flyagent | 70bdacf54200a9ff5756882921230b32f4511eec6c8a3770a89b413547acd0e1

Analysis

max time kernel
52s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 05:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
70bdacf54200a9ff5756882921230b32f4511eec6c8a3770a89b413547acd0e1.exe
Size 1.2MB
Sample260722-fx3s1adn2w
SHA256 70bdacf54200a9ff5756882921230b32f4511eec6c8a3770a89b413547acd0e1
MD5 03ec8b7ba86cce7da1fc644e1a09ffc7
SHA1 82442db1db314b5fe68cf6c3e08410bb057e11b1
SHA512 4af5eb75568df2906fe7a971060837e7f45cc5d3c8130a98e29c880a1fb5e10f93af5a8feb3370be7ccae44c9a6f9c076cf2dc26c51181e29548f1a47d645ea7
SSDEEP 24576:BjtC6RxD1hMbipXcvvX8wirRtcuO2hl5GdYquD+oHlG4Xt4JgPJCj8zDVpJEo:BjtxttI2vquflG4XtggPJMjo
TLSH
T1C645AE23F18280F2C728113118FB1735FEB897565A70CA9BE7D4DE781D63251AB6B21E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery execution flyagent persistence

Malware Config

Signatures

Family: FlyAgent
FlyAgent is a backdoor written in C++.
backdoor flyagent

Detects FlyAgent Backdoor 9 IoCs

resource	yara_rule
behavioral2/memory/2556-0-0x0000000000400000-0x0000000000576000-memory.dmp	flyagent
behavioral2/files/0x000f00000001b85c-17.dat	flyagent
behavioral2/memory/2556-25-0x0000000000400000-0x0000000000576000-memory.dmp	flyagent
behavioral2/memory/2556-28-0x0000000000400000-0x0000000000576000-memory.dmp	flyagent
behavioral2/memory/2556-31-0x0000000000400000-0x0000000000576000-memory.dmp	flyagent
behavioral2/memory/2556-35-0x0000000000400000-0x0000000000576000-memory.dmp	flyagent
behavioral2/memory/2556-38-0x0000000000400000-0x0000000000576000-memory.dmp	flyagent
behavioral2/memory/2556-41-0x0000000000400000-0x0000000000576000-memory.dmp	flyagent
behavioral2/memory/2556-44-0x0000000000400000-0x0000000000576000-memory.dmp	flyagent

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.lnk	70bdacf54200a9ff5756882921230b32f4511eec6c8a3770a89b413547acd0e1.exe

Executes dropped EXE 1 IoCs

pid	Process
3772	svchcst.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\360safo = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\svchcst.exe"	70bdacf54200a9ff5756882921230b32f4511eec6c8a3770a89b413547acd0e1.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
3424	WScript.exe
1064	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	70bdacf54200a9ff5756882921230b32f4511eec6c8a3770a89b413547acd0e1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings	70bdacf54200a9ff5756882921230b32f4511eec6c8a3770a89b413547acd0e1.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2556	70bdacf54200a9ff5756882921230b32f4511eec6c8a3770a89b413547acd0e1.exe
2556	70bdacf54200a9ff5756882921230b32f4511eec6c8a3770a89b413547acd0e1.exe
2556	70bdacf54200a9ff5756882921230b32f4511eec6c8a3770a89b413547acd0e1.exe
2556	70bdacf54200a9ff5756882921230b32f4511eec6c8a3770a89b413547acd0e1.exe
2556	70bdacf54200a9ff5756882921230b32f4511eec6c8a3770a89b413547acd0e1.exe
2556	70bdacf54200a9ff5756882921230b32f4511eec6c8a3770a89b413547acd0e1.exe
2556	70bdacf54200a9ff5756882921230b32f4511eec6c8a3770a89b413547acd0e1.exe
2556	70bdacf54200a9ff5756882921230b32f4511eec6c8a3770a89b413547acd0e1.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2556	70bdacf54200a9ff5756882921230b32f4511eec6c8a3770a89b413547acd0e1.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2556	70bdacf54200a9ff5756882921230b32f4511eec6c8a3770a89b413547acd0e1.exe
2556	70bdacf54200a9ff5756882921230b32f4511eec6c8a3770a89b413547acd0e1.exe
3772	svchcst.exe
3772	svchcst.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 3424	2556	70bdacf54200a9ff5756882921230b32f4511eec6c8a3770a89b413547acd0e1.exe	90
PID 2556 wrote to memory of 1064	2556	70bdacf54200a9ff5756882921230b32f4511eec6c8a3770a89b413547acd0e1.exe	89

