needle_stealer | 4b3d9ff0f3eef2684879bea47fb066a259bb2cc18bb0ab0c2f0c069e732dd5e1

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 16:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 10KB
Sample260804-ttetnavbpe
SHA256 4b3d9ff0f3eef2684879bea47fb066a259bb2cc18bb0ab0c2f0c069e732dd5e1
MD5 94498bcc84599ebe710f3efd951845da
SHA1 9f28937b9f7e0ea73557bb2354702862b03308ac
SHA512 9dbce6d216b2a8845c1be029bac8e4d870b7ea137f9d8adb72bf9d4305959d92dfd0aa918c62cc9079d4dcccdb10ba99559847ccfe6396bbfd54d947d1cadd60
SSDEEP 192:b0oVW0BJBqcx+ep/AX5PFJxTEZmFhSKcq:b0oLBecwCAX5PFwZ2
TLSH
T15822292E6E890072D7904DF416B54A4D657E457327C6B3EBF373C5990EE92448042BEF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution needle_stealer xmrig miner persistence spyware stealer

Malware Config

Extracted

Family

needle_stealer

http://130.12.180.135:3000/api/v2

Attributes

api_key
alk_2f668968ee87e7d30f8b996112bebef880cfe8626af9c1d8d53e0f719e47be4f
base_extension
false
self_destruct
false

Signatures

Family: NeedleStealer
NeedleStealer is a modular stealer written in Golang.
stealer needle_stealer
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects NeedleStealer payload 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024545-31.dat	family_needlestealer

XMRig Miner payload 16 IoCs

miner

resource	yara_rule
behavioral1/memory/2080-20-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/2080-17-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/2080-16-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/2080-15-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/2080-14-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/2080-13-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/2080-12-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/2080-11-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/2080-10-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/2080-24-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/2080-25-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/2080-29-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/2080-27-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/2080-28-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/2080-33-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/2080-34-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig

Downloads MZ/PE file 1 IoCs

flow	pid	Process
10	5088	file.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
640	1960216511.exe
3816	syswinprdrvc.exe
452	3277830592.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3816 set thread context of 2080	3816	syswinprdrvc.exe	99

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2300	sc.exe
3896	sc.exe
2444	sc.exe
4056	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	13	Go-http-client/1.1

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
1796	taskkill.exe
2492	taskkill.exe
1116	taskkill.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
640	1960216511.exe
640	1960216511.exe
640	1960216511.exe
640	1960216511.exe
3816	syswinprdrvc.exe
452	3277830592.exe
452	3277830592.exe
452	3277830592.exe
452	3277830592.exe
452	3277830592.exe
452	3277830592.exe
452	3277830592.exe
452	3277830592.exe
452	3277830592.exe
452	3277830592.exe
452	3277830592.exe
452	3277830592.exe
452	3277830592.exe
452	3277830592.exe
452	3277830592.exe
452	3277830592.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2080	dwm.exe
Token: SeDebugPrivilege	452	3277830592.exe
Token: SeDebugPrivilege	2492	taskkill.exe
Token: SeDebugPrivilege	1796	taskkill.exe
Token: SeDebugPrivilege	1116	taskkill.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 640	5088	file.exe	87
PID 3816 wrote to memory of 2080	3816	syswinprdrvc.exe	99
PID 3816 wrote to memory of 2080	3816	syswinprdrvc.exe	99
PID 3816 wrote to memory of 2080	3816	syswinprdrvc.exe	99
PID 3816 wrote to memory of 2080	3816	syswinprdrvc.exe	99
PID 3816 wrote to memory of 2080	3816	syswinprdrvc.exe	99
PID 3816 wrote to memory of 2080	3816	syswinprdrvc.exe	99
PID 3816 wrote to memory of 2080	3816	syswinprdrvc.exe	99
PID 3816 wrote to memory of 2080	3816	syswinprdrvc.exe	99
PID 3816 wrote to memory of 2080	3816	syswinprdrvc.exe	99
PID 3816 wrote to memory of 2080	3816	syswinprdrvc.exe	99
PID 3816 wrote to memory of 2080	3816	syswinprdrvc.exe	99
PID 3816 wrote to memory of 2080	3816	syswinprdrvc.exe	99
PID 5088 wrote to memory of 452	5088	file.exe	101
PID 452 wrote to memory of 1796	452	3277830592.exe	102
PID 452 wrote to memory of 2492	452	3277830592.exe	104
PID 452 wrote to memory of 1116	452	3277830592.exe	107

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Users\Admin\AppData\Local\Temp\1960216511.exe
  C:\Users\Admin\AppData\Local\Temp\1960216511.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:640
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "winmgr"
    3⤵
    - Launches sc.exe
    PID:2300
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "winmgr" binpath= "C:\ProgramData\winmgr\syswinprdrvc.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:3896
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:2444
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "winmgr"
    3⤵
    - Launches sc.exe
    PID:4056
- C:\Users\Admin\AppData\Local\Temp\3277830592.exe
  C:\Users\Admin\AppData\Local\Temp\3277830592.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:452
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1796
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2492
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedgewebview2.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1116

C:\ProgramData\winmgr\syswinprdrvc.exe
C:\ProgramData\winmgr\syswinprdrvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3816
- C:\Windows\system32\dwm.exe
  dwm.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

1960216511.exe

Path C:\Users\Admin\AppData\Local\Temp\1960216511.exe
Size 6.8MB
SHA256 9639f7ebc6a6d69d7bf5b8bc869e7783a1406088f192868624ad8919e9bfd1d4
MD5 083d5895283755a910b5c59d60a5348b
SHA1 0d94bf4d0418061907ff7977e3f25a463cb25188
SHA512 4ae34f0e50843182f780d1e31b1226db5f831e6d48c1cfe9448c0c2da558a334f0ee37d00dfbe84c80e7d54a17eed1cc8b56b34da71123b65541a4dc58076f10
SSDEEP 196608:Od8aiP1kVGff0MYA9ZHP6mJhimlsM0sH86TTS6k:OWlMyhJDse/5
TLSH
T188660246297FA774A367A3848BD1E5739AAF4639FE55853036233CEB9F1049400B0EE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3277830592.exe

Path C:\Users\Admin\AppData\Local\Temp\3277830592.exe
Size 8.3MB
SHA256 ed1d3f69fbbd5576c2ed8dba45ba22c4f6884eb311d4f6e389203846d512ec11
MD5 2cfaefe80e05fe0f093cf5c382d7c77f
SHA1 c2ad2a5b5cd45e6f574d86b6e5b1079ed3063933
SHA512 d75a4743bcb6fa5d879e06ef83536c00408434dff59aee6a182745fe43f57099d9cf3e85cbc149960846ae1d5d4d5cce790baa717f089afbc96bfdf771b1a3d7
SSDEEP 98304:aoM7vbdbj6O/qZLw5tfjf8Bwm1sDjNXX5Ikr3aX5svhUE:aoMLbdbWO/eLafjUBD1+jNnSMq+t
TLSH
T131968D07EC9155A9C0AAE6358A729253BA717C485B3123D73F90F7382F73BD06AB8750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2080-16-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/2080-10-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/2080-17-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/2080-21-0x000001CB37DC0000-0x000001CB37DE0000-memory.dmp

Download

memory/2080-15-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/2080-14-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/2080-13-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/2080-12-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/2080-11-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/2080-20-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/2080-24-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/2080-25-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/2080-29-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/2080-9-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/2080-27-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/2080-28-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/2080-33-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/2080-34-0x0000000140000000-0x000000014082E000-memory.dmp

Download