flyagent | bcc15fe1d2bcde7508a4bce697b5b2f1581643df559b461e218f555a8dedc97f

Analysis

max time kernel
40s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 11:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bcc15fe1d2bcde7508a4bce697b5b2f1581643df559b461e218f555a8dedc97f.exe
Size 1.7MB
Sample260816-n4mpcsxtfw
SHA256 bcc15fe1d2bcde7508a4bce697b5b2f1581643df559b461e218f555a8dedc97f
MD5 f5489ba3257f1e6b24e775f40b246cec
SHA1 4330ebf4a359dca5b8c5f49e126e45d85f483710
SHA512 695e0a4349050292fbe49ad81313dba1a90b04450cc6ff927f878c91a253a8c9ff3781d87f17ca9945926c8cfe7b588d45318bfc1cd2e9678eb3c1b6e39c04b1
SSDEEP 24576:oqg8zeKPja85nd0T9RAN0P30mqym6hzsGoRlG4qqjwg1mRW/u85tW2rcO36Umpqs:o4zeI/0XqymkulG4qmxmAuitlcI6UQ
TLSH
T1AB85AF13B6C156B2C25D1233A1721334ABF6D9072A29CB87B794EDF91E623139E1731B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery execution flyagent persistence privilege_escalation

Malware Config

Signatures

Family: FlyAgent
FlyAgent is a backdoor written in C++.
backdoor flyagent

Detects FlyAgent Backdoor 10 IoCs

resource	yara_rule
behavioral2/memory/2556-0-0x0000000000400000-0x0000000000553000-memory.dmp	flyagent
behavioral2/files/0x000e00000001c521-17.dat	flyagent
behavioral2/memory/4916-25-0x0000000000400000-0x0000000000553000-memory.dmp	flyagent
behavioral2/memory/2556-26-0x0000000000400000-0x0000000000553000-memory.dmp	flyagent
behavioral2/memory/2556-29-0x0000000000400000-0x0000000000553000-memory.dmp	flyagent
behavioral2/memory/2556-32-0x0000000000400000-0x0000000000553000-memory.dmp	flyagent
behavioral2/memory/2556-36-0x0000000000400000-0x0000000000553000-memory.dmp	flyagent
behavioral2/memory/2556-39-0x0000000000400000-0x0000000000553000-memory.dmp	flyagent
behavioral2/memory/2556-42-0x0000000000400000-0x0000000000553000-memory.dmp	flyagent
behavioral2/memory/2556-45-0x0000000000400000-0x0000000000553000-memory.dmp	flyagent

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.lnk	bcc15fe1d2bcde7508a4bce697b5b2f1581643df559b461e218f555a8dedc97f.exe

Executes dropped EXE 1 IoCs

pid	Process
4916	svchcst.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\360safo = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\svchcst.exe"	bcc15fe1d2bcde7508a4bce697b5b2f1581643df559b461e218f555a8dedc97f.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
4836	WScript.exe
5608	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bcc15fe1d2bcde7508a4bce697b5b2f1581643df559b461e218f555a8dedc97f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings	bcc15fe1d2bcde7508a4bce697b5b2f1581643df559b461e218f555a8dedc97f.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2556	bcc15fe1d2bcde7508a4bce697b5b2f1581643df559b461e218f555a8dedc97f.exe
2556	bcc15fe1d2bcde7508a4bce697b5b2f1581643df559b461e218f555a8dedc97f.exe
2556	bcc15fe1d2bcde7508a4bce697b5b2f1581643df559b461e218f555a8dedc97f.exe
2556	bcc15fe1d2bcde7508a4bce697b5b2f1581643df559b461e218f555a8dedc97f.exe
2556	bcc15fe1d2bcde7508a4bce697b5b2f1581643df559b461e218f555a8dedc97f.exe
2556	bcc15fe1d2bcde7508a4bce697b5b2f1581643df559b461e218f555a8dedc97f.exe
2556	bcc15fe1d2bcde7508a4bce697b5b2f1581643df559b461e218f555a8dedc97f.exe
2556	bcc15fe1d2bcde7508a4bce697b5b2f1581643df559b461e218f555a8dedc97f.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2556	bcc15fe1d2bcde7508a4bce697b5b2f1581643df559b461e218f555a8dedc97f.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2556	bcc15fe1d2bcde7508a4bce697b5b2f1581643df559b461e218f555a8dedc97f.exe
2556	bcc15fe1d2bcde7508a4bce697b5b2f1581643df559b461e218f555a8dedc97f.exe
4916	svchcst.exe
4916	svchcst.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 5608	2556	bcc15fe1d2bcde7508a4bce697b5b2f1581643df559b461e218f555a8dedc97f.exe	89
PID 2556 wrote to memory of 4836	2556	bcc15fe1d2bcde7508a4bce697b5b2f1581643df559b461e218f555a8dedc97f.exe	90

