Analysis
-
max time kernel
147s -
max time network
157s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
-
submitted
10-09-2024 07:40
General
-
Target
PhoenixMiner_6.2c_Windows/42_ethw-pool-msk.bat
-
Size
188B
-
MD5
cb2a97edb01bdcd91e3948e7efcd2726
-
SHA1
cbd1ad0aaa92eed1198b104ee1621b0a59a652b8
-
SHA256
b76e877d6580c8436cece9b24adfd8e2b1992307df83ef1d7ec4c2148f9c1cdc
-
SHA512
8acffa3c59b113c9eb022263879c491fd562ca33d3e5b0e937ef944386481592d180a63cdfee3284d5a75295f0c5308facac467cd07f6eb05c48a8054d8c0c18
Score
5/10
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PhoenixMiner_6.2c_Windows\42_ethw-pool-msk.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PhoenixMiner_6.2c_Windows\PhoenixMiner.exePhoenixMiner.exe -pool ssl://ethw.pool-moscow.ru:9009 -wal 0x1DE28FDcfF94656CBaCe3557FF1239CC0F61a3cE -worker phoenix -pass x -log 0 -retrydelay 1 -Rmode 1 -fret 1 -rate 1 -coin ETH2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger