Analysis
-
max time kernel
47s -
max time network
48s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
25/03/2025, 12:04
General
-
Target
sigmacode.exe
-
Size
45KB
-
MD5
4fbef0899b35ae09ba0d601cba569e54
-
SHA1
49e1f7939dc5ad245a26f5c5762bec1d4730f797
-
SHA256
3f2a0056e6fe0575d5823732d1e4549ee0c3cf9d196637b8589a0432a46f59e7
-
SHA512
bcd3ae5fb14bf7f3d49520afa00c47360ddd178bbc1b8fb8490b18280495a708efc23afb6b08693c71b7cad410b6241cf545448103d0afaf9c649806376b5908
-
SSDEEP
768:KdhO/poiiUcjlJInvbqmH9Xqk5nWEZ5SbTDaxWI7CPW5h:sw+jjgnzH9XqcnW85SbTgWIZ
Malware Config
Extracted
xenorat
issue-vernon.gl.at.ply.gg
deptrainhatvutru
-
delay
5000
-
install_path
nothingset
-
port
7560
-
startup_name
nothingset
Signatures
-
Detect XenoRat Payload 3 IoCs
-
XenorRat
XenorRat is a remote access trojan written in C#.
-
Xenorat family
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 37 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\sigmacode.exe"C:\Users\Admin\AppData\Local\Temp\sigmacode.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
408KB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
584KB
-
Filesize
5.6MB
-
Filesize
1000KB
-
Filesize
1.8MB
-
Filesize
320KB
-
Filesize
472KB
-
Filesize
5.2MB
-
Filesize
7.7MB
-
Filesize
120KB
-
Filesize
624KB
-
Filesize
2.5MB
-
Filesize
7.7MB