Analysis
- user interaction
yes - max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/08/2026, 02:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Mystic FiveM.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
Mystic FiveM.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target Mystic FiveM.exe
- Size 3.1MB
- Sample260809-ckskqagj9v
- SHA256 7b31a8d2a8a6f1bdccdd92a12580dbd20aae82502d829072f960a845ae523f29
- MD5 d38f4f9a4e5fff6195f203df4c20ac56
- SHA1 8faae2b2b7fedc6792e861f199320552ee8838af
- SHA512 d698fece5962a7602be18b2ae6c0399e1f6543329c86dbc0b7cbd90e685b49984d958265155e93f9ccf5a97c481a8c0bf54b631508d6f7b07b8387b712f654d1
- SSDEEP 49152:AJ9rIzbbM3aAcSzYJzxmmcHKe6v8AMxPGsEpf30/qP2T8+HED90YdaplIiB47l8:Aebg3GMmcHKe6v8AMO30i+plrB47l8
- TLSH T1E6E5CF47A3A501ECC567D038C646961BE772744913209BDB27E48AA96FE3AE02F3F351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
pid Process 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1916 cmd.exe - Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe 3424 Mystic FiveM.exe - Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3424 Mystic FiveM.exe Token: SeSecurityPrivilege 3424 Mystic FiveM.exe Token: SeTakeOwnershipPrivilege 3424 Mystic FiveM.exe Token: SeLoadDriverPrivilege 3424 Mystic FiveM.exe Token: SeSystemProfilePrivilege 3424 Mystic FiveM.exe Token: SeSystemtimePrivilege 3424 Mystic FiveM.exe Token: SeProfSingleProcessPrivilege 3424 Mystic FiveM.exe Token: SeIncBasePriorityPrivilege 3424 Mystic FiveM.exe Token: SeCreatePagefilePrivilege 3424 Mystic FiveM.exe Token: SeBackupPrivilege 3424 Mystic FiveM.exe Token: SeRestorePrivilege 3424 Mystic FiveM.exe Token: SeShutdownPrivilege 3424 Mystic FiveM.exe Token: SeDebugPrivilege 3424 Mystic FiveM.exe Token: SeSystemEnvironmentPrivilege 3424 Mystic FiveM.exe Token: SeChangeNotifyPrivilege 3424 Mystic FiveM.exe Token: SeRemoteShutdownPrivilege 3424 Mystic FiveM.exe Token: SeUndockPrivilege 3424 Mystic FiveM.exe Token: SeManageVolumePrivilege 3424 Mystic FiveM.exe Token: SeImpersonatePrivilege 3424 Mystic FiveM.exe Token: SeCreateGlobalPrivilege 3424 Mystic FiveM.exe Token: 33 3424 Mystic FiveM.exe Token: 34 3424 Mystic FiveM.exe Token: 35 3424 Mystic FiveM.exe Token: 36 3424 Mystic FiveM.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3424 wrote to memory of 1916 3424 Mystic FiveM.exe 85 PID 1916 wrote to memory of 400 1916 cmd.exe 90 PID 1916 wrote to memory of 1496 1916 cmd.exe 91 PID 1916 wrote to memory of 1536 1916 cmd.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\Mystic FiveM.exe"C:\Users\Admin\AppData\Local\Temp\Mystic FiveM.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Mystic FiveM.exe" MD5 | find /i /v "md5" | find /i /v "certutil"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\system32\certutil.execertutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Mystic FiveM.exe" MD53⤵PID:400
-
-
C:\Windows\system32\find.exefind /i /v "md5"3⤵PID:1496
-
-
C:\Windows\system32\find.exefind /i /v "certutil"3⤵PID:1536
-
-