Analysis
-
max time kernel
446s -
max time network
1167s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
-
submitted
10-09-2024 07:42
General
-
Target
PhoenixMiner_6.2c_Windows/Akroma-zergpool.bat
-
Size
236B
-
MD5
f6cc429f4781255d2905ef98422529b2
-
SHA1
52a312a8298f89f990f886755c3d2c79a7c6350e
-
SHA256
ade27234955b1d886112047bd8cbbd78d6204465698b6c2846c704eafd894caf
-
SHA512
ab6763f8d1e098d0da4c097591f03afea022496a9fc24cf7b621fac2bfb4ea295191dfcf6d0f138a47c954969d6da5cbd2459abd8f43edab434f6f4a7c9dfe1a
Score
5/10
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PhoenixMiner_6.2c_Windows\Akroma-zergpool.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PhoenixMiner_6.2c_Windows\PhoenixMiner.exePhoenixMiner.exe -pool stratum+tcp://ethash.eu.mine.zergpool.com:9999 -wal 0xba7e38d976a03d844ad77a01e0988269267a3237 -worker Phoenix -pass x -log 0 -retrydelay 1 -ftime 55 -tt 79 -tstop 89 -tstart 85 -Rmode 1 -fret 1 -rate 12⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger