flyagent | 3b087cbbe12e2da9764cdfdafba80bb9c03b99c9b047fab6d156d9c9ac5838eb

Analysis

max time kernel
32s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 21:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3b087cbbe12e2da9764cdfdafba80bb9c03b99c9b047fab6d156d9c9ac5838eb.exe
Size 1.4MB
Sample260804-1abq8aen2s
SHA256 3b087cbbe12e2da9764cdfdafba80bb9c03b99c9b047fab6d156d9c9ac5838eb
MD5 03800fff910612a6f28274e208e800a8
SHA1 a0975070e66f41ad3918157d05a5ae2481af78cb
SHA512 e0fc73fdaaac70ef91d3d4441630f0b0f93ab1d80156d4b92172ca39ab37c2ded4f5c1534a8b44801a6fd5a33127a7bc4dd02679992ff99adea33334e20992ea
SSDEEP 24576:faMoNmfTEs86C9r5m84DVTh22rFvGf9VLegQEollG4uXpeTR6v:f0NeEs86FvMLejlG4uYA
TLSH
T170659E27E9C180F2C198107168AB1F35FEB456912E358B83A7D4EEB85F72790DA3721D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery execution flyagent

Malware Config

Signatures

Family: FlyAgent
FlyAgent is a backdoor written in C++.
backdoor flyagent

Detects FlyAgent Backdoor 2 IoCs

resource	yara_rule
behavioral2/memory/1104-21-0x0000000000400000-0x000000000056D000-memory.dmp	flyagent
behavioral2/memory/1104-32-0x0000000000400000-0x000000000056D000-memory.dmp	flyagent

Executes a VBScript file via the Windows Script Host. 1 TTPs 3 IoCs

execution

Visual Basic

T1059.005

pid	Process
2516	WScript.exe
2692	WScript.exe
5480	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3b087cbbe12e2da9764cdfdafba80bb9c03b99c9b047fab6d156d9c9ac5838eb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	3b087cbbe12e2da9764cdfdafba80bb9c03b99c9b047fab6d156d9c9ac5838eb.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1104	3b087cbbe12e2da9764cdfdafba80bb9c03b99c9b047fab6d156d9c9ac5838eb.exe
1104	3b087cbbe12e2da9764cdfdafba80bb9c03b99c9b047fab6d156d9c9ac5838eb.exe
1104	3b087cbbe12e2da9764cdfdafba80bb9c03b99c9b047fab6d156d9c9ac5838eb.exe
1104	3b087cbbe12e2da9764cdfdafba80bb9c03b99c9b047fab6d156d9c9ac5838eb.exe
1104	3b087cbbe12e2da9764cdfdafba80bb9c03b99c9b047fab6d156d9c9ac5838eb.exe
1104	3b087cbbe12e2da9764cdfdafba80bb9c03b99c9b047fab6d156d9c9ac5838eb.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1104	3b087cbbe12e2da9764cdfdafba80bb9c03b99c9b047fab6d156d9c9ac5838eb.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1104	3b087cbbe12e2da9764cdfdafba80bb9c03b99c9b047fab6d156d9c9ac5838eb.exe
1104	3b087cbbe12e2da9764cdfdafba80bb9c03b99c9b047fab6d156d9c9ac5838eb.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 5480	1104	3b087cbbe12e2da9764cdfdafba80bb9c03b99c9b047fab6d156d9c9ac5838eb.exe	89
PID 1104 wrote to memory of 2516	1104	3b087cbbe12e2da9764cdfdafba80bb9c03b99c9b047fab6d156d9c9ac5838eb.exe	91
PID 1104 wrote to memory of 2692	1104	3b087cbbe12e2da9764cdfdafba80bb9c03b99c9b047fab6d156d9c9ac5838eb.exe	90

C:\Users\Admin\AppData\Local\Temp\3b087cbbe12e2da9764cdfdafba80bb9c03b99c9b047fab6d156d9c9ac5838eb.exe
"C:\Users\Admin\AppData\Local\Temp\3b087cbbe12e2da9764cdfdafba80bb9c03b99c9b047fab6d156d9c9ac5838eb.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:5480
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:2692
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:2516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 753B
SHA256 10639173fe3fc3558372bbb1abb19cc80dd78b8ba1f838dd30e257a34c0c242f
MD5 7b59782c46cd5ff60cea39404418741d
SHA1 c28b0792a19ead76bbd943d48c68608dca83a971
SHA512 2def2617d3fcd72f46e5d455180bc9424cb2429865a2c7da13aa4b11b0a2be1513d89d96109384bcd1daf5579f9cb89f12bcb10672469ba8ae289584638f6e6c
TLSH
T1F101FE00ED6CC259607553B62932A40EF3EA1423A303ACD9B895D9A62F7076CDDB5E37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1104-21-0x0000000000400000-0x000000000056D000-memory.dmp

Download

memory/1104-32-0x0000000000400000-0x000000000056D000-memory.dmp

Download