needle_stealer | 642ece59ea6f9a2f8c4ddf7bc5ee2c758ec9809b9b2f27a6085434e2b5eba870

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 08:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 10KB
Sample260820-khc19ahj3t
SHA256 642ece59ea6f9a2f8c4ddf7bc5ee2c758ec9809b9b2f27a6085434e2b5eba870
MD5 358798482fd0ad0b5212f29e675b4522
SHA1 9a261c7e5f43faa62065ab3d602a972ee680ab76
SHA512 2d565b3b16f057900126a7cf2a7e2edda2566e64bf53dc4787ee9ddad2139be4d3d5afa80b347ed25b27962200f78084740ba68e516ae2fc3995b3175f1322ba
SSDEEP 192:BcolWLwziNBQ5tsxeugRPFJxTEZmFhEorccGFGp:+oBiHAvPFwZsMFG
TLSH
T1EE22D51E2E860331EE6008B0E675864A113D5EE37386FBEBE733D6870AD5D4584C06AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution needle_stealer phorphiex xmrig loader miner persistence spyware stealer trojan worm

Malware Config

Extracted

Family

phorphiex

http://178.16.55.240/
http://178.16.55.240/l/
http://178.16.55.240/nm/
http://178.16.55.240/nmm/

Mutex

464626246

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36

Extracted

Family

needle_stealer

http://130.12.180.135:3000/api/v2

Attributes

api_key
alk_2f668968ee87e7d30f8b996112bebef880cfe8626af9c1d8d53e0f719e47be4f
base_extension
false
self_destruct
false

Signatures

Family: NeedleStealer
NeedleStealer is a modular stealer written in Golang.
stealer needle_stealer
Family: Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects NeedleStealer payload 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024223-50.dat	family_needlestealer

XMRig Miner payload 16 IoCs

miner

resource	yara_rule
behavioral1/memory/992-30-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/992-34-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/992-40-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/992-37-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/992-36-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/992-35-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/992-33-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/992-32-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/992-31-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/992-45-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/992-46-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/992-44-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/992-42-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/992-43-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/992-53-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig
behavioral1/memory/992-54-0x0000000140000000-0x000000014082E000-memory.dmp	xmrig

Downloads MZ/PE file 5 IoCs

flow	pid	Process
10	2276	file.exe
10	2276	file.exe
10	2276	file.exe
10	2276	file.exe
10	2276	file.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 7 IoCs

pid	Process
5068	1034815216.exe
1312	943026286.exe
2144	3278936697.exe
1920	1263214336.exe
1704	3599224747.exe
1320	syswinprdrvc.exe
4432	2179538113.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1320 set thread context of 992	1320	syswinprdrvc.exe	111

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3680	sc.exe
320	sc.exe
2176	sc.exe
1624	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1034815216.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	943026286.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3278936697.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1263214336.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	24	Go-http-client/1.1

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
4372	taskkill.exe
4104	taskkill.exe
3264	taskkill.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
1704	3599224747.exe
1704	3599224747.exe
1704	3599224747.exe
1704	3599224747.exe
1320	syswinprdrvc.exe
4432	2179538113.exe
4432	2179538113.exe
4432	2179538113.exe
4432	2179538113.exe
4432	2179538113.exe
4432	2179538113.exe
4432	2179538113.exe
4432	2179538113.exe
4432	2179538113.exe
4432	2179538113.exe
4432	2179538113.exe
4432	2179538113.exe
4432	2179538113.exe
4432	2179538113.exe
4432	2179538113.exe
4432	2179538113.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	992	dwm.exe
Token: SeDebugPrivilege	4432	2179538113.exe
Token: SeDebugPrivilege	4372	taskkill.exe
Token: SeDebugPrivilege	3264	taskkill.exe
Token: SeDebugPrivilege	4104	taskkill.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 5068	2276	file.exe	87
PID 2276 wrote to memory of 1312	2276	file.exe	91
PID 2276 wrote to memory of 2144	2276	file.exe	94
PID 2276 wrote to memory of 1920	2276	file.exe	99
PID 2276 wrote to memory of 1704	2276	file.exe	101
PID 1320 wrote to memory of 992	1320	syswinprdrvc.exe	111
PID 1320 wrote to memory of 992	1320	syswinprdrvc.exe	111
PID 1320 wrote to memory of 992	1320	syswinprdrvc.exe	111
PID 1320 wrote to memory of 992	1320	syswinprdrvc.exe	111
PID 1320 wrote to memory of 992	1320	syswinprdrvc.exe	111
PID 1320 wrote to memory of 992	1320	syswinprdrvc.exe	111
PID 1320 wrote to memory of 992	1320	syswinprdrvc.exe	111
PID 1320 wrote to memory of 992	1320	syswinprdrvc.exe	111
PID 1320 wrote to memory of 992	1320	syswinprdrvc.exe	111
PID 1320 wrote to memory of 992	1320	syswinprdrvc.exe	111
PID 1320 wrote to memory of 992	1320	syswinprdrvc.exe	111
PID 1320 wrote to memory of 992	1320	syswinprdrvc.exe	111
PID 2276 wrote to memory of 4432	2276	file.exe	112
PID 4432 wrote to memory of 4372	4432	2179538113.exe	113
PID 4432 wrote to memory of 3264	4432	2179538113.exe	114
PID 4432 wrote to memory of 4104	4432	2179538113.exe	119

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Users\Admin\AppData\Local\Temp\1034815216.exe
  C:\Users\Admin\AppData\Local\Temp\1034815216.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5068
- C:\Users\Admin\AppData\Local\Temp\943026286.exe
  C:\Users\Admin\AppData\Local\Temp\943026286.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1312
- C:\Users\Admin\AppData\Local\Temp\3278936697.exe
  C:\Users\Admin\AppData\Local\Temp\3278936697.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2144
- C:\Users\Admin\AppData\Local\Temp\1263214336.exe
  C:\Users\Admin\AppData\Local\Temp\1263214336.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1920
- C:\Users\Admin\AppData\Local\Temp\3599224747.exe
  C:\Users\Admin\AppData\Local\Temp\3599224747.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1704
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "winmgr"
    3⤵
    - Launches sc.exe
    PID:3680
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "winmgr" binpath= "C:\ProgramData\winmgr\syswinprdrvc.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:320
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:2176
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "winmgr"
    3⤵
    - Launches sc.exe
    PID:1624
- C:\Users\Admin\AppData\Local\Temp\2179538113.exe
  C:\Users\Admin\AppData\Local\Temp\2179538113.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4432
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4372
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3264
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedgewebview2.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4104

C:\ProgramData\winmgr\syswinprdrvc.exe
C:\ProgramData\winmgr\syswinprdrvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Windows\system32\dwm.exe
  dwm.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

1034815216.exe

Path C:\Users\Admin\AppData\Local\Temp\1034815216.exe
Size 18KB
SHA256 46b17f043c38aaa7bb67986b4101cecdb9cd176f259828f0b4e9fa2f5d7b17ed
MD5 0126590cd5a48d265d7408ffd68619c5
SHA1 3bbe520fdab2d7c75f44b03052f4f928a0d60b82
SHA512 3d66778de85346c519561517d5561c08b2fbcac5c9d41d06caa92d7a32bcfaed145a2cc55da4ec66175242a8850a1658c39dbd4c8dcf400da725bd8de7009948
SSDEEP 384:0S6I8vVaF61SYUQQlmLu94gXTczlmxav8U9cVl:0SPkUQQt9U8a0U
TLSH
T1D9824B0FB9424326D0E11070A676867BDA79A8B633C514DBF7E48AED0A686D1FC3215F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1263214336.exe

Path C:\Users\Admin\AppData\Local\Temp\1263214336.exe
Size 18KB
SHA256 8678a0b7ebe2eccf92cdab9a60bb9d55260c776fcd44ee8a2530cfa379d0460a
MD5 5a490555596fd0084c9816c742f54030
SHA1 fbaae541c1b6a47441e58fadf36a7ef7617db4cd
SHA512 46babd71c2b8a06f89474fccf57bec7bc94c44a27a7b7c7693733f2959531bcc8519a20cc60b9ea97d11515c8a3e9d0795b9cfccbb978c8cfa92a839465af2c9
SSDEEP 384:GP6I8/V6l6Vio0HlmLu94gXTcjlmxav8U9c9bl:GPfk0Ht9k8a0UO
TLSH
T1E4824B0FB9424326D0E110B09676967BDA79A87633C414DBF7E48AEE0A686D1FC3315F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2179538113.exe

Path C:\Users\Admin\AppData\Local\Temp\2179538113.exe
Size 8.3MB
SHA256 ed1d3f69fbbd5576c2ed8dba45ba22c4f6884eb311d4f6e389203846d512ec11
MD5 2cfaefe80e05fe0f093cf5c382d7c77f
SHA1 c2ad2a5b5cd45e6f574d86b6e5b1079ed3063933
SHA512 d75a4743bcb6fa5d879e06ef83536c00408434dff59aee6a182745fe43f57099d9cf3e85cbc149960846ae1d5d4d5cce790baa717f089afbc96bfdf771b1a3d7
SSDEEP 98304:aoM7vbdbj6O/qZLw5tfjf8Bwm1sDjNXX5Ikr3aX5svhUE:aoMLbdbWO/eLafjUBD1+jNnSMq+t
TLSH
T131968D07EC9155A9C0AAE6358A729253BA717C485B3123D73F90F7382F73BD06AB8750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3278936697.exe

Path C:\Users\Admin\AppData\Local\Temp\3278936697.exe
Size 18KB
SHA256 6f7dc171744100aa4d50cb2b7f22b059861b2992c7d1a97f928ba835bdd2b2c3
MD5 d316c5318b3310ff81580776a06b2eb5
SHA1 c85ef0b963e98a775ddaa0536ce214ff8a37d3e7
SHA512 d295921e53cbb53c1e7e18ebeb0135e5adcf1412cdfcbba145e4c2665e4d4b485660058550dff694c46eef5e48929b829917e5ad25732dfd72998879909ce978
SSDEEP 384:T96I8/V6l6VWo0HlmLu94gXTcjlmxav8U9cml:T9f40Ht9k8a0U
TLSH
T136824A0FB9424326D0E110B09676967BDA79A87633C414DBF7E48AEE0A686D1FC3215F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3599224747.exe

Path C:\Users\Admin\AppData\Local\Temp\3599224747.exe
Size 6.8MB
SHA256 9639f7ebc6a6d69d7bf5b8bc869e7783a1406088f192868624ad8919e9bfd1d4
MD5 083d5895283755a910b5c59d60a5348b
SHA1 0d94bf4d0418061907ff7977e3f25a463cb25188
SHA512 4ae34f0e50843182f780d1e31b1226db5f831e6d48c1cfe9448c0c2da558a334f0ee37d00dfbe84c80e7d54a17eed1cc8b56b34da71123b65541a4dc58076f10
SSDEEP 196608:Od8aiP1kVGff0MYA9ZHP6mJhimlsM0sH86TTS6k:OWlMyhJDse/5
TLSH
T188660246297FA774A367A3848BD1E5739AAF4639FE55853036233CEB9F1049400B0EE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

943026286.exe

Path C:\Users\Admin\AppData\Local\Temp\943026286.exe
Size 18KB
SHA256 37c11f7513e3f89936105ecc9a6d1d24e5ec8e2c732624d22835024747389569
MD5 0c6008df0c79c76bd9fc6ad19a4c7c4b
SHA1 8a27970da176e3e827414422ee20c46fabfadd0d
SHA512 e58c0e9d461216f3cc1e339f8ef9e3c79f8e621beedb9351620aeede279df9b4a622a4a6c50ddb55b1ec40c26ef342a47b96c4acf4e6f64ef0b567901e0ee62c
SSDEEP 384:k56I8vVaF61eYUQQlmLu94gXTczlmxav8U9cIfl:k5PAUQQt9U8a0UZ
TLSH
T1CF824B0FB9424326D0E11070A676867BDA79A8B633C414DBF7E48AED0A6C6D5FC3215F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/992-33-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/992-29-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/992-40-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/992-37-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/992-36-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/992-35-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/992-34-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/992-32-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/992-31-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/992-41-0x000001B326D40000-0x000001B326D60000-memory.dmp

Download

memory/992-45-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/992-46-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/992-44-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/992-42-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/992-43-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/992-30-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/992-53-0x0000000140000000-0x000000014082E000-memory.dmp

Download

memory/992-54-0x0000000140000000-0x000000014082E000-memory.dmp

Download