Analysis
-
max time kernel
442s -
max time network
1165s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
-
submitted
10-09-2024 07:42
General
-
Target
PhoenixMiner_6.2c_Windows/42_ethw-ethwmine.bat
-
Size
178B
-
MD5
8a164db026926e30f9be9b2d61c3d9ca
-
SHA1
a03d41ff170135f56c09ee4f99fe0cbc8fea77bd
-
SHA256
ccf2495c4af42c3e8af54903f50bc37df4175e2151f8e0aaf3668ff917508695
-
SHA512
37cb933c55b85978a58862b2ab1670ca53cde473b47d24718e591bd561c7a3bf3fe2d884a85b495537476d65f6abb1446156f583b642ddd7bd9c76983aaf8dc7
Score
5/10
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PhoenixMiner_6.2c_Windows\42_ethw-ethwmine.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PhoenixMiner_6.2c_Windows\PhoenixMiner.exePhoenixMiner.exe -pool eu.ethwmine.com:8008 -wal 0x1DE28FDcfF94656CBaCe3557FF1239CC0F61a3cE -worker phoenix -pass x -log 0 -retrydelay 1 -Rmode 1 -fret 1 -rate 1 -coin ETH2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger