Analysis
-
max time kernel
437s -
max time network
1157s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
-
submitted
10-09-2024 07:42
General
-
Target
PhoenixMiner_6.2c_Windows/3_ethereum-classic-miningpoolhub.bat
-
Size
214B
-
MD5
6d4396bd7419fbe456f0e6152ead88c7
-
SHA1
6ecee865ed1d373dc92f3fa1f5ad50f79654c73c
-
SHA256
b30765776a2e125edf2fbf0ed53cf07f71beb3477a7e97ed6fd14412731f2b5c
-
SHA512
5dc9a79e1928a4832586c86733712ea15b3c30f6c716b7cdd3c40db00f7fe090880f53b5f5ff6a1b52c77e97f6f0b0ae674ac0e5589bc4b4741b7cb3ed9e5d8c
Score
5/10
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PhoenixMiner_6.2c_Windows\3_ethereum-classic-miningpoolhub.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PhoenixMiner_6.2c_Windows\PhoenixMiner.exePhoenixMiner.exe -pool europe.etchash-hub.miningpoolhub.com:20615 -wal rgzrgz_leo.rgzrgz_leo -pass x -log 0 -retrydelay 1 -ftime 55 -tt 79 -tstop 89 -tstart 85 -Rmode 1 -proto 1 -fret 1 -rate 1 -coin etc2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger