Analysis
-
max time kernel
435s -
max time network
1158s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
-
submitted
10-09-2024 07:42
General
-
Target
PhoenixMiner_6.2c_Windows/12_ethereum-classic-nicehash.bat
-
Size
227B
-
MD5
de242f1f5fbe88828505433d5d54f56b
-
SHA1
5da7e06b46faebc39f92f2c095f6d0739d19fc4e
-
SHA256
75102ea4f21f5679e9b426cfb749d8320acccd2c6751cb0ad6bf8819ab4401a9
-
SHA512
5f0d666867812a068fd37507ed5eed4276803343d69e7fd57146e7cadbed4080a056d2bd98a6fe6c02cd9f3d5bf2ffe6c332ac06aa8576634b15add8603b5091
Score
5/10
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PhoenixMiner_6.2c_Windows\12_ethereum-classic-nicehash.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PhoenixMiner_6.2c_Windows\PhoenixMiner.exePhoenixMiner.exe -pool etchash.auto.nicehash.com:9200 -wal 3P7qADz69quhfyK5e9kvfno6Jyjq4Rcocx.Phoenix -epsw x -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -ftime 55 -tt 79 -tstop 89 -tstart 79 -proto 4 -nosni2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger