needle_stealer | 7aa0e249b5c1176344f5fa5579d39a095a08bcb156ffa1789c16c2828bb4cf13

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/06/2026, 11:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_7aa0e249b5c1176344f5fa5579d39a095a08bcb156ffa1789c16c2828bb4cf13.exe
Size 10KB
Sample260623-ncgn2act7x
SHA256 7aa0e249b5c1176344f5fa5579d39a095a08bcb156ffa1789c16c2828bb4cf13
MD5 ea425b8c0e70dca5e395592a4e7379d5
SHA1 4a65b44aee410e901fd318ec7043b653b1215e38
SHA512 a14185301d1c7daa0aa1a3b48c20fbc6e95664fd37abe4735458520523633dbdbd143f5b135af4cd722802544a009c893633301685e6ebefb63fd7c2091559f2
SSDEEP 192:YK5oJEWkKB6x+eWlgzPFJxTEZmFhSorcw32:J5oJMZwdyzPFwZK
TLSH
T13D22182F7E850231E3A049B41176964F553D4673A787B3EBF373D5990BA92488440FAF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution needle_stealer phorphiex xmrig loader miner persistence spyware stealer trojan worm

Malware Config

Extracted

Family

phorphiex

http://178.16.55.240/
http://130.12.180.190/us/
http://178.16.55.240/nmix/
http://178.16.55.240/nmixx/
http://91.92.242.107/lmix/

Mutex

daedaaef

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36

Extracted

Family

needle_stealer

http://130.12.180.135:3000/api/v2

Attributes

api_key
alk_2f668968ee87e7d30f8b996112bebef880cfe8626af9c1d8d53e0f719e47be4f
base_extension
false
self_destruct
false

Signatures

Family: NeedleStealer
NeedleStealer is a modular stealer written in Golang.
stealer needle_stealer
Family: Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects NeedleStealer payload 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024490-54.dat	family_needlestealer

XMRig Miner payload 16 IoCs

miner

resource	yara_rule
behavioral1/memory/1884-37-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/1884-38-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/1884-41-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/1884-40-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/1884-39-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/1884-43-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/1884-44-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/1884-42-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/1884-50-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/1884-52-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/1884-55-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/1884-56-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/1884-51-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/1884-47-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/1884-58-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/1884-59-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig

Downloads MZ/PE file 6 IoCs

flow	pid	Process
7	2220	_7aa0e249b5c1176344f5fa5579d39a095a08bcb156ffa1789c16c2828bb4cf13.exe
7	2220	_7aa0e249b5c1176344f5fa5579d39a095a08bcb156ffa1789c16c2828bb4cf13.exe
7	2220	_7aa0e249b5c1176344f5fa5579d39a095a08bcb156ffa1789c16c2828bb4cf13.exe
7	2220	_7aa0e249b5c1176344f5fa5579d39a095a08bcb156ffa1789c16c2828bb4cf13.exe
7	2220	_7aa0e249b5c1176344f5fa5579d39a095a08bcb156ffa1789c16c2828bb4cf13.exe
7	2220	_7aa0e249b5c1176344f5fa5579d39a095a08bcb156ffa1789c16c2828bb4cf13.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 8 IoCs

pid	Process
2268	1429937880.exe
3288	2151516234.exe
4836	949226694.exe
2968	3023837154.exe
3988	1821614845.exe
5004	1694225308.exe
420	syswinprdrvc.exe
3812	1901438779.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 420 set thread context of 1884	420	syswinprdrvc.exe	105

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4856	sc.exe
3336	sc.exe
4292	sc.exe
2164	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1429937880.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2151516234.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	949226694.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3023837154.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1821614845.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_7aa0e249b5c1176344f5fa5579d39a095a08bcb156ffa1789c16c2828bb4cf13.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	21	Go-http-client/1.1

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
1072	taskkill.exe
1332	taskkill.exe
2112	taskkill.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
5004	1694225308.exe
5004	1694225308.exe
5004	1694225308.exe
5004	1694225308.exe
420	syswinprdrvc.exe
3812	1901438779.exe
3812	1901438779.exe
3812	1901438779.exe
3812	1901438779.exe
3812	1901438779.exe
3812	1901438779.exe
3812	1901438779.exe
3812	1901438779.exe
3812	1901438779.exe
3812	1901438779.exe
3812	1901438779.exe
3812	1901438779.exe
3812	1901438779.exe
3812	1901438779.exe
3812	1901438779.exe
3812	1901438779.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1884	dwm.exe
Token: SeDebugPrivilege	3812	1901438779.exe
Token: SeDebugPrivilege	1072	taskkill.exe
Token: SeDebugPrivilege	1332	taskkill.exe
Token: SeDebugPrivilege	2112	taskkill.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2268	2220	_7aa0e249b5c1176344f5fa5579d39a095a08bcb156ffa1789c16c2828bb4cf13.exe	90
PID 2220 wrote to memory of 3288	2220	_7aa0e249b5c1176344f5fa5579d39a095a08bcb156ffa1789c16c2828bb4cf13.exe	91
PID 2220 wrote to memory of 4836	2220	_7aa0e249b5c1176344f5fa5579d39a095a08bcb156ffa1789c16c2828bb4cf13.exe	92
PID 2220 wrote to memory of 2968	2220	_7aa0e249b5c1176344f5fa5579d39a095a08bcb156ffa1789c16c2828bb4cf13.exe	93
PID 2220 wrote to memory of 3988	2220	_7aa0e249b5c1176344f5fa5579d39a095a08bcb156ffa1789c16c2828bb4cf13.exe	94
PID 2220 wrote to memory of 5004	2220	_7aa0e249b5c1176344f5fa5579d39a095a08bcb156ffa1789c16c2828bb4cf13.exe	95
PID 420 wrote to memory of 1884	420	syswinprdrvc.exe	105
PID 420 wrote to memory of 1884	420	syswinprdrvc.exe	105
PID 420 wrote to memory of 1884	420	syswinprdrvc.exe	105
PID 420 wrote to memory of 1884	420	syswinprdrvc.exe	105
PID 420 wrote to memory of 1884	420	syswinprdrvc.exe	105
PID 420 wrote to memory of 1884	420	syswinprdrvc.exe	105
PID 420 wrote to memory of 1884	420	syswinprdrvc.exe	105
PID 420 wrote to memory of 1884	420	syswinprdrvc.exe	105
PID 420 wrote to memory of 1884	420	syswinprdrvc.exe	105
PID 420 wrote to memory of 1884	420	syswinprdrvc.exe	105
PID 420 wrote to memory of 1884	420	syswinprdrvc.exe	105
PID 420 wrote to memory of 1884	420	syswinprdrvc.exe	105
PID 2220 wrote to memory of 3812	2220	_7aa0e249b5c1176344f5fa5579d39a095a08bcb156ffa1789c16c2828bb4cf13.exe	106
PID 3812 wrote to memory of 1072	3812	1901438779.exe	107
PID 3812 wrote to memory of 1332	3812	1901438779.exe	109
PID 3812 wrote to memory of 2112	3812	1901438779.exe	114

C:\Users\Admin\AppData\Local\Temp\_7aa0e249b5c1176344f5fa5579d39a095a08bcb156ffa1789c16c2828bb4cf13.exe
"C:\Users\Admin\AppData\Local\Temp\_7aa0e249b5c1176344f5fa5579d39a095a08bcb156ffa1789c16c2828bb4cf13.exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Users\Admin\AppData\Local\Temp\1429937880.exe
  C:\Users\Admin\AppData\Local\Temp\1429937880.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2268
- C:\Users\Admin\AppData\Local\Temp\2151516234.exe
  C:\Users\Admin\AppData\Local\Temp\2151516234.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3288
- C:\Users\Admin\AppData\Local\Temp\949226694.exe
  C:\Users\Admin\AppData\Local\Temp\949226694.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4836
- C:\Users\Admin\AppData\Local\Temp\3023837154.exe
  C:\Users\Admin\AppData\Local\Temp\3023837154.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2968
- C:\Users\Admin\AppData\Local\Temp\1821614845.exe
  C:\Users\Admin\AppData\Local\Temp\1821614845.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3988
- C:\Users\Admin\AppData\Local\Temp\1694225308.exe
  C:\Users\Admin\AppData\Local\Temp\1694225308.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:5004
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "winmgr"
    3⤵
    - Launches sc.exe
    PID:4856
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "winmgr" binpath= "C:\ProgramData\winmgr\syswinprdrvc.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:3336
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:4292
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "winmgr"
    3⤵
    - Launches sc.exe
    PID:2164
- C:\Users\Admin\AppData\Local\Temp\1901438779.exe
  C:\Users\Admin\AppData\Local\Temp\1901438779.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3812
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1072
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1332
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedgewebview2.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2112

C:\ProgramData\winmgr\syswinprdrvc.exe
C:\ProgramData\winmgr\syswinprdrvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:420
- C:\Windows\system32\dwm.exe
  dwm.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

1429937880.exe

Path C:\Users\Admin\AppData\Local\Temp\1429937880.exe
Size 18KB
SHA256 df482da0d9a366592795d1f87f174eae6a423b01d4d4a9c7b022e17c38395d73
MD5 5285c03009623a66df99dbc04b5bd1ad
SHA1 59785eb0f54995c670340a177f481ea72127f4e0
SHA512 0f2ee9dc75e7ecb3ab451f9b76810fa2e9352e5f3642b3281abdceca89d1f3faa1007a1ba8b615660ae8f21b935381ad669e166775713834abdd3151290cf13e
SSDEEP 384:LXIqQlV6lvR+v0CvBu9JgwHcOv4av8U9cmF:LD80IE9b4a0U
TLSH
T14D825B0FB8424726D0E210B49676977BDABA6872338414DBF7D44AE90B686D5FC3311F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1694225308.exe

Path C:\Users\Admin\AppData\Local\Temp\1694225308.exe
Size 6.8MB
SHA256 9639f7ebc6a6d69d7bf5b8bc869e7783a1406088f192868624ad8919e9bfd1d4
MD5 083d5895283755a910b5c59d60a5348b
SHA1 0d94bf4d0418061907ff7977e3f25a463cb25188
SHA512 4ae34f0e50843182f780d1e31b1226db5f831e6d48c1cfe9448c0c2da558a334f0ee37d00dfbe84c80e7d54a17eed1cc8b56b34da71123b65541a4dc58076f10
SSDEEP 196608:Od8aiP1kVGff0MYA9ZHP6mJhimlsM0sH86TTS6k:OWlMyhJDse/5
TLSH
T188660246297FA774A367A3848BD1E5739AAF4639FE55853036233CEB9F1049400B0EE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1821614845.exe

Path C:\Users\Admin\AppData\Local\Temp\1821614845.exe
Size 18KB
SHA256 96ada74774413c01c0e7d4707d9837bb30dba9132cc3519178e890596f2b5dbd
MD5 5c1469dfe6aed70e8bc529c68216b9ad
SHA1 796bb8aa995056739a6201720f3266da815e92bf
SHA512 3bef0e4e74db9dbf83bc92961dffd259274ab1c60855e3e6033dc0a1ccee3a081886d31a641b0669c04e93daa9f96f8c914b6713c51f426ded3aeeb875ea03af
SSDEEP 384:hIqQ1VaFPte/SZCvBu9JgwHcev4av8U9cNF:FYUIE9r4a0U
TLSH
T12F825B0FB8424726D1E210749276977BDABDA872338414DBFBD489E90A686D6FC3311F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1901438779.exe

