flyagent | 5846338f4020ffd1d700cdc9b91dace0d8fd3143c12107b6858ac29295572a60

Analysis

max time kernel
80s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 09:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5846338f4020ffd1d700cdc9b91dace0d8fd3143c12107b6858ac29295572a60.exe
Size 1.1MB
Sample260601-lmg2faav4j
SHA256 5846338f4020ffd1d700cdc9b91dace0d8fd3143c12107b6858ac29295572a60
MD5 5bfbda778d873236aba083169f3a2183
SHA1 2b004d8f3b324ae280bd1d9bd4439533d61cfd12
SHA512 885aa1ea79e468a465ed0ef0eb93c5cb7573621e2b617e43d178bbd31caee0539806946903a9b637209d61cbc9d677177ffa0cb9505a32d419e719bd4c0121ed
SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Qw:acallSllG4ZM7QzM5
TLSH
T143458D13F292C0F1E61C227124FB6739BE749B450A71CAC7EB94DD791C32691AB6720E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery flyagent

Malware Config

Signatures

Family: FlyAgent
FlyAgent is a backdoor written in C++.
backdoor flyagent

Detects FlyAgent Backdoor 13 IoCs

resource	yara_rule
behavioral2/memory/1820-0-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/1820-12-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/1820-14-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/1820-16-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/files/0x000600000000d34a-17.dat	flyagent
behavioral2/memory/3376-19-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/3376-30-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/3376-31-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/files/0x002200000002b2a0-32.dat	flyagent
behavioral2/files/0x000700000000d34a-34.dat	flyagent
behavioral2/memory/3888-43-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/3888-44-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/3448-56-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent

Deletes itself 1 IoCs

pid	Process
3376	svchcst.exe

Executes dropped EXE 2 IoCs

pid	Process
3376	svchcst.exe
3888	svchcst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5846338f4020ffd1d700cdc9b91dace0d8fd3143c12107b6858ac29295572a60.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings	5846338f4020ffd1d700cdc9b91dace0d8fd3143c12107b6858ac29295572a60.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings	svchcst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings	svchcst.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1820	5846338f4020ffd1d700cdc9b91dace0d8fd3143c12107b6858ac29295572a60.exe
1820	5846338f4020ffd1d700cdc9b91dace0d8fd3143c12107b6858ac29295572a60.exe
1820	5846338f4020ffd1d700cdc9b91dace0d8fd3143c12107b6858ac29295572a60.exe
1820	5846338f4020ffd1d700cdc9b91dace0d8fd3143c12107b6858ac29295572a60.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe
3376	svchcst.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1820	5846338f4020ffd1d700cdc9b91dace0d8fd3143c12107b6858ac29295572a60.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1820	5846338f4020ffd1d700cdc9b91dace0d8fd3143c12107b6858ac29295572a60.exe
1820	5846338f4020ffd1d700cdc9b91dace0d8fd3143c12107b6858ac29295572a60.exe
3376	svchcst.exe
3376	svchcst.exe
3888	svchcst.exe
3888	svchcst.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 8	1820	5846338f4020ffd1d700cdc9b91dace0d8fd3143c12107b6858ac29295572a60.exe	81
PID 1820 wrote to memory of 2836	1820	5846338f4020ffd1d700cdc9b91dace0d8fd3143c12107b6858ac29295572a60.exe	82
PID 2836 wrote to memory of 3376	2836	WScript.exe	84
PID 3376 wrote to memory of 4196	3376	svchcst.exe	86
PID 3376 wrote to memory of 2572	3376	svchcst.exe	85
PID 4196 wrote to memory of 3888	4196	WScript.exe	87
PID 3888 wrote to memory of 1572	3888	svchcst.exe	88
PID 3888 wrote to memory of 1780	3888	svchcst.exe	89

C:\Users\Admin\AppData\Local\Temp\5846338f4020ffd1d700cdc9b91dace0d8fd3143c12107b6858ac29295572a60.exe
"C:\Users\Admin\AppData\Local\Temp\5846338f4020ffd1d700cdc9b91dace0d8fd3143c12107b6858ac29295572a60.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:8
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
    3⤵
    - Deletes itself
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3376
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:2572
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4196
    - - C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3888
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1572
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        7⤵
        
        PID:3448
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        8⤵
        
        PID:2212
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        8⤵
        
        PID:4836
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Config.ini

Path C:\Users\Admin\AppData\Roaming\Microsoft\Config.ini
Size 92B
SHA256 44063c266686263f14cd2a83fee124fb3e61a9171a6aab69709464f49511011d
MD5 67b9b3e2ded7086f393ebbc36c5e7bca
SHA1 e6299d0450b9a92a18cc23b5704a2b475652c790
SHA512 826fbc9481f46b1ae3db828a665c55c349023caf563e6e8c17321f5f3af3e4c3914955db6f0eebfc6defe561315435d47310b4d0499ab9c2c85bb61264dedc09
MD5 SHA1 SHA512

