Analysis
-
max time kernel
445s -
max time network
1168s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
-
submitted
10-09-2024 07:42
General
-
Target
PhoenixMiner_6.2c_Windows/1_ethereum-classic-nanopool.bat
-
Size
226B
-
MD5
5b462bbb2f3f7a9aabf68f1d41a17456
-
SHA1
7ef7ba37a8bd62b828e033257a0cee5ae52759f8
-
SHA256
cc9f16c5210bce3134863575af79f136f1a4b981bfea60ee59b5dd1382377c8e
-
SHA512
9972673b538fa536dffcc67f2463f16afbe6f59d51723009981a77b9d020f8f3d99724144c06510a8dac80f299daddf375b3a09b81f1a4ab90bb39a3d243f66d
Score
5/10
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PhoenixMiner_6.2c_Windows\1_ethereum-classic-nanopool.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PhoenixMiner_6.2c_Windows\PhoenixMiner.exePhoenixMiner.exe -pool etc-eu2.nanopool.org:19999 -wal 0x7b9cc9270cF06889a4286221931D3a58e627F888 -worker Phoenix -pass x -log 0 -retrydelay 1 -ftime 55 -tt 79 -tstop 89 -tstart 85 -Rmode 1 -fret 1 -rate 1 -coin etc2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger