BE749B450A71CAC7E794DD791C32691ABA720E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2096-18-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/2096-29-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/2332-0-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/2332-11-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/2332-15-0x0000000000400000-0x000000000055F000-memory.dmp

Download