Analysis
-
max time kernel
147s -
max time network
157s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
-
submitted
10-09-2024 07:40
General
-
Target
PhoenixMiner_6.2c_Windows/Calisto-2miners.bat
-
Size
220B
-
MD5
5d24b64f783df3a53b1f95461f8ac01c
-
SHA1
d3e382488264f404ea95bd6fdd9c61dafc63ffcb
-
SHA256
715de7f53bc3a297e1427b9d58f92e245522cc27cab084592efc76f198800910
-
SHA512
703fc69e0e87d666cce3c1324f277849f0736cfd799afd7d85e8d1ff4a4dbccdb6b964f17f1e7d03586212e9db816e06e1b85150b678209bf9446ef5f370eae1
Score
5/10
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PhoenixMiner_6.2c_Windows\Calisto-2miners.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PhoenixMiner_6.2c_Windows\PhoenixMiner.exePhoenixMiner.exe -pool clo.2miners.com:3030 -wal 0xfed8e9b8ae81c863cc8a987cb5b21eed4e8b43a7 -worker Phoenix -pass x -log 0 -retrydelay 1 -ftime 55 -tt 79 -tstop 89 -tstart 85 -Rmode 1 -fret 1 -rate 1 -coin clo2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger