499f9bbf2c074382bae74d87599121d63e27262a87c5f1b4bc645e3453e37d44

Analysis

user interaction
yes
max time kernel
116s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 02:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Mystic FiveM_cracked.exe
Size 3.1MB
Sample260809-dcn31ayfrf
SHA256 499f9bbf2c074382bae74d87599121d63e27262a87c5f1b4bc645e3453e37d44
MD5 3d957f7a6cf61863182020531d830fce
SHA1 8233494660c5202db8bab8339195c9e99070c136
SHA512 d53f989263683734eecbce8be5decab631a5c0e7059cb69408ae6d475cfcf35b0c26a0f79061f0b87400c95b984eaacea7b810ae73785ef6cbb0a1c4d18e19e7
SSDEEP 49152:AJ9XIzbbM3aAcSzYJzxmmcHKe6v8AMxIGsEpf30/qP2T8+HED90YdaplIiB47l8:Aybg3GMmcHKe6v8AMb30i+plrB47l8
TLSH
T13FE5CF47A3A501ECC567D038C646961BE772744913209BDB27E48AA96FE3AF02F3F351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4148	cmd.exe
3924	cmd.exe
3756	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2764	timeout.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2864	Mystic FiveM_cracked.exe
Token: SeSecurityPrivilege	2864	Mystic FiveM_cracked.exe
Token: SeTakeOwnershipPrivilege	2864	Mystic FiveM_cracked.exe
Token: SeLoadDriverPrivilege	2864	Mystic FiveM_cracked.exe
Token: SeSystemProfilePrivilege	2864	Mystic FiveM_cracked.exe
Token: SeSystemtimePrivilege	2864	Mystic FiveM_cracked.exe
Token: SeProfSingleProcessPrivilege	2864	Mystic FiveM_cracked.exe
Token: SeIncBasePriorityPrivilege	2864	Mystic FiveM_cracked.exe
Token: SeCreatePagefilePrivilege	2864	Mystic FiveM_cracked.exe
Token: SeBackupPrivilege	2864	Mystic FiveM_cracked.exe
Token: SeRestorePrivilege	2864	Mystic FiveM_cracked.exe
Token: SeShutdownPrivilege	2864	Mystic FiveM_cracked.exe
Token: SeDebugPrivilege	2864	Mystic FiveM_cracked.exe
Token: SeSystemEnvironmentPrivilege	2864	Mystic FiveM_cracked.exe
Token: SeChangeNotifyPrivilege	2864	Mystic FiveM_cracked.exe
Token: SeRemoteShutdownPrivilege	2864	Mystic FiveM_cracked.exe
Token: SeUndockPrivilege	2864	Mystic FiveM_cracked.exe
Token: SeManageVolumePrivilege	2864	Mystic FiveM_cracked.exe
Token: SeImpersonatePrivilege	2864	Mystic FiveM_cracked.exe
Token: SeCreateGlobalPrivilege	2864	Mystic FiveM_cracked.exe
Token: 33	2864	Mystic FiveM_cracked.exe
Token: 34	2864	Mystic FiveM_cracked.exe
Token: 35	2864	Mystic FiveM_cracked.exe
Token: 36	2864	Mystic FiveM_cracked.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 4148	2864	Mystic FiveM_cracked.exe	88
PID 4148 wrote to memory of 3136	4148	cmd.exe	90
PID 4148 wrote to memory of 3344	4148	cmd.exe	91
PID 4148 wrote to memory of 3468	4148	cmd.exe	92
PID 2864 wrote to memory of 3924	2864	Mystic FiveM_cracked.exe	107
PID 3924 wrote to memory of 3756	3924	cmd.exe	109
PID 3756 wrote to memory of 2764	3756	cmd.exe	114

C:\Users\Admin\AppData\Local\Temp\Mystic FiveM_cracked.exe
"C:\Users\Admin\AppData\Local\Temp\Mystic FiveM_cracked.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Mystic FiveM_cracked.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4148
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Mystic FiveM_cracked.exe" MD5
    3⤵
    PID:3136
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:3344
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:3468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start cmd /C "color b && title Error && echo CURL Error: SSL connect error && timeout /t 5"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3924
- - C:\Windows\system32\cmd.exe
    cmd /C "color b && title Error && echo CURL Error: SSL connect error && timeout /t 5"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3756
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads