needle_stealer | 6b221814fa8c8d800a2ea3dcbb30943c33d8a28e184dbd368e42c5f5e92f90e4

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 15:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 11KB
Sample260805-sxtxbabl6s
SHA256 6b221814fa8c8d800a2ea3dcbb30943c33d8a28e184dbd368e42c5f5e92f90e4
MD5 a53edc758bc697b43b92f366dfb21992
SHA1 5160ab7f4d04c8e536eb0b0de6e8ce5496e4e1de
SHA512 c3c6638c6b617af74584c051655fe63142b888d5760c8a4ab7ddc177266c8b2d4ccafda9cbd0e7e305751c5c75deadca7febc583f43338970d1e28e145490df1
SSDEEP 192:HroTWSqBEx+eylG+Ibi/+I4PFJxTEZmFhSuc:Hroz7wxLIbLI4PFwZ
TLSH
T10B32092A7E490331E3A488F41475438F653D5633A387A3EBF77396AD4BA62448441EBF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution needle_stealer phorphiex xmrig loader miner persistence spyware stealer trojan worm

Malware Config

Extracted

Family

phorphiex

http://178.16.54.109/spmm/
http://178.16.54.109/spm/
http://178.16.55.240/
http://178.16.55.240/l/
http://178.16.55.240/nm/
http://178.16.55.240/nmm/
http://178.16.54.109/c/

Mutex

975595

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36

Extracted

Family

needle_stealer

http://130.12.180.135:3000/api/v2

Attributes

api_key
alk_2f668968ee87e7d30f8b996112bebef880cfe8626af9c1d8d53e0f719e47be4f
base_extension
false
self_destruct
false

Signatures

Family: NeedleStealer
NeedleStealer is a modular stealer written in Golang.
stealer needle_stealer
Family: Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects NeedleStealer payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5e4-54.dat	family_needlestealer

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c00000001c5e6-62.dat	family_xmrig
behavioral2/files/0x000c00000001c5e6-62.dat	xmrig

Downloads MZ/PE file 9 IoCs

flow	pid	Process
10	4360	file.exe
10	4360	file.exe
10	4360	file.exe
10	4360	file.exe
10	4360	file.exe
10	4360	file.exe
10	4360	file.exe
10	4360	file.exe
19	4620	3303828625.exe

Executes dropped EXE 12 IoCs

pid	Process
1852	4104719196.exe
2052	977531553.exe
1460	223869192.exe
3184	2111219655.exe
2780	909030115.exe
4524	2170140522.exe
5184	967918214.exe
4620	3303828625.exe
5224	3199438879.exe
5420	sysmgnrsv.exe
4296	sysfrodolv.exe
5588	sysmgnrsv.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Config = "\\sysfrodolv.exe"	3303828625.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5164	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	967918214.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3303828625.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysfrodolv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4104719196.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	977531553.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	223869192.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	909030115.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2111219655.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2170140522.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	20	Go-http-client/1.1

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
1332	taskkill.exe
3092	taskkill.exe
5152	taskkill.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
5224	3199438879.exe
5224	3199438879.exe
5224	3199438879.exe
5224	3199438879.exe
5224	3199438879.exe
5224	3199438879.exe
5224	3199438879.exe
5224	3199438879.exe
5224	3199438879.exe
5224	3199438879.exe
5224	3199438879.exe
5224	3199438879.exe
5224	3199438879.exe
5224	3199438879.exe
5224	3199438879.exe
5224	3199438879.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	5224	3199438879.exe
Token: SeDebugPrivilege	5152	taskkill.exe
Token: SeDebugPrivilege	1332	taskkill.exe
Token: SeDebugPrivilege	3092	taskkill.exe
Token: SeLockMemoryPrivilege	5588	sysmgnrsv.exe
Token: SeLockMemoryPrivilege	5588	sysmgnrsv.exe
Token: SeIncBasePriorityPrivilege	5588	sysmgnrsv.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5588	sysmgnrsv.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4360 wrote to memory of 1852	4360	file.exe	90
PID 4360 wrote to memory of 2052	4360	file.exe	91
PID 4360 wrote to memory of 1460	4360	file.exe	92
PID 4360 wrote to memory of 3184	4360	file.exe	93
PID 4360 wrote to memory of 2780	4360	file.exe	94
PID 4360 wrote to memory of 4524	4360	file.exe	95
PID 4360 wrote to memory of 5184	4360	file.exe	96
PID 4360 wrote to memory of 4620	4360	file.exe	97
PID 4360 wrote to memory of 5224	4360	file.exe	98
PID 5224 wrote to memory of 5152	5224	3199438879.exe	99
PID 5224 wrote to memory of 1332	5224	3199438879.exe	100
PID 4620 wrote to memory of 5420	4620	3303828625.exe	104
PID 5224 wrote to memory of 3092	5224	3199438879.exe	106
PID 4620 wrote to memory of 4296	4620	3303828625.exe	108
PID 4296 wrote to memory of 5164	4296	sysfrodolv.exe	110
PID 5164 wrote to memory of 5588	5164	cmd.exe	112

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4360
- C:\Users\Admin\AppData\Local\Temp\4104719196.exe
  C:\Users\Admin\AppData\Local\Temp\4104719196.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1852
- C:\Users\Admin\AppData\Local\Temp\977531553.exe
  C:\Users\Admin\AppData\Local\Temp\977531553.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2052
- C:\Users\Admin\AppData\Local\Temp\223869192.exe
  C:\Users\Admin\AppData\Local\Temp\223869192.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1460
- C:\Users\Admin\AppData\Local\Temp\2111219655.exe
  C:\Users\Admin\AppData\Local\Temp\2111219655.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3184
- C:\Users\Admin\AppData\Local\Temp\909030115.exe
  C:\Users\Admin\AppData\Local\Temp\909030115.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2780
- C:\Users\Admin\AppData\Local\Temp\2170140522.exe
  C:\Users\Admin\AppData\Local\Temp\2170140522.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4524
- C:\Users\Admin\AppData\Local\Temp\967918214.exe
  C:\Users\Admin\AppData\Local\Temp\967918214.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5184
- C:\Users\Admin\AppData\Local\Temp\3303828625.exe
  C:\Users\Admin\AppData\Local\Temp\3303828625.exe
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4620
- - C:\Users\Admin\sysmgnrsv.exe
    C:\Users\Admin\sysmgnrsv.exe
    3⤵
    - Executes dropped EXE
    PID:5420
- - C:\sysfrodolv.exe
    \sysfrodolv.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4296
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\sysmgnrsv.exe -o 178.16.54.109:6060 -u 83h9mBvy1LL2qW6c2HeWczYVJQsFDF7RfVqDnaiSfFBdDcxfyJfWhRnZqZkY5chb5b6tmKZ1PPhuQbNgXggCdwTrMYWN8hi -p x --cpu-priority=5 --threads=2 --max-cpu-usage=25
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5164
    - - C:\Users\Admin\sysmgnrsv.exe
        
        C:\Users\Admin\sysmgnrsv.exe -o 178.16.54.109:6060 -u 83h9mBvy1LL2qW6c2HeWczYVJQsFDF7RfVqDnaiSfFBdDcxfyJfWhRnZqZkY5chb5b6tmKZ1PPhuQbNgXggCdwTrMYWN8hi -p x --cpu-priority=5 --threads=2 --max-cpu-usage=25
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:5588
- C:\Users\Admin\AppData\Local\Temp\3199438879.exe
  C:\Users\Admin\AppData\Local\Temp\3199438879.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5224
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5152
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1332
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedgewebview2.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2111219655.exe

Path C:\Users\Admin\AppData\Local\Temp\2111219655.exe
Size 18KB
SHA256 428e0a62d12d4a1d3421b158e3d58ef6bc554e1715da19158a3af6468d7c6bb5
MD5 200e69d045085ddeecbb9fb0c2ac79de
SHA1 105574ad8b72fff29c517a9e9bcb0e3823adfad6
SHA512 91d1168220d62d5ac66a2559eef30c81dd889c507ddd860e71bf865a7cab413120b73a10284128ae5ad18203a3ae1c4b12dfb61f0a5b0f6c5c3ed7a42c26d35e
SSDEEP 384:Zt6I8vVaF61eYUQQlmLu94gXTc4lmxav8U9c/l:ZtPAUQQt9z8a0U
TLSH
T1B2824B0FB9414326D0E11070A276867BDA79A8B6378414DBF7E48AED0A6C6D1FC3215F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2170140522.exe

Path C:\Users\Admin\AppData\Local\Temp\2170140522.exe
Size 18KB
SHA256 a8f34e6c23dd2704852855eafcc55cb2d5e300dbfa6cb596d44578e689f0239e
MD5 a0f59c023d0939cd5d905499b40d0ef9
SHA1 cf67886b0702e67bdb39d0dafdaef34bbe2064a6
SHA512 7ff23231355d7de6980d71aa710e374edb903a81d554a9fdd4143e55e980dfcde337c268b2b49159fc7c23527bb1da7f10eb5916ad013d8dd26f37a9ce0b54d5
SSDEEP 384:RL6I8/V6l6Vqo0HlmLu94gXTcolmxav8U9ccbl:RLf80Ht9j8a0Ub
TLSH
T1EE824A0FB9424226D0E110B09676967BDA79A87633C414DBF7E48AEE0A6C6D1FC3215F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

223869192.exe

Path C:\Users\Admin\AppData\Local\Temp\223869192.exe
Size 18KB
SHA256 1e5fb0977788c891046b9e28491497586fa98ee8f693fb1bb97fa34bce92e09c
MD5 20d3461c6fa4e369c23252a471aaccf9
SHA1 40a6727dd2e6d2a2108deba298fc710f0b460ce4
SHA512 ecd55f33fefd5348a5ec4014c10bd4e8c7b921dbf5d3630d10ec49ef4e449ff090ee61068315bd98ea41f935bc2f556f2ec3c489d95b01aba888d255670472eb
SSDEEP 384:4T6I8vVaF61SYUQQlmLu94gXTc4lmxav8U9c3l:4TPkUQQt9z8a0U
TLSH
T114824B0FB9414316D0E11070A276567BDA79A8B6378414DBF7E48AED0B686D1FC3215F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3199438879.exe

Path C:\Users\Admin\AppData\Local\Temp\3199438879.exe
Size 8.3MB
SHA256 ed1d3f69fbbd5576c2ed8dba45ba22c4f6884eb311d4f6e389203846d512ec11
MD5 2cfaefe80e05fe0f093cf5c382d7c77f
SHA1 c2ad2a5b5cd45e6f574d86b6e5b1079ed3063933
SHA512 d75a4743bcb6fa5d879e06ef83536c00408434dff59aee6a182745fe43f57099d9cf3e85cbc149960846ae1d5d4d5cce790baa717f089afbc96bfdf771b1a3d7
SSDEEP 98304:aoM7vbdbj6O/qZLw5tfjf8Bwm1sDjNXX5Ikr3aX5svhUE:aoMLbdbWO/eLafjUBD1+jNnSMq+t
TLSH
T131968D07EC9155A9C0AAE6358A729253BA717C485B3123D73F90F7382F73BD06AB8750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3303828625.exe

Path C:\Users\Admin\AppData\Local\Temp\3303828625.exe
Size 12KB
SHA256 01f64c61767bc41f039cf2080e61da49c96b14e4d558da6c03128e40ca816799
MD5 07bd5d0edaca14204802b8ff7db346ce
SHA1 660784d4aa65c5914978fae86d4f493e26a9b2b1
SHA512 7ba6ede3f8f94eda823241898465fcd71ac5935ed46ed679a525360d44ab6eb9a1298bd7c1c0e7fab28fe096471a62a014c8e147abf752d42118d880b4ad614e
SSDEEP 192:PeeTbgOhmKM84zleg7zL/mmPJxTZ3lk9nAthBsuNOk:mITwG4z0A2oZK9nABsk
TLSH
T1D3421A07AD998121E7F00DB1147E924B86BD3D723BD5AC9FA700F5462DB17A0C472A7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4104719196.exe

Path C:\Users\Admin\AppData\Local\Temp\4104719196.exe
Size 18KB
SHA256 bddbed57dd412c52cb60093dd8bf887f96979f8451933b36e406fa46f290f57c
MD5 1dea1494c8fdd968b2dc09ae484ecedd
SHA1 4a54c473a8b9a18cf835254a088851bb39132f37
SHA512 37cecce8922718fb6497975b32254fb11952d67276c8183689767fb5411926c30a9ad8ce32f0e3ca781b9241a840ab6722d1eaaedfea1103962c6c59559c3e0e
SSDEEP 384:pV6I8vVaF6OeYUQQlmLu94gXQc4lmxav8U9c2l:pVPvUQQt9a8a0U
TLSH
T165824B0FB9414326D0E11070A276567BDA79A8B637C414DBF7E48AED0A6C6D1FC3215F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

909030115.exe

Path C:\Users\Admin\AppData\Local\Temp\909030115.exe
Size 18KB
SHA256 35d1a650fe790571b25a107242a70190b8931ad235b533e44443fd7b938aaf3a
MD5 1a62caa2ccc49ff846625fb0c54b885c
SHA1 7914ffa5ad5be1cfde75c20c89b11d1fbbe64966
SHA512 6b1f3f9c2acf8d58868499f946f264ee6f1ad086a3ec74c3f18bc66de11080d36f5ccc0f9c92da52b426633f5dc26e2e9cc305de2967ad35d5729a54e9ab2a83
SSDEEP 384:8YI6I8/V6l6Vio0HlmLu94gXTcolmxav8U9cUl:8xfk0Ht9j8a0U
TLSH
T10C824B0FB9424226D0D110B09676967BDA79A87633C414DBF7E48AEE0A686D1FC3215F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

967918214.exe

Path C:\Users\Admin\AppData\Local\Temp\967918214.exe
Size 18KB
SHA256 17843590f5ff6f7ce4f7036981fdddfc1057c2ecc34e81eba174c045f1e17e70
MD5 eec3646ea312d5a7c28f3b9bce2e0225
SHA1 cb9a07f694f27ee5539021b0d37d9e9ba26dff7b
SHA512 ae83d421ccb432de076e151e88d55527f4e369e7288366436c65784551e53b8dcec5bd717eddfb9a5ca2311da0fc7d4c4d5cf7e047b78a95a21f428bd4cadefc
SSDEEP 384:JX6I8vVaF61eYUQQlmLu94gXMc4lmxav8U9cCl:JXPAUQQt928a0U
TLSH
T10A824B0FB9414326D0E11070A276467BDA79A8B6378414DBF7E48AED0A686D1FC3215F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

977531553.exe

Path C:\Users\Admin\AppData\Local\Temp\977531553.exe
Size 18KB
SHA256 ed2f3110a5df028f68ec43305bded919097797dd17b7e11f78f3d3f93ce89e00
MD5 ba46eff125dcddcb991cee678f2b7c2f
SHA1 66827ae7fd5352da85e334578daf8755137c89c2
SHA512 8398d2be775ff91dc2b85e3363fb0a827e5e1f71c18302143006aacaa403d1710578dae3c24871574c1f56e9f855f25be08abd368ef0aa688a9ab137e7f0ef82
SSDEEP 384:bk6I8vVaF6OeYUQQlmLu94gXgc4lmxav8U9cjl:bkPvUQQt9K8a0U
TLSH
T1FD824B0FB9414326D0E11070A276467BDA79A8B637C414DBF7E48AED0A6C6D1FC3215F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sysmgnrsv.exe

Path C:\Users\Admin\sysmgnrsv.exe
Size 6.2MB
SHA256 001816f728d96a823a88e8243cba32486ff0207c123628fa767073bb4a49cd6e
MD5 ac458ece671fdde066ce60e448f12bc0
SHA1 d31d5d5617a09e09df0cd3bffde6b03f48a0d540
SHA512 f0c8d01b2ae26e2ad1f63d74831a835b37a2f95e3020b66e9a71b161408a5599f2aa4effc2079c6250cc0e9c34ada1b2a6aba771ea388c6a90ead220a840aa99
SSDEEP 98304:N36U0mJMOqh9s03ZMza32r4vQmI4eXUMltMQXfPJFWNNrgs4u/EKgIymvloXMPwn:NL7y5h9FcJFwrgDu/nGmv6iL0Qg
TLSH
T19D569D26B7A400E8C87AC53CC6469513F7B2B81A53B0A7DB17B4967A1F336D41E3EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5420-64-0x0000021E756C0000-0x0000021E756E0000-memory.dmp

Download