Analysis
- user interaction
yes - max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 02:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Mystic Valorant.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
Mystic Valorant.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target Mystic Valorant.exe
- Size 164KB
- Sample260820-dbesyaydld
- SHA256 e632bc2dc511f2d03c3243df2c10f46e24a31036bffd5e89825090ad7a5e9911
- MD5 036f52d53d3c9fd4c59adc135e7d5f19
- SHA1 1030ac8864dd7db98fb3585bab00efc3ee955550
- SHA512 5ad29318c5d1e925ebe0b9cd0e2e1e0a9d0ae09e809ae5d105eca3cc3aec0f36e0e2ea04ddfb8e7637831b02b6a1a42509b244b006a919914a16d947a14fc80a
- SSDEEP 1536:6lptDBbGt5CL1lWMv9/EFSQjfoZThI+yi1ErWKoH3i+8piJ3W7WZoDjTRvw8mO6:6lBQCL+SCo/I+ybrRN7WZUTRhm
- TLSH T1A1F35B1EA587057ED2E2DDB8CA264542F733B88E1FD165E723D04AF10D276D8AB35A03
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 27 IoCs
pid Process 3896 Mystic Valorant.exe 3896 Mystic Valorant.exe 3896 Mystic Valorant.exe 3896 Mystic Valorant.exe 3896 Mystic Valorant.exe 3896 Mystic Valorant.exe 3896 Mystic Valorant.exe 3896 Mystic Valorant.exe 3896 Mystic Valorant.exe 3896 Mystic Valorant.exe 3896 Mystic Valorant.exe 3896 Mystic Valorant.exe 3896 Mystic Valorant.exe 3896 Mystic Valorant.exe 3896 Mystic Valorant.exe 3896 Mystic Valorant.exe 3896 Mystic Valorant.exe 3896 Mystic Valorant.exe 3896 Mystic Valorant.exe 3896 Mystic Valorant.exe 3896 Mystic Valorant.exe 3896 Mystic Valorant.exe 3896 Mystic Valorant.exe 3896 Mystic Valorant.exe 3896 Mystic Valorant.exe 3896 Mystic Valorant.exe 3896 Mystic Valorant.exe - Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3796 cmd.exe 3136 cmd.exe 4128 cmd.exe - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 3896 Mystic Valorant.exe 3896 Mystic Valorant.exe 3896 Mystic Valorant.exe 3896 Mystic Valorant.exe 3896 Mystic Valorant.exe 3896 Mystic Valorant.exe 3896 Mystic Valorant.exe 3896 Mystic Valorant.exe 3896 Mystic Valorant.exe 3896 Mystic Valorant.exe 3896 Mystic Valorant.exe 3896 Mystic Valorant.exe 3896 Mystic Valorant.exe 3896 Mystic Valorant.exe 3896 Mystic Valorant.exe 3896 Mystic Valorant.exe 3896 Mystic Valorant.exe 3896 Mystic Valorant.exe 3896 Mystic Valorant.exe 3896 Mystic Valorant.exe 3896 Mystic Valorant.exe 3896 Mystic Valorant.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3896 Mystic Valorant.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3896 wrote to memory of 3796 3896 Mystic Valorant.exe 89 PID 3796 wrote to memory of 4188 3796 cmd.exe 90 PID 3896 wrote to memory of 3136 3896 Mystic Valorant.exe 92 PID 3896 wrote to memory of 4128 3896 Mystic Valorant.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\Mystic Valorant.exe"C:\Users\Admin\AppData\Local\Temp\Mystic Valorant.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c mode con: cols=82 lines=182⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Windows\system32\mode.commode con: cols=82 lines=183⤵PID:4188
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
- Executes a command shell one-liner
PID:3136
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
- Executes a command shell one-liner
PID:4128
-