flyagent | 29199045761d496282c149a1dddc15b7e6c180f7bf585dddcb239c1669b427e8

Analysis

max time kernel
32s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 05:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
29199045761d496282c149a1dddc15b7e6c180f7bf585dddcb239c1669b427e8.exe
Size 1.7MB
Sample260819-gpj7csem6s
SHA256 29199045761d496282c149a1dddc15b7e6c180f7bf585dddcb239c1669b427e8
MD5 f5c81c0896bd19a9052969dff10580d4
SHA1 e053249eb17d4b9af664259c9a4a4c411554ab2c
SHA512 dbcb768a482e21ab4a88825353e1bcdb9c1b6d361f239498b725d5e5630afa9c71597b7dd3481bf25b1d1a533ee77ab4b71cd82b3822cc932c9cf40973bba456
SSDEEP 24576:oqg8zeKPja85nd0T9RAN0P30mqym6hzsGoRlG4qqjwg1mRW/u85tW2rcO36Umpqz:o4zeI/0XqymkulG4qmxmAuitlcI6UP
TLSH
T19A85AF13B6C156B2C25D1233A1721334ABF6D9072A29CB87B794EDF91E623139E1731B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery execution flyagent persistence privilege_escalation

Malware Config

Signatures

Family: FlyAgent
FlyAgent is a backdoor written in C++.
backdoor flyagent

Detects FlyAgent Backdoor 10 IoCs

resource	yara_rule
behavioral2/memory/6664-0-0x0000000000400000-0x0000000000553000-memory.dmp	flyagent
behavioral2/files/0x000c00000001c660-17.dat	flyagent
behavioral2/memory/4396-25-0x0000000000400000-0x0000000000553000-memory.dmp	flyagent
behavioral2/memory/6664-26-0x0000000000400000-0x0000000000553000-memory.dmp	flyagent
behavioral2/memory/6664-29-0x0000000000400000-0x0000000000553000-memory.dmp	flyagent
behavioral2/memory/6664-32-0x0000000000400000-0x0000000000553000-memory.dmp	flyagent
behavioral2/memory/6664-36-0x0000000000400000-0x0000000000553000-memory.dmp	flyagent
behavioral2/memory/6664-39-0x0000000000400000-0x0000000000553000-memory.dmp	flyagent
behavioral2/memory/6664-42-0x0000000000400000-0x0000000000553000-memory.dmp	flyagent
behavioral2/memory/6664-45-0x0000000000400000-0x0000000000553000-memory.dmp	flyagent

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.lnk	29199045761d496282c149a1dddc15b7e6c180f7bf585dddcb239c1669b427e8.exe

Executes dropped EXE 1 IoCs

pid	Process
4396	svchcst.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\360safo = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\svchcst.exe"	29199045761d496282c149a1dddc15b7e6c180f7bf585dddcb239c1669b427e8.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
6316	WScript.exe
1428	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	29199045761d496282c149a1dddc15b7e6c180f7bf585dddcb239c1669b427e8.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings	29199045761d496282c149a1dddc15b7e6c180f7bf585dddcb239c1669b427e8.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
6664	29199045761d496282c149a1dddc15b7e6c180f7bf585dddcb239c1669b427e8.exe
6664	29199045761d496282c149a1dddc15b7e6c180f7bf585dddcb239c1669b427e8.exe
6664	29199045761d496282c149a1dddc15b7e6c180f7bf585dddcb239c1669b427e8.exe
6664	29199045761d496282c149a1dddc15b7e6c180f7bf585dddcb239c1669b427e8.exe
6664	29199045761d496282c149a1dddc15b7e6c180f7bf585dddcb239c1669b427e8.exe
6664	29199045761d496282c149a1dddc15b7e6c180f7bf585dddcb239c1669b427e8.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
6664	29199045761d496282c149a1dddc15b7e6c180f7bf585dddcb239c1669b427e8.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
6664	29199045761d496282c149a1dddc15b7e6c180f7bf585dddcb239c1669b427e8.exe
6664	29199045761d496282c149a1dddc15b7e6c180f7bf585dddcb239c1669b427e8.exe
4396	svchcst.exe
4396	svchcst.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 6664 wrote to memory of 6316	6664	29199045761d496282c149a1dddc15b7e6c180f7bf585dddcb239c1669b427e8.exe	90
PID 6664 wrote to memory of 1428	6664	29199045761d496282c149a1dddc15b7e6c180f7bf585dddcb239c1669b427e8.exe	91