C:\Users\Admin\AppData\Local\Temp\70bdacf54200a9ff5756882921230b32f4511eec6c8a3770a89b413547acd0e1.exe
"C:\Users\Admin\AppData\Local\Temp\70bdacf54200a9ff5756882921230b32f4511eec6c8a3770a89b413547acd0e1.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:1064
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:3424

C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Config.ini

Path C:\Users\Admin\AppData\Roaming\Microsoft\Config.ini
Size 92B
SHA256 7bfcc2f0d3c25f895eac6676d4ce9f16713149206980fb97f4aa4272e82ed2b8
MD5 616ffedca89dfde66c19c781ec4933c5
SHA1 05d28ae3243fbaed0b925f218c1c7c71a5dbbca1
SHA512 8a6fa82b124203512e1ed3d4ad037df7a3c2ec3d8f1db6b5d4e591ccb08c1c44b2a8589d769697c0f1ea35e711b38eb8fbab3fa3a24be99d099782b9c6c25a8f
MD5 SHA1 SHA512

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 753B
SHA256 d50f747c5290cd10e783a782eaa7ba2aa750c392102a3c0a6992209d8709d9fa
MD5 65874d308d8eb8831ce4b970d921144f
SHA1 79c18bf9dcc1678cefe7a6c1804f2d8a4fb8914a
SHA512 b9404ae360bd6acbbbeda6ca3b113751aec02881d5d729eb98c7bf68d5429f581944541982066d96b39878c710291393982196f412e74758cf82c7f18d12f5a6
TLSH
T18001CB10ED6CD22C603553B22832E84EFBAE1553B303ACD9B859D0612FB066C9DB5A36
MD5 SHA1 SHA512 TLSH

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.2MB
SHA256 caf55f2441ea483d5f732ce164f5ab9091bbbaf2206283fac90305761274431c
MD5 d2065cb3c0d0a864edd3e9f383276697
SHA1 188c1db30d44a5c8def07d4e983754ce13d0f533
SHA512 64b613899ca72e18ff1288afd3c8b94ecbef3bb6c457c371b62db877b3257f61294f4e7ed10f746e8ec74626389c4479e8b213e49149d8434bec3354c82d2551
SSDEEP 24576:BjtC6RxD1hMbipXcvvX8wirRtcuO2hl5GdYquD+oHlG4Xt4JgPJCj8zDVpJEd:BjtxttI2vquflG4XtggPJMjd
TLSH
T1A445AE23F18280F2C728113118FB1735FEB897565A70CA9BE7D4DE781D63251AB6B21E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2556-0-0x0000000000400000-0x0000000000576000-memory.dmp

Download

memory/2556-25-0x0000000000400000-0x0000000000576000-memory.dmp

Download

memory/2556-28-0x0000000000400000-0x0000000000576000-memory.dmp

Download

memory/2556-31-0x0000000000400000-0x0000000000576000-memory.dmp

Download

memory/2556-35-0x0000000000400000-0x0000000000576000-memory.dmp

Download

memory/2556-38-0x0000000000400000-0x0000000000576000-memory.dmp

Download

memory/2556-41-0x0000000000400000-0x0000000000576000-memory.dmp

Download

memory/2556-44-0x0000000000400000-0x0000000000576000-memory.dmp

Download