Analysis
-
max time kernel
438s -
max time network
1163s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
-
submitted
10-09-2024 07:42
General
-
Target
PhoenixMiner_6.2c_Windows/1_Ethereum-classic-f2pool.bat
-
Size
182B
-
MD5
d4d22289124f55b9db1169fdbb7647bb
-
SHA1
1064cdb8ae28bb6aed8ea955d4ffd9bd64031602
-
SHA256
d1e061e1c9ae4b266607b2fd1d338f894f771aadf49ec426016d241d19441f5f
-
SHA512
6d471094b0df84fbf07f6ac81901c9ae499a963b52fca3ba3f852ad9688d42a01d4a9f679e3bd22a04045327f825d67e994b7c6ddc70647fa55eb0aa6fa47276
Score
5/10
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PhoenixMiner_6.2c_Windows\1_Ethereum-classic-f2pool.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PhoenixMiner_6.2c_Windows\PhoenixMiner.exePhoenixMiner.exe -pool etc.f2pool.com:8118 -wal rgz -worker rgz -epsw x -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -ftime 55 -tt 79 -tstop 89 -asm 2 -coin etc2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-