flyagent | 54918d8a961e12603e89d901dac24a2ca3f7c89d1915ed21e43fa3a927ed22a6

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 09:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
54918d8a961e12603e89d901dac24a2ca3f7c89d1915ed21e43fa3a927ed22a6.exe
Size 1.3MB
Sample260601-lsdafaaw7m
SHA256 54918d8a961e12603e89d901dac24a2ca3f7c89d1915ed21e43fa3a927ed22a6
MD5 855e82e2dca0059820b9b1f6636c7c9e
SHA1 c2ba25eab2560bab1f4d200c7773da423c19e860
SHA512 9cefdf08b4609ee975e7f0c41fbcafb28d0e4a09efe264773be887925ac95f3491315a986c6d640ca477ad6235624b3d764504dbf2e0f680c6f69c34b149b113
SSDEEP 24576:WBS9qQEK6QywlBqH82QoXFkrzkmmlSgRDko0lG4Z8r7Qfd7iu5K:WZaClSFlG4ZM7QlVs
TLSH
T12A557C13F692C0F1E61C227124FB6339BE7497450A71CACBE794DD791C32691ABA720E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery flyagent

Malware Config

Signatures

Family: FlyAgent
FlyAgent is a backdoor written in C++.
backdoor flyagent

Detects FlyAgent Backdoor 4 IoCs

resource	yara_rule
behavioral2/memory/4800-10-0x0000000000400000-0x0000000000551000-memory.dmp	flyagent
behavioral2/memory/4800-12-0x0000000000400000-0x0000000000551000-memory.dmp	flyagent
behavioral2/files/0x0012000000025c63-13.dat	flyagent
behavioral2/files/0x001b00000002b54d-25.dat	flyagent

Deletes itself 1 IoCs

pid	Process
3060	svchcst.exe

Executes dropped EXE 3 IoCs

pid	Process
3060	svchcst.exe
4044	svchcst.exe
4104	svchcst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	54918d8a961e12603e89d901dac24a2ca3f7c89d1915ed21e43fa3a927ed22a6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings	54918d8a961e12603e89d901dac24a2ca3f7c89d1915ed21e43fa3a927ed22a6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings	svchcst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4800	54918d8a961e12603e89d901dac24a2ca3f7c89d1915ed21e43fa3a927ed22a6.exe
4800	54918d8a961e12603e89d901dac24a2ca3f7c89d1915ed21e43fa3a927ed22a6.exe
4800	54918d8a961e12603e89d901dac24a2ca3f7c89d1915ed21e43fa3a927ed22a6.exe
4800	54918d8a961e12603e89d901dac24a2ca3f7c89d1915ed21e43fa3a927ed22a6.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe
3060	svchcst.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4800	54918d8a961e12603e89d901dac24a2ca3f7c89d1915ed21e43fa3a927ed22a6.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4800	54918d8a961e12603e89d901dac24a2ca3f7c89d1915ed21e43fa3a927ed22a6.exe
4800	54918d8a961e12603e89d901dac24a2ca3f7c89d1915ed21e43fa3a927ed22a6.exe
3060	svchcst.exe
3060	svchcst.exe
4104	svchcst.exe
4104	svchcst.exe
4044	svchcst.exe
4044	svchcst.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 3404	4800	54918d8a961e12603e89d901dac24a2ca3f7c89d1915ed21e43fa3a927ed22a6.exe	80
PID 4800 wrote to memory of 3828	4800	54918d8a961e12603e89d901dac24a2ca3f7c89d1915ed21e43fa3a927ed22a6.exe	81
PID 3404 wrote to memory of 3060	3404	WScript.exe	83
PID 3060 wrote to memory of 4484	3060	svchcst.exe	84
PID 3060 wrote to memory of 544	3060	svchcst.exe	85
PID 544 wrote to memory of 4044	544	WScript.exe	87
PID 4484 wrote to memory of 4104	4484	WScript.exe	86