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 696B
SHA256 d7433fbea40ea3f87e991ce54c73436c110cfbb83748d554aea8d94051a5224e
MD5 2c3b5340da071ac89dded61dffd49fb5
SHA1 77a880658d0b70e5455379099427bfdae8cc0ae8
SHA512 7e69f14c55afec39149491531c2a499b6253aa71ad448e722912f239fde055826b34383bd8d14773af08ef475b5fe53451a0a93e0bcc46fbeba3872198200f3c
TLSH
T1E2019900DD4C8258503557B62432A44FF7EA1553A303ACE8B899D0A52F7076C9CB4A36
MD5 SHA1 SHA512 TLSH

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 753B
SHA256 babeee5edf7a5f35714ff6780d472dd8e139fae387f0826cedbca71653e072ae
MD5 1b329c00d195c61f6a6b0b0b2ad67fbd
SHA1 aeda632394305466540142e83a1a8acb5b9cf168
SHA512 36045e8398d605534ac9dbdb3c3337bcbcc4e4527a317868d386c92f489590e195cdcf68f03050d69f84a17faf83d5f1f9b7975108451037875399b61f08de58
TLSH
T1D001CB00DD4CC218507597B62432E40FE7EA1553A3039CD9B89AC1A12F7076C9DB4A37
MD5 SHA1 SHA512 TLSH

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 696B
SHA256 50e39163065b39c8cac4f381ff35c00972adde6c6fcd6d9cf555d1b0b8b68554
MD5 632419f9e97777f0bcd1af67443cadae
SHA1 52edb2e30a2b1156ff9f77c0fe7435bc1a616ac8
SHA512 b9b188d33cab5023dd410c0d6c01b5b200c003b432d44fe47da9b6ca1d4a5fa6fd3e869baeac6c8f5d7fae063e6128ee9c96b9258e10e550093e199cccaca2b1
TLSH
T1EB019910DD4C8259603553B62432A44FF7EA1553A303ACE8B899D0A52F70768DDB4A36
MD5 SHA1 SHA512 TLSH

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 696B
SHA256 9eca0120263ab4947d38369d9a4986744e61189382c1d313eb464ad449ea2651
MD5 f02b234115a56496bcd6642d1de04e5d
SHA1 d383b9d3c82fe145f25a9a6e7e4333151fd4ecc6
SHA512 c446eccd822729a81d49321c88ecc0fba4e4f7b6f6277d2660c7f3a18a67614915ae24a96353bf93b039eb441f0c260c1961a1363f16524dbeaf2554626c1b4e
TLSH
T1B2019910DD4C8258503553B62432A44FF7EA1553A303ACE8B899D0B52F707689CB4A32
MD5 SHA1 SHA512 TLSH

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.1MB
SHA256 7a24f7959b0d82fb3a7976cb6a192294b3cc47af3822d48a57975f059d98066a
MD5 8781707d4022295de021be8748f67eb8
SHA1 9186b5f67f16808d3753091b1a42bc135f4c9c8a
SHA512 7b0e91738a891053361d67850841496b0613ab6495a408b8017d4c26f2a27b376679bf07272569dffacae736a1ead0b21c06b013bae16fb43acaa66bcf12b739
SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5QG:acallSllG4ZM7QzMz
TLSH
T134458D13F292C0F1E61C227124FB6739BE749B450A71CAC7EB94DD791C32691AB6720E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.1MB
SHA256 737e05aae03cadc05f4f4e2c57e08596e3d6293521067a98b4e667eafedf173e
MD5 969eec325d858a9dff1200cbac9bab9a
SHA1 a7e10624c798f8e71253f34592d3b4d2bae346b9
SHA512 f5c7fcc3a3af561c0707ca15c6ad309d2c18fe4aa1eee304dd2a145d14faeed4deb5dce0a249353e778ab8e69b5dc52e6e88aeab52d8168584f69d59ac8aab1a
SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5QE:acallSllG4ZM7QzMN
TLSH
T18B458D13F292C0F1E61C227124FB6739BE749B450A71CAC7EB94DD791C32691AB6720E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.1MB
SHA256 31bd6d0a71ecb10898854f7ea2ec0831854099847e21105e017f9ab18b4837f2
MD5 cb1f36bd654fb968b52b5876a9e872ed
SHA1 aaaa581d84ea0cb52da211e6a80d9bac102e63ce
SHA512 cd921d714e1609accb4e8f911939e40d0fb98b31919376f4d0bb0fb927d686ca615abb7acdaba43e08dae740c4ea40d679813636d3305fbb082d28fc0e76cf06
SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5QB:acallSllG4ZM7QzMI
TLSH
T1A4458D13F292C0F1E61C227124FB6739BE749B450A71CAC7EB94DD791C32691AB6720E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1820-16-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/1820-0-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/1820-14-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/1820-12-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/3376-19-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/3376-30-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/3376-31-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/3448-56-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/3888-43-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/3888-44-0x0000000000400000-0x000000000055F000-memory.dmp

Download