Analysis
-
max time kernel
437s -
max time network
1165s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
-
submitted
10-09-2024 07:42
General
-
Target
PhoenixMiner_6.2c_Windows/7_ethereum-classic-coinmine.bat
-
Size
193B
-
MD5
eed59cea5c63728968b69ab334637d6d
-
SHA1
0cb14b4b74501732a1a497cb54c336cfb61d14bb
-
SHA256
57218ba71a6e6c8749a5b40349736697d4599221eec7545e2d070e9adc7989b4
-
SHA512
e8a256f8eb8f46dd33f11c7bf5136918aa6cf340db53489b5ccd4af8280fc4af019154e7bbb015b82aae27b8d14289f4a188e31290a9629bb297c0c6a9257e73
Score
5/10
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PhoenixMiner_6.2c_Windows\7_ethereum-classic-coinmine.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PhoenixMiner_6.2c_Windows\PhoenixMiner.exePhoenixMiner.exe -pool etc.coinmine.pl:24000 -wal rgzrgz_leo.rgzrgz_leo -pass x -log 0 -retrydelay 1 -ftime 55 -tt 79 -tstop 89 -tstart 85 -Rmode 1 -proto 1 -fret 1 -rate 1 -coin etc2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger