Malware Analysis Report

2025-04-13 23:04

Sample ID 250325-n8rtwav1b1
Target sigmacode.exe
SHA256 3f2a0056e6fe0575d5823732d1e4549ee0c3cf9d196637b8589a0432a46f59e7
Tags
xenorat discovery rat spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3f2a0056e6fe0575d5823732d1e4549ee0c3cf9d196637b8589a0432a46f59e7

Threat Level: Known bad

The file sigmacode.exe was found to be: Known bad.

Malicious Activity Summary

xenorat discovery rat spyware stealer trojan

Xenorat family

Detect XenoRat Payload

XenorRat

Reads user/profile data of web browsers

Unsigned PE

Browser Information Discovery

System Location Discovery: System Language Discovery

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-03-25 12:04

Signatures

Detect XenoRat Payload

Description Indicator Process Target
N/A N/A N/A N/A

Xenorat family

xenorat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-03-25 12:04

Reported

2025-03-25 12:05

Platform

win10v2004-20250314-en

Max time kernel

47s

Max time network

48s

Command Line

"C:\Users\Admin\AppData\Local\Temp\sigmacode.exe"

Signatures

Detect XenoRat Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

XenorRat

trojan rat xenorat

Xenorat family

xenorat

Reads user/profile data of web browsers

spyware stealer

Browser Information Discovery

discovery

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\sigmacode.exe

"C:\Users\Admin\AppData\Local\Temp\sigmacode.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 issue-vernon.gl.at.ply.gg udp
US 147.185.221.25:7560 issue-vernon.gl.at.ply.gg tcp
US 147.185.221.25:7560 issue-vernon.gl.at.ply.gg tcp
US 147.185.221.25:7560 issue-vernon.gl.at.ply.gg tcp
US 147.185.221.25:7560 issue-vernon.gl.at.ply.gg tcp
US 147.185.221.25:7560 issue-vernon.gl.at.ply.gg tcp
US 147.185.221.25:7560 issue-vernon.gl.at.ply.gg tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

memory/4680-0-0x000000007477E000-0x000000007477F000-memory.dmp

memory/4680-1-0x0000000000B80000-0x0000000000B92000-memory.dmp

memory/4680-2-0x0000000074770000-0x0000000074F20000-memory.dmp

memory/4680-3-0x000000007477E000-0x000000007477F000-memory.dmp

memory/4680-4-0x0000000006090000-0x00000000060F6000-memory.dmp

memory/4680-5-0x0000000074770000-0x0000000074F20000-memory.dmp

memory/4680-6-0x0000000006030000-0x000000000603A000-memory.dmp

memory/4680-7-0x00000000063A0000-0x0000000006432000-memory.dmp

memory/4680-8-0x00000000069F0000-0x0000000006F94000-memory.dmp

memory/4680-9-0x00000000071A0000-0x000000000729A000-memory.dmp

memory/4680-10-0x0000000007970000-0x0000000007B32000-memory.dmp

memory/4680-11-0x0000000006960000-0x00000000069B0000-memory.dmp

memory/4680-12-0x0000000007320000-0x0000000007396000-memory.dmp

memory/4680-13-0x0000000008390000-0x00000000088BC000-memory.dmp

memory/4680-14-0x0000000074770000-0x0000000074F20000-memory.dmp

memory/4680-15-0x00000000073A0000-0x00000000073BE000-memory.dmp

memory/4680-17-0x0000000007480000-0x000000000751C000-memory.dmp

memory/4680-25-0x0000000007540000-0x00000000077C0000-memory.dmp

memory/4680-48-0x0000000074770000-0x0000000074F20000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-03-25 12:04

Reported

2025-03-25 12:07

Platform

win10ltsc2021-20250314-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\sigmacode.exe"

Signatures

Detect XenoRat Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

XenorRat

trojan rat xenorat

Xenorat family

xenorat

Reads user/profile data of web browsers

spyware stealer

Browser Information Discovery

discovery

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\sigmacode.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\sigmacode.exe

"C:\Users\Admin\AppData\Local\Temp\sigmacode.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 issue-vernon.gl.at.ply.gg udp
US 147.185.221.25:7560 issue-vernon.gl.at.ply.gg tcp
US 147.185.221.25:7560 issue-vernon.gl.at.ply.gg tcp
US 147.185.221.25:7560 issue-vernon.gl.at.ply.gg tcp
US 147.185.221.25:7560 issue-vernon.gl.at.ply.gg tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.179.227:80 c.pki.goog tcp

Files

memory/5476-0-0x0000000074ACE000-0x0000000074ACF000-memory.dmp

memory/5476-1-0x0000000000A40000-0x0000000000A52000-memory.dmp

memory/5476-2-0x0000000074AC0000-0x0000000075271000-memory.dmp

memory/5476-3-0x0000000074ACE000-0x0000000074ACF000-memory.dmp

memory/5476-4-0x0000000074AC0000-0x0000000075271000-memory.dmp

memory/5476-5-0x0000000005F60000-0x0000000005FC6000-memory.dmp

memory/5476-6-0x0000000006410000-0x000000000650A000-memory.dmp

memory/5476-7-0x00000000066E0000-0x00000000068A2000-memory.dmp

memory/5476-8-0x0000000006560000-0x00000000065B0000-memory.dmp

memory/5476-9-0x0000000006630000-0x00000000066A6000-memory.dmp

memory/5476-10-0x0000000006DE0000-0x000000000730C000-memory.dmp

memory/5476-11-0x0000000006930000-0x000000000694E000-memory.dmp

memory/5476-12-0x00000000069F0000-0x0000000006A8C000-memory.dmp

memory/5476-13-0x0000000006A90000-0x0000000006D10000-memory.dmp