flyagent | 368f8c5091eaab758b5924a4fb3309203461d7cf6c3c0a7b052aaf74d6e92698

Analysis

max time kernel
113s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 06:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
368f8c5091eaab758b5924a4fb3309203461d7cf6c3c0a7b052aaf74d6e92698.exe
Size 1.3MB
Sample260602-hat9fsfs8y
SHA256 368f8c5091eaab758b5924a4fb3309203461d7cf6c3c0a7b052aaf74d6e92698
MD5 391990a609c6fe4a8a7c1aff3f8b2f7b
SHA1 a95c74dec877fe9fd95e7ec8bfbcad36724bb9e7
SHA512 7ae1ba82492fe84171e1f4f6bd1a4528d9eddf58c0d42f453f5dfd45b374024d2162d87230dad4b568ab8593be6b7916dcddc3bc4beab367ea9e518ecf9bf23f
SSDEEP 24576:WBS9qQEK6QywlBqH82QoXFkrzkmmlSgRDko0lG4Z8r7Qfd7iu5I:WZaClSFlG4ZM7QlVW
TLSH
T18C557C13F692C0F1E61C227124FB6339BE7497450A71CACBE794DD791C32691ABA720E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery flyagent

Malware Config

Signatures

Family: FlyAgent
FlyAgent is a backdoor written in C++.
backdoor flyagent

Detects FlyAgent Backdoor 5 IoCs

resource	yara_rule
behavioral2/memory/5132-10-0x0000000000400000-0x0000000000551000-memory.dmp	flyagent
behavioral2/memory/5132-12-0x0000000000400000-0x0000000000551000-memory.dmp	flyagent
behavioral2/files/0x00120000000261ad-13.dat	flyagent
behavioral2/files/0x000b00000002a41c-25.dat	flyagent
behavioral2/files/0x00130000000261ad-27.dat	flyagent

Deletes itself 1 IoCs

pid	Process
4284	svchcst.exe

Executes dropped EXE 2 IoCs

pid	Process
4284	svchcst.exe
3792	svchcst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	368f8c5091eaab758b5924a4fb3309203461d7cf6c3c0a7b052aaf74d6e92698.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings	svchcst.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings	svchcst.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings	368f8c5091eaab758b5924a4fb3309203461d7cf6c3c0a7b052aaf74d6e92698.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	WScript.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5132	368f8c5091eaab758b5924a4fb3309203461d7cf6c3c0a7b052aaf74d6e92698.exe
5132	368f8c5091eaab758b5924a4fb3309203461d7cf6c3c0a7b052aaf74d6e92698.exe
5132	368f8c5091eaab758b5924a4fb3309203461d7cf6c3c0a7b052aaf74d6e92698.exe
5132	368f8c5091eaab758b5924a4fb3309203461d7cf6c3c0a7b052aaf74d6e92698.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe
4284	svchcst.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5132	368f8c5091eaab758b5924a4fb3309203461d7cf6c3c0a7b052aaf74d6e92698.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
5132	368f8c5091eaab758b5924a4fb3309203461d7cf6c3c0a7b052aaf74d6e92698.exe
5132	368f8c5091eaab758b5924a4fb3309203461d7cf6c3c0a7b052aaf74d6e92698.exe
4284	svchcst.exe
4284	svchcst.exe
3792	svchcst.exe
3792	svchcst.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5132 wrote to memory of 2112	5132	368f8c5091eaab758b5924a4fb3309203461d7cf6c3c0a7b052aaf74d6e92698.exe	80
PID 5132 wrote to memory of 1056	5132	368f8c5091eaab758b5924a4fb3309203461d7cf6c3c0a7b052aaf74d6e92698.exe	81
PID 1056 wrote to memory of 4284	1056	WScript.exe	83
PID 4284 wrote to memory of 4712	4284	svchcst.exe	84
PID 4284 wrote to memory of 128	4284	svchcst.exe	85
PID 4712 wrote to memory of 3792	4712	WScript.exe	86
PID 3792 wrote to memory of 4032	3792	svchcst.exe	87

C:\Users\Admin\AppData\Local\Temp\368f8c5091eaab758b5924a4fb3309203461d7cf6c3c0a7b052aaf74d6e92698.exe
"C:\Users\Admin\AppData\Local\Temp\368f8c5091eaab758b5924a4fb3309203461d7cf6c3c0a7b052aaf74d6e92698.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5132
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:2112
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1056
- - C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
    3⤵
    - Deletes itself
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4284
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4712
    - - C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3792
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4032
        
        C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
        7⤵
        
        PID:3256
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        8⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        8⤵
        
        PID:3316
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      4⤵
      System Location Discovery: System Language Discovery
      PID:128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Config.ini

Path C:\Users\Admin\AppData\Roaming\Microsoft\Config.ini
Size 92B
SHA256 44063c266686263f14cd2a83fee124fb3e61a9171a6aab69709464f49511011d
MD5 67b9b3e2ded7086f393ebbc36c5e7bca
SHA1 e6299d0450b9a92a18cc23b5704a2b475652c790
SHA512 826fbc9481f46b1ae3db828a665c55c349023caf563e6e8c17321f5f3af3e4c3914955db6f0eebfc6defe561315435d47310b4d0499ab9c2c85bb61264dedc09
MD5 SHA1 SHA512

