Analysis
- max time kernel
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
29/05/2026, 01:11
Behavioral task
behavioral1
Sample
7a97266ccc6431da7275ae3a6a336b834ebb318f54314ed24706d2f29f9b1add.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 7a97266ccc6431da7275ae3a6a336b834ebb318f54314ed24706d2f29f9b1add.exe
- Size 1.3MB
- Sample260529-bj5yzsfx2s
- SHA256 7a97266ccc6431da7275ae3a6a336b834ebb318f54314ed24706d2f29f9b1add
- MD5 2df4305a11f1bbec4716b921cefcce15
- SHA1 430295015d232cb69a8575588c774444acde741f
- SHA512 ff337ee4c80872ac97132a0b718e06645625e5834a89c77be49d044beea5b7e4b9056d6d66f2f468975abc74fd625f8f99c74d533e3cf71ec1f562d89ecb10eb
- SSDEEP 24576:WBS9qQEK6QywlBqH82QoXFkrzkmmlSgRDko0lG4Z8r7Qfd7iu5m:WZaClSFlG4ZM7QlVY
- TLSH T19C557C13F692C0F1E61C227124FB6339BE7497450A71CACBE794DD791C32691ABA720E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects FlyAgent Backdoor 3 IoCs
resource yara_rule behavioral2/memory/4860-10-0x0000000000400000-0x0000000000551000-memory.dmp flyagent behavioral2/memory/4860-11-0x0000000000400000-0x0000000000551000-memory.dmp flyagent behavioral2/files/0x000600000000d34a-12.dat flyagent - Deletes itself 1 IoCs
pid Process 3300 svchcst.exe - Executes dropped EXE 2 IoCs
pid Process 3300 svchcst.exe 3632 svchcst.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7a97266ccc6431da7275ae3a6a336b834ebb318f54314ed24706d2f29f9b1add.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchcst.exe - Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings 7a97266ccc6431da7275ae3a6a336b834ebb318f54314ed24706d2f29f9b1add.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ WScript.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4860 7a97266ccc6431da7275ae3a6a336b834ebb318f54314ed24706d2f29f9b1add.exe 4860 7a97266ccc6431da7275ae3a6a336b834ebb318f54314ed24706d2f29f9b1add.exe 4860 7a97266ccc6431da7275ae3a6a336b834ebb318f54314ed24706d2f29f9b1add.exe 4860 7a97266ccc6431da7275ae3a6a336b834ebb318f54314ed24706d2f29f9b1add.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe 3300 svchcst.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 4860 7a97266ccc6431da7275ae3a6a336b834ebb318f54314ed24706d2f29f9b1add.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4860 7a97266ccc6431da7275ae3a6a336b834ebb318f54314ed24706d2f29f9b1add.exe 4860 7a97266ccc6431da7275ae3a6a336b834ebb318f54314ed24706d2f29f9b1add.exe 3300 svchcst.exe 3300 svchcst.exe 3632 svchcst.exe 3632 svchcst.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4860 wrote to memory of 3364 4860 7a97266ccc6431da7275ae3a6a336b834ebb318f54314ed24706d2f29f9b1add.exe 81 PID 4860 wrote to memory of 3244 4860 7a97266ccc6431da7275ae3a6a336b834ebb318f54314ed24706d2f29f9b1add.exe 82 PID 3364 wrote to memory of 3300 3364 WScript.exe 84 PID 3244 wrote to memory of 3632 3244 WScript.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a97266ccc6431da7275ae3a6a336b834ebb318f54314ed24706d2f29f9b1add.exe"C:\Users\Admin\AppData\Local\Temp\7a97266ccc6431da7275ae3a6a336b834ebb318f54314ed24706d2f29f9b1add.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3300
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3632
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
- Size 753B
- SHA256 9e12f19c8375dbb50c18a7cfbfada5a08db661ee87f85da050955bade0ff71db
- MD5 3e05c5ae04237f9f9f8aecdefcd8b26f
- SHA1 077e08dc83d14563c11572be28f169552d837e88
- SHA512 18fd9385f9aa2aba83f2fa3aba678121fb65e32b78fae38b04f863b237e0f51da45a06c4eb552c6429deb6d285e68a7618283bfd56ece5422acf40a99decd80f
- TLSH T13F01C010ED5CC75C503547765532E40EE7EA194363036CD97895D0B12FB06589CB5A76
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
- Size 1.3MB
- SHA256 b022f707655d4a6b0ceed1dbce86c88cf0ca41ea4777b595574a35403b908d50
- MD5 3e1691aaf9ad71aea5e902e164f77c83
- SHA1 032f7011e3765fde29a80fbbd624a61a97950968
- SHA512 b33c6ef28db52267e67eff7e522162145620f5f749b472eb93181cd50afb30e5d3be958efb85531dbd7305c5154a0f675f238eb86373c9cf3148da5894d0538e
- SSDEEP 24576:WBS9qQEK6QywlBqH82QoXFkrzkmmlSgRDko0lG4Z8r7Qfd7iu5z:WZaClSFlG4ZM7QlVB
- TLSH T112557C13F692C0F1E61C227124FB6339BE7497450A71CACBE794DD791C32691ABA720E
- MD5 SHA1 SHA512 SSDEEP TLSH