C:\Users\Admin\AppData\Local\Temp\bcc15fe1d2bcde7508a4bce697b5b2f1581643df559b461e218f555a8dedc97f.exe
"C:\Users\Admin\AppData\Local\Temp\bcc15fe1d2bcde7508a4bce697b5b2f1581643df559b461e218f555a8dedc97f.exe"
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:5608
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:4836

C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Config.ini

Path C:\Users\Admin\AppData\Roaming\Microsoft\Config.ini
Size 92B
SHA256 8e59e3dc5427519534af0cfb2713d94388d03240f4f6d2c9ec6a13db1d9812ab
MD5 5611518085f0e601b7af262b73ca1e21
SHA1 679e284b4e15030b11e9fcab9e54090f6128c6c2
SHA512 0fc4c396d00386c7942366bab8bf30b59723f4a8b0d5bfe00dbc4a74df13acb68cd6616694a81de199bcd2409ff41b6dcaca931614165deefadd728350c52bcc
MD5 SHA1 SHA512

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 753B
SHA256 1d046eabec76dc4dd300ad841234a6bed7cac054aed35425da375210244813ef
MD5 1dda79750068a3e576f213b574b8b3fa
SHA1 21c43dc590e3fd493481777b17cf8f9937081cfe
SHA512 abcf27252b48d44a3ff523bc4d9898b1f387fd25a63b687f4f3dc54f56028787fa0f53a81d12f1904c29e3f49784d880f4e3935fd9a84b28c07f3e1905827489
TLSH
T15801C010ED5C931C507443762472944FF7AA1553A3035CD87849D5713F70A589DB4A32
MD5 SHA1 SHA512 TLSH

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.7MB
SHA256 7e3aaaaaa5aa7d0dcaa30796671b7d4237987d1aadc22abfdea586d456dae245
MD5 9c75cf28d161a6e8618bbffaac8794a4
SHA1 b81cf4989d1d6886d132d3813bb38dd35e6a29af
SHA512 1da855918f840bbf4cbfc7d132e202bab591d5a41e087160ebdf5af4b6fb868ee8534d714ed39a30a3a1dfb53edc651df8c0c9a0f6a8821f40a8697b2d727055
SSDEEP 24576:oqg8zeKPja85nd0T9RAN0P30mqym6hzsGoRlG4qqjwg1mRW/u85tW2rcO36UmpqJ:o4zeI/0XqymkulG4qmxmAuitlcI6Ul
TLSH
T16A85AF13B6C156B2C25D1233A1721334ABF6D9072A29CB87B794EDF91E623139E1731B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2556-0-0x0000000000400000-0x0000000000553000-memory.dmp

Download

memory/2556-26-0x0000000000400000-0x0000000000553000-memory.dmp

Download

memory/2556-29-0x0000000000400000-0x0000000000553000-memory.dmp

Download

memory/2556-32-0x0000000000400000-0x0000000000553000-memory.dmp

Download

memory/2556-36-0x0000000000400000-0x0000000000553000-memory.dmp

Download

memory/2556-39-0x0000000000400000-0x0000000000553000-memory.dmp

Download

memory/2556-42-0x0000000000400000-0x0000000000553000-memory.dmp

Download

memory/2556-45-0x0000000000400000-0x0000000000553000-memory.dmp

Download

memory/4916-25-0x0000000000400000-0x0000000000553000-memory.dmp

Download