C:\Users\Admin\AppData\Local\Temp\54918d8a961e12603e89d901dac24a2ca3f7c89d1915ed21e43fa3a927ed22a6.exe
"C:\Users\Admin\AppData\Local\Temp\54918d8a961e12603e89d901dac24a2ca3f7c89d1915ed21e43fa3a927ed22a6.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3404
- - C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
    3⤵
    - Deletes itself
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3060
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4484
    - - C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4104
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:544
    - - C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4044
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Config.ini

Path C:\Users\Admin\AppData\Roaming\Microsoft\Config.ini
Size 92B
SHA256 44063c266686263f14cd2a83fee124fb3e61a9171a6aab69709464f49511011d
MD5 67b9b3e2ded7086f393ebbc36c5e7bca
SHA1 e6299d0450b9a92a18cc23b5704a2b475652c790
SHA512 826fbc9481f46b1ae3db828a665c55c349023caf563e6e8c17321f5f3af3e4c3914955db6f0eebfc6defe561315435d47310b4d0499ab9c2c85bb61264dedc09
MD5 SHA1 SHA512

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 753B
SHA256 e8909259d6f02aeafb151bbfb87b0416988f6676f8fcd726699e245801d8c0bc
MD5 b95d70d067f8c006732d65d2bad263ac
SHA1 d373d8b397c2fea1c0947e4fdcfccdb229d3ce20
SHA512 b275bcdad422d1962e3abf16d416af1dc2aa342f351754007f70d37031c14c4efef93cf61700dbcafc701e2d9486aa18e3047362aa5af79b64775bb52a9c2600
TLSH
T1B5014410DD4C8218503953B66533E44EFB9A152363039CD87845D0652F70B189CB4E33
MD5 SHA1 SHA512 TLSH

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 696B
SHA256 758f74e1aa31de598fbf37f70ffd76f936c0b5dd2227b17c0d8e9ac4506f3aaf
MD5 f080eefd41c0fca1c404d5133fb5c957
SHA1 bef3f9c014eca7cf4dc001f3d85befd3681d4bcc
SHA512 e2066e4082f51d4064bfd68eff48c97c481bbb524bb0fa2da0b5ae25bda730811d2933480a72d91a8e5c10ac794f0e793fb8323892332eb9b7c43890ee25c4d7
TLSH
T1F9019900DD5C8258503553B62532A40FF7AA1553A303ACE8B899D0B52F707689CB4A32
MD5 SHA1 SHA512 TLSH

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.3MB
SHA256 c8527b68ae72059c57e16f1f3e291b5da29c18a8905e18427e5cb633685aea1b
MD5 93e6f39b295fc7336a524d396f110ac7
SHA1 6d4c8ecc781085c48f8b9a0c0e9c8332b5ed9e9d
SHA512 9565ceed4c6ba23438fbb62c5d86879fb11b26491c5079eef07e5202477c16fe8cca0a2a596a97f203b203de1aef6913b080db9b838e093dbae7cbb6df4de709
SSDEEP 24576:WBS9qQEK6QywlBqH82QoXFkrzkmmlSgRDko0lG4Z8r7Qfd7iu5b:WZaClSFlG4ZM7QlV5
TLSH
T1F1557C13F692C0F1E61C227124FB6339BE7497450A71CACBE794DD791C32691ABA720E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.3MB
SHA256 80c33eb81d73a1f25ca35409852c986a37969b2e5142e98e3062fcfcefc9aa74
MD5 0555d67ae54ebd28d7c1191be38f0165
SHA1 70e5f5dcdb670df3cb0f5585787e457f7a9f0652
SHA512 1245f9debc71d1d670c1ff9e4049e50ff561c86eba46d32675bfd1f782e70be46a625cd5e75062ea3e69eedf026247e6ace52f90662a5f39ab6ee5b12db2e053
SSDEEP 24576:WBS9qQEK6QywlBqH82QoXFkrzkmmlSgRDko0lG4Z8r7Qfd7iu5r:WZaClSFlG4ZM7QlVp
TLSH
T17F557C13F692C0F1E61C227124FB6339BE7497450A71CACBE794DD791C32691ABA720E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4800-10-0x0000000000400000-0x0000000000551000-memory.dmp

Download

memory/4800-12-0x0000000000400000-0x0000000000551000-memory.dmp

Download