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 696B
SHA256 5f341c2f1ff381eecedbf6fcbe549724323c30c05728132a98ea55f607bc3e81
MD5 5d0d203da02edb604545d3d826c88b42
SHA1 9be0cfd40b48d4e6041e00827047a8b0d877d4a1
SHA512 a3e01552a9576ba8dd9aa9f65211f74a69588a316d984b8887e740c6c174e19df2056dc0138d5af26bd927e192ec2c7d355fc8b4092e30d55de910e932fbd49f
TLSH
T158019400DD4C8268603953B62532A40FF7AA1563A303ACE8B899D0A52FB076C9DB4A36
MD5 SHA1 SHA512 TLSH

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 696B
SHA256 b0544b1226f7cfd08fbffa33537e742cae314ef9ebc6a146d9aae7ead895ae1f
MD5 d04e4fa1d3c8ba67f98c8e40c157ed97
SHA1 c0d95df53f8a804370ce7230fd02b9e58f75ec22
SHA512 7436211ec14314df3689406a0b828f28a337929922fe1d381569b3eedc40dd9639764a73adfb033ede68ff760c5c0429de44a865e96f105cd0a2b6ec80269890
TLSH
T14B019900DD4C8258503553B62472A40FF7AA1553A303ACE8B899D0B52F707689CB4A32
MD5 SHA1 SHA512 TLSH

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 696B
SHA256 3dc5ae697f3f5a3ffe053412e05a646883c49be29b179039ceadf5f71a595f9d
MD5 8cb32754e88999ece2a392d94875313e
SHA1 da0ef4e297872b82db206ebdc4cafefeed2a4e3d
SHA512 a331a2472d0ef04f4d6a9b41a147020a688c96977feec8d61878f31382af8c27b8e990dc404137475d48f0155d600cc0d6ebe0a5d1cbb60b1fecf364301ebaa7
TLSH
T169019900DD4CC258503553B62432E40FF7AA1553A303ACE8B899D0B52FB07689DB4A33
MD5 SHA1 SHA512 TLSH

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 753B
SHA256 277497985e18852bc1664e8ea03c54cf0f9a85896b4a8d1e5fbbb9e1a9fbfcb0
MD5 ea7f46bda963922076a29a4e0e798490
SHA1 9d3aa230c2395117c25f8ad001241f42c7f78a33
SHA512 ae59127f79849de224136de52ff35d023db12cabcc6e96cbbb1b635851d87fb000222951a11bb5c9f3da3503320dde88c807db017a9a8db41360f7121a4bff96
TLSH
T18401F410FD4CC259503597B22432E40EF7EA155363039CD8B855D4A53F7076C9DB4A77
MD5 SHA1 SHA512 TLSH

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.3MB
SHA256 1900877fce8421ca33f3683f7cb9a3ed28a6057e195dfb61dc6dcff26270310b
MD5 d48c1b4e3fa4bf4aeccbff5331a4f164
SHA1 32dd786f1d74edbfad8a75929cd79e3b99ae2946
SHA512 bcc30ddd5688732203a2667c8d792affe07ca60075bb2949b4307f6db3a213603f2327096205035b64bea965fb6975b66baf4888e2916ba523ed251f2b8f9ee5
SSDEEP 24576:WBS9qQEK6QywlBqH82QoXFkrzkmmlSgRDko0lG4Z8r7Qfd7iu56:WZaClSFlG4ZM7QlV8
TLSH
T195557C13F692C0F1E61C227124FB6339BE7497450A71CACBE794DD791C32691ABA720E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.3MB
SHA256 16a9f4233db63b21e864f68e712cecd55acbe3fcfc6583cbb6b0419a1dbe924e
MD5 596086525169389b253c3932e83cf12e
SHA1 dfc90b9078814d6a8e81da2f4834dea26451913f
SHA512 4cff65bac81100685600098555678338860144a6b08c7879e2d0ce93ec9d7a2484cb20c60dd3fa244fd45c93bc127b40e3d449aa69261e5a5a937ad931e1def1
SSDEEP 24576:WBS9qQEK6QywlBqH82QoXFkrzkmmlSgRDko0lG4Z8r7Qfd7iu5u:WZaClSFlG4ZM7QlVQ
TLSH
T1DA557C13F692C0F1E61C227124FB6339BE7497450A71CACBE794DD791C32691ABA720E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.3MB
SHA256 e770a10771426a7a734715300c77b26f3d7dc7dd8a3df3f2c0c29f2269069137
MD5 5ecb84e0a55de771a0a1430436ab504d
SHA1 6baf3b910946e7a6a41920b2d0a0eca7a5a98b68
SHA512 840ba19b3c2ec1b6f41d80278bebbac0a25b9151392c446888a5498cd6b6867bc5c70a58ef0182d4e8b62cb634a745c3f1ea86c79f30b582a78784ee8f5cd54b
SSDEEP 24576:WBS9qQEK6QywlBqH82QoXFkrzkmmlSgRDko0lG4Z8r7Qfd7iu5g:WZaClSFlG4ZM7QlVe
TLSH
T122557C13F692C0F1E61C227124FB6339BE7497450A71CACBE794DD791C32691ABA720E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5132-10-0x0000000000400000-0x0000000000551000-memory.dmp

Download

memory/5132-12-0x0000000000400000-0x0000000000551000-memory.dmp

Download