Analysis
-
max time kernel
147s -
max time network
154s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
-
submitted
10-09-2024 07:40
General
-
Target
PhoenixMiner_6.2c_Windows/4_ethereum-classic-ethermine.bat
-
Size
226B
-
MD5
5154b80655f67280d38edc8a2472d4ad
-
SHA1
d14f42125ffa76bbe40c5165eb1589741473e3f1
-
SHA256
6d7bde49f7860cd73c2f465d198b1430aa4de6d4a95d86e7c76a4e476868428c
-
SHA512
36979ad1d936cbc89875ed90f90fc25fc7f1a60308f16100835f7678187d9b408923eed7de32318194d0158d453d7cff9abcf54e2862129854632766be11f25c
Score
5/10
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PhoenixMiner_6.2c_Windows\4_ethereum-classic-ethermine.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PhoenixMiner_6.2c_Windows\PhoenixMiner.exePhoenixMiner.exe -pool eu1-etc.ethermine.org:4444 -wal 0x7b9cc9270cF06889a4286221931D3a58e627F888 -worker Phoenix -pass x -log 0 -retrydelay 1 -ftime 55 -tt 79 -tstop 89 -tstart 85 -Rmode 1 -fret 1 -rate 1 -coin etc2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger