Analysis
- user interaction
yes - max time kernel
16s - max time network
11s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 02:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Mystic FiveM.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
Mystic FiveM.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target Mystic FiveM.exe
- Size 3.1MB
- Sample260809-ckskqagj9v
- SHA256 7b31a8d2a8a6f1bdccdd92a12580dbd20aae82502d829072f960a845ae523f29
- MD5 d38f4f9a4e5fff6195f203df4c20ac56
- SHA1 8faae2b2b7fedc6792e861f199320552ee8838af
- SHA512 d698fece5962a7602be18b2ae6c0399e1f6543329c86dbc0b7cbd90e685b49984d958265155e93f9ccf5a97c481a8c0bf54b631508d6f7b07b8387b712f654d1
- SSDEEP 49152:AJ9rIzbbM3aAcSzYJzxmmcHKe6v8AMxPGsEpf30/qP2T8+HED90YdaplIiB47l8:Aebg3GMmcHKe6v8AMO30i+plrB47l8
- TLSH T1E6E5CF47A3A501ECC567D038C646961BE772744913209BDB27E48AA96FE3AE02F3F351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
pid Process 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1976 cmd.exe - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe 3328 Mystic FiveM.exe - Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3328 Mystic FiveM.exe Token: SeSecurityPrivilege 3328 Mystic FiveM.exe Token: SeTakeOwnershipPrivilege 3328 Mystic FiveM.exe Token: SeLoadDriverPrivilege 3328 Mystic FiveM.exe Token: SeSystemProfilePrivilege 3328 Mystic FiveM.exe Token: SeSystemtimePrivilege 3328 Mystic FiveM.exe Token: SeProfSingleProcessPrivilege 3328 Mystic FiveM.exe Token: SeIncBasePriorityPrivilege 3328 Mystic FiveM.exe Token: SeCreatePagefilePrivilege 3328 Mystic FiveM.exe Token: SeBackupPrivilege 3328 Mystic FiveM.exe Token: SeRestorePrivilege 3328 Mystic FiveM.exe Token: SeShutdownPrivilege 3328 Mystic FiveM.exe Token: SeDebugPrivilege 3328 Mystic FiveM.exe Token: SeSystemEnvironmentPrivilege 3328 Mystic FiveM.exe Token: SeChangeNotifyPrivilege 3328 Mystic FiveM.exe Token: SeRemoteShutdownPrivilege 3328 Mystic FiveM.exe Token: SeUndockPrivilege 3328 Mystic FiveM.exe Token: SeManageVolumePrivilege 3328 Mystic FiveM.exe Token: SeImpersonatePrivilege 3328 Mystic FiveM.exe Token: SeCreateGlobalPrivilege 3328 Mystic FiveM.exe Token: 33 3328 Mystic FiveM.exe Token: 34 3328 Mystic FiveM.exe Token: 35 3328 Mystic FiveM.exe Token: 36 3328 Mystic FiveM.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3328 wrote to memory of 1976 3328 Mystic FiveM.exe 89 PID 1976 wrote to memory of 264 1976 cmd.exe 93 PID 1976 wrote to memory of 364 1976 cmd.exe 94 PID 1976 wrote to memory of 4880 1976 cmd.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\Mystic FiveM.exe"C:\Users\Admin\AppData\Local\Temp\Mystic FiveM.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Mystic FiveM.exe" MD5 | find /i /v "md5" | find /i /v "certutil"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\system32\certutil.execertutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Mystic FiveM.exe" MD53⤵PID:264
-
-
C:\Windows\system32\find.exefind /i /v "md5"3⤵PID:364
-
-
C:\Windows\system32\find.exefind /i /v "certutil"3⤵PID:4880
-
-