Path C:\Users\Admin\AppData\Local\Temp\1901438779.exe
Size 8.3MB
SHA256 1b963ea63828c83ff15a12fe84ff83ab970e02bcfb9996e5835052e9537224c3
MD5 68fcf1b0aee7fb5ef4367f4f6d7b5b66
SHA1 12d589e04eafe6940ac26c27dceeebab9599d506
SHA512 c601740f5ec571472eb4ad45475631fd5d78a0aadf0dcdcbcc385c0f5b6cbfb5e9b138504949593e591d17f973367830d829ad3bbd0b42473f1eb4c571f7b48d
SSDEEP 98304:eoM7vbdbj6O/qZqwTtuwvvEw9AS+jNXPXskV3eJ5svhUE:eoMLbdbWO/eqouwXEAAhjNfcCuwt
TLSH
T12F968D07EC9155A9C0AAE6358A729253BA717C485B3123D73F90F3392F73BD06AB8750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2151516234.exe

Path C:\Users\Admin\AppData\Local\Temp\2151516234.exe
Size 18KB
SHA256 9332cd4e9ce6ed2b6f53661ab38877b512826fb84f7b1d4465edbd9d82136d1b
MD5 681866a55cf1b2939ca8413b33b807a8
SHA1 a9fef75cedbf61ea96c96e13d8592abe5a4022df
SHA512 75a8d2a52fdfc66670567f9d0c380473e9f28ab3f13c6faf8d55c607c5c17afeb9c7c41d4faec197cd35358e807ab7cff0aa4789bd9a38fb1f2f1188760de1d5
SSDEEP 384:SIqQlV6lvV+v0CvBu9JgwQcOv4av8U9cxF:Ig0IE9C4a0U
TLSH
T10A824B0FB8424726D0E210B49676977BDAB96872338414DBF7D44AE90B686D5FC3311F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3023837154.exe

Path C:\Users\Admin\AppData\Local\Temp\3023837154.exe
Size 18KB
SHA256 47088023cf22c95f436e6fb08c208f172504668f3d620b6a558e19b0695bdb04
MD5 6d4d35bc97f74470387df82f04b3d249
SHA1 f4652ff0682011a7c3424036a36a30ef4fe620de
SHA512 16f741b3bd6f40a90fba883e2585f540f239b57da600f56a0ba69b96872ed7031040dceb9b412289dcc5f2edeca5249cd5c86ddfe51ffc5fe26d3a6784ef30d2
SSDEEP 384:BIqQ1VaFPBe/SZCvBu9JgwHcev4av8U9cvF:l8UIE9r4a0U
TLSH
T1B4825A0FB8424726D0E210749276877BDABDA872338414DBFBD489A90A686D6FC3311F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

949226694.exe

Path C:\Users\Admin\AppData\Local\Temp\949226694.exe
Size 18KB
SHA256 cac977b50d2505405e729e623025a03b60a58e92b0b75c272242592139985ddb
MD5 3268072194bac5900af0ef321afd0ee9
SHA1 ab916a12c7cc793a942f709d13b9f9e7be2012b1
SHA512 bc78d0cffe64772d51dbdce217489bb47bdfecb7d1d16d888cfd369d3fcecbd7ebcb699e413e50b59b12a485dd2f8cc8de57c2754ec707cd2aca812e2d3b5b6b
SSDEEP 384:0IqQ1VaFPte/SZCvBu9JgwHcev4av8U9c6F:CYUIE9r4a0U
TLSH
T1A9825B0FB8424726D0E210749276877BDABDA872338414DBFBD489E90A686D6FC3311F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1884-43-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/1884-50-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/1884-41-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/1884-40-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/1884-39-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/1884-37-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/1884-44-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/1884-42-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/1884-48-0x00000167A04E0000-0x00000167A0500000-memory.dmp

Download

memory/1884-38-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/1884-52-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/1884-55-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/1884-56-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/1884-36-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/1884-51-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/1884-47-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/1884-58-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/1884-59-0x0000000140000000-0x000000014082E000-memory.dmp

Download