C:\Users\Admin\AppData\Local\Temp\29199045761d496282c149a1dddc15b7e6c180f7bf585dddcb239c1669b427e8.exe
"C:\Users\Admin\AppData\Local\Temp\29199045761d496282c149a1dddc15b7e6c180f7bf585dddcb239c1669b427e8.exe"
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6664
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:6316
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:1428

C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Config.ini

Path C:\Users\Admin\AppData\Roaming\Microsoft\Config.ini
Size 92B
SHA256 8e59e3dc5427519534af0cfb2713d94388d03240f4f6d2c9ec6a13db1d9812ab
MD5 5611518085f0e601b7af262b73ca1e21
SHA1 679e284b4e15030b11e9fcab9e54090f6128c6c2
SHA512 0fc4c396d00386c7942366bab8bf30b59723f4a8b0d5bfe00dbc4a74df13acb68cd6616694a81de199bcd2409ff41b6dcaca931614165deefadd728350c52bcc
MD5 SHA1 SHA512

Submit Download

VBS3.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
Size 753B
SHA256 91cb17cc7190403ac89bfdcd08e9f2f7804fcad779eba27dab1499a66d31153c
MD5 e341c77c23390a193479c388f836fce8
SHA1 59d9fbe6ff4f22552c305b8b44df21898d038335
SHA512 9ceda3daac23f90135ccb568fea6c7ef291a203a97eb310734a9261ed2827b000714ce2d79111a12f6d71547c2024bf1418702bd20df8ac7896f37bc01f13c25
TLSH
T16B01CB01ED5C8258A03553B22973E44AF3EA1553B303ACD9B889C0712FB06689CB4A32
MD5 SHA1 SHA512 TLSH

Submit Download

svchcst.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
Size 1.7MB
SHA256 307f3adb6b5c14af7f29ac6a2fd0c6371b071d9fba32ce04229810f896826f52
MD5 22a81bf8feedb0fd1b337fbe258ee73b
SHA1 82bec7fa010954e514cc527bb7c8e71f4876872d
SHA512 98b4ead7225ddf823e99fae21c14180c9e70494c7af5b543a433579dc4d2cc5f84997f8d5f7f8a3a7d3fa160afa3abe10b50ebb1c9e915a7b5e4b1449ff420d0
SSDEEP 24576:oqg8zeKPja85nd0T9RAN0P30mqym6hzsGoRlG4qqjwg1mRW/u85tW2rcO36UmpqR:o4zeI/0XqymkulG4qmxmAuitlcI6UN
TLSH
T1DD85AF13B6C156B2C25D1233A1721334ABF6D9072A29CB87B794EDF91E623139E1731B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4396-25-0x0000000000400000-0x0000000000553000-memory.dmp

Download

memory/6664-0-0x0000000000400000-0x0000000000553000-memory.dmp

Download

memory/6664-26-0x0000000000400000-0x0000000000553000-memory.dmp

Download

memory/6664-29-0x0000000000400000-0x0000000000553000-memory.dmp

Download

memory/6664-32-0x0000000000400000-0x0000000000553000-memory.dmp

Download

memory/6664-36-0x0000000000400000-0x0000000000553000-memory.dmp

Download

memory/6664-39-0x0000000000400000-0x0000000000553000-memory.dmp

Download

memory/6664-42-0x0000000000400000-0x0000000000553000-memory.dmp

Download

memory/6664-45-0x0000000000400000-0x0000000000553000-memory.dmp

Download