flyagent | 2f2929be0c06659e1fe1b6e39f6ee3b14b8f21f7cfef06360c68a94c3cc8ff52

Analysis

max time kernel
48s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 09:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2f2929be0c06659e1fe1b6e39f6ee3b14b8f21f7cfef06360c68a94c3cc8ff52.exe
Size 1.1MB
Sample260809-lwdelsvfmd
SHA256 2f2929be0c06659e1fe1b6e39f6ee3b14b8f21f7cfef06360c68a94c3cc8ff52
MD5 69d630ecd9f701e1b89217cc9668ce70
SHA1 493615ef43c57d059f2c7367fc6ac9aea8442228
SHA512 c62bda39ebb9dcb0c1f6af115887fe0fe77e7b6d93d9b5690b40929e43ec9d32c6a1cc218f16a8e58b7ced61bdfae2e3caee9b52a308be795f9c6923b10d85b6
SSDEEP 24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Qk:acallSllG4ZM7QzMD
TLSH
T1C1458D13F292C0F1E61C227124FB6339BE749B450A71CAC7E795DD791C32691ABA720E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery execution flyagent

Malware Config

Signatures

Family: FlyAgent
FlyAgent is a backdoor written in C++.
backdoor flyagent

Detects FlyAgent Backdoor 2 IoCs

resource	yara_rule
behavioral2/memory/4964-0-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent
behavioral2/memory/4964-18-0x0000000000400000-0x000000000055F000-memory.dmp	flyagent

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
5092	WScript.exe
3656	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2f2929be0c06659e1fe1b6e39f6ee3b14b8f21f7cfef06360c68a94c3cc8ff52.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	2f2929be0c06659e1fe1b6e39f6ee3b14b8f21f7cfef06360c68a94c3cc8ff52.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4964	2f2929be0c06659e1fe1b6e39f6ee3b14b8f21f7cfef06360c68a94c3cc8ff52.exe
4964	2f2929be0c06659e1fe1b6e39f6ee3b14b8f21f7cfef06360c68a94c3cc8ff52.exe
4964	2f2929be0c06659e1fe1b6e39f6ee3b14b8f21f7cfef06360c68a94c3cc8ff52.exe
4964	2f2929be0c06659e1fe1b6e39f6ee3b14b8f21f7cfef06360c68a94c3cc8ff52.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4964	2f2929be0c06659e1fe1b6e39f6ee3b14b8f21f7cfef06360c68a94c3cc8ff52.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4964	2f2929be0c06659e1fe1b6e39f6ee3b14b8f21f7cfef06360c68a94c3cc8ff52.exe
4964	2f2929be0c06659e1fe1b6e39f6ee3b14b8f21f7cfef06360c68a94c3cc8ff52.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 5092	4964	2f2929be0c06659e1fe1b6e39f6ee3b14b8f21f7cfef06360c68a94c3cc8ff52.exe	90
PID 4964 wrote to memory of 3656	4964	2f2929be0c06659e1fe1b6e39f6ee3b14b8f21f7cfef06360c68a94c3cc8ff52.exe	89

C:\Users\Admin\AppData\Local\Temp\2f2929be0c06659e1fe1b6e39f6ee3b14b8f21f7cfef06360c68a94c3cc8ff52.exe
"C:\Users\Admin\AppData\Local\Temp\2f2929be0c06659e1fe1b6e39f6ee3b14b8f21f7cfef06360c68a94c3cc8ff52.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:3656
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:5092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 753B
SHA256 fddf5ea9de4b8e88cac58ebdb6811b69da7f506bc53603c1ca9d886338cd578e
MD5 d58b908addf227e6d1e5b73f6f2f2f6a
SHA1 011383fc8935bf7b4d549cf8c9655c76056ba63c
SHA512 13dc4cd26b494ad2513dc2d7d1429c48a6b84e315d14de7a2fb9b61893234c468edda6293d6162b363312df79ab15daf1608253d3a478c2e1090580d13de9c3a
TLSH
T12601C014DD5C825DA13553B62532E44FE3E91493A303ACD9B89AC1A12F707588CB1A73
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4964-0-0x0000000000400000-0x000000000055F000-memory.dmp

Download

memory/4964-18-0x0000000000400000-0x000000000055F000-memory.dmp

Download