499f9bbf2c074382bae74d87599121d63e27262a87c5f1b4bc645e3453e37d44

Analysis

user interaction
yes
max time kernel
150s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 02:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Mystic FiveM_cracked.exe
Size 3.1MB
Sample260809-dcn31ayfrf
SHA256 499f9bbf2c074382bae74d87599121d63e27262a87c5f1b4bc645e3453e37d44
MD5 3d957f7a6cf61863182020531d830fce
SHA1 8233494660c5202db8bab8339195c9e99070c136
SHA512 d53f989263683734eecbce8be5decab631a5c0e7059cb69408ae6d475cfcf35b0c26a0f79061f0b87400c95b984eaacea7b810ae73785ef6cbb0a1c4d18e19e7
SSDEEP 49152:AJ9XIzbbM3aAcSzYJzxmmcHKe6v8AMxIGsEpf30/qP2T8+HED90YdaplIiB47l8:Aybg3GMmcHKe6v8AMb30i+plrB47l8
TLSH
T13FE5CF47A3A501ECC567D038C646961BE772744913209BDB27E48AA96FE3AF02F3F351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4184	cmd.exe
5840	cmd.exe
4208	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
3696	timeout.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3964	Mystic FiveM_cracked.exe
Token: SeSecurityPrivilege	3964	Mystic FiveM_cracked.exe
Token: SeTakeOwnershipPrivilege	3964	Mystic FiveM_cracked.exe
Token: SeLoadDriverPrivilege	3964	Mystic FiveM_cracked.exe
Token: SeSystemProfilePrivilege	3964	Mystic FiveM_cracked.exe
Token: SeSystemtimePrivilege	3964	Mystic FiveM_cracked.exe
Token: SeProfSingleProcessPrivilege	3964	Mystic FiveM_cracked.exe
Token: SeIncBasePriorityPrivilege	3964	Mystic FiveM_cracked.exe
Token: SeCreatePagefilePrivilege	3964	Mystic FiveM_cracked.exe
Token: SeBackupPrivilege	3964	Mystic FiveM_cracked.exe
Token: SeRestorePrivilege	3964	Mystic FiveM_cracked.exe
Token: SeShutdownPrivilege	3964	Mystic FiveM_cracked.exe
Token: SeDebugPrivilege	3964	Mystic FiveM_cracked.exe
Token: SeSystemEnvironmentPrivilege	3964	Mystic FiveM_cracked.exe
Token: SeChangeNotifyPrivilege	3964	Mystic FiveM_cracked.exe
Token: SeRemoteShutdownPrivilege	3964	Mystic FiveM_cracked.exe
Token: SeUndockPrivilege	3964	Mystic FiveM_cracked.exe
Token: SeManageVolumePrivilege	3964	Mystic FiveM_cracked.exe
Token: SeImpersonatePrivilege	3964	Mystic FiveM_cracked.exe
Token: SeCreateGlobalPrivilege	3964	Mystic FiveM_cracked.exe
Token: 33	3964	Mystic FiveM_cracked.exe
Token: 34	3964	Mystic FiveM_cracked.exe
Token: 35	3964	Mystic FiveM_cracked.exe
Token: 36	3964	Mystic FiveM_cracked.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3964 wrote to memory of 4184	3964	Mystic FiveM_cracked.exe	89
PID 4184 wrote to memory of 5496	4184	cmd.exe	91
PID 4184 wrote to memory of 252	4184	cmd.exe	92
PID 4184 wrote to memory of 4920	4184	cmd.exe	93
PID 3964 wrote to memory of 5840	3964	Mystic FiveM_cracked.exe	95
PID 5840 wrote to memory of 4208	5840	cmd.exe	97
PID 4208 wrote to memory of 3696	4208	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\Mystic FiveM_cracked.exe
"C:\Users\Admin\AppData\Local\Temp\Mystic FiveM_cracked.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Mystic FiveM_cracked.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4184
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Mystic FiveM_cracked.exe" MD5
    3⤵
    PID:5496
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:252
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:4920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start cmd /C "color b && title Error && echo CURL Error: SSL connect error && timeout /t 5"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5840
- - C:\Windows\system32\cmd.exe
    cmd /C "color b && title Error && echo CURL Error: SSL connect error && timeout /t 5"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4208
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads