Analysis
-
max time kernel
433s -
max time network
1155s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
-
submitted
10-09-2024 07:42
General
-
Target
PhoenixMiner_6.2c_Windows/5_Ethereum-classic-antpool.bat
-
Size
195B
-
MD5
c531617dc5b4cd6dddeb83d756b3e78d
-
SHA1
63bb53dc6a398bb88f1ad9a04eb53a6f08c533a1
-
SHA256
77b81c23860a0f58b606bd5de29a8318cb556ec15e18446095b9e923bbfd5747
-
SHA512
5d370e1148ea2ac4b44743fdbc236d37a17d7cb11ac8bb9b49ca1526c0d7af349382a63d4cfd16a809c38cded39c2d427a73fa6afc44dba9b6de83551db683c4
Score
5/10
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PhoenixMiner_6.2c_Windows\5_Ethereum-classic-antpool.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PhoenixMiner_6.2c_Windows\PhoenixMiner.exePhoenixMiner.exe -pool stratum-etc.antpool.com:8008 -wal etcuser -worker rgz -epsw x -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -ftime 55 -tt 79 -tstop 89 -asm 2 -coin etc2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-