Analysis
-
max time kernel
91s -
max time network
95s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
-
submitted
10-09-2024 07:40
General
-
Target
PhoenixMiner_6.2c_Windows/8_ethereum-classic-beepool.bat
-
Size
232B
-
MD5
505e9020adecd409e6cad8f40d2b2e2d
-
SHA1
9905ae476725e8984b36ea65882a098f6dc4acd8
-
SHA256
44c6d522a25d560e4c57cffa1d57f18a09ba52735290c88dbd89b197db8996d3
-
SHA512
d2ac8d06a5c97cac87e18ca1ccf15124e7dca161f5295e2724e1c04c6c09f3d67875abcf6a2ec2a266bd06e08e9b44da6d50570a733d6163799b5f43ce7c98cb
Score
5/10
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PhoenixMiner_6.2c_Windows\8_ethereum-classic-beepool.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PhoenixMiner_6.2c_Windows\PhoenixMiner.exePhoenixMiner.exe -pool etc-pool.beepool.org:9518 -wal 0x7b9cc9270cF06889a4286221931D3a58e627F888 -worker Phoenix -epsw x -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -ftime 55 -tt 79 -tstop 89 -tstart 79 -coin etc2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger