Analysis Overview
SHA256
3f2a0056e6fe0575d5823732d1e4549ee0c3cf9d196637b8589a0432a46f59e7
Threat Level: Known bad
The file sigmacode.exe was found to be: Known bad.
Malicious Activity Summary
Xenorat family
Detect XenoRat Payload
XenorRat
Reads user/profile data of web browsers
Unsigned PE
Browser Information Discovery
System Location Discovery: System Language Discovery
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2025-03-25 12:04
Signatures
Detect XenoRat Payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Xenorat family
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2025-03-25 12:04
Reported
2025-03-25 12:05
Platform
win10v2004-20250314-en
Max time kernel
47s
Max time network
48s
Command Line
Signatures
Detect XenoRat Payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
XenorRat
Xenorat family
Reads user/profile data of web browsers
Browser Information Discovery
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\sigmacode.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\sigmacode.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\sigmacode.exe
"C:\Users\Admin\AppData\Local\Temp\sigmacode.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | issue-vernon.gl.at.ply.gg | udp |
| US | 147.185.221.25:7560 | issue-vernon.gl.at.ply.gg | tcp |
| US | 147.185.221.25:7560 | issue-vernon.gl.at.ply.gg | tcp |
| US | 147.185.221.25:7560 | issue-vernon.gl.at.ply.gg | tcp |
| US | 147.185.221.25:7560 | issue-vernon.gl.at.ply.gg | tcp |
| US | 147.185.221.25:7560 | issue-vernon.gl.at.ply.gg | tcp |
| US | 147.185.221.25:7560 | issue-vernon.gl.at.ply.gg | tcp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
Files
memory/4680-0-0x000000007477E000-0x000000007477F000-memory.dmp
memory/4680-1-0x0000000000B80000-0x0000000000B92000-memory.dmp
memory/4680-2-0x0000000074770000-0x0000000074F20000-memory.dmp
memory/4680-3-0x000000007477E000-0x000000007477F000-memory.dmp
memory/4680-4-0x0000000006090000-0x00000000060F6000-memory.dmp
memory/4680-5-0x0000000074770000-0x0000000074F20000-memory.dmp
memory/4680-6-0x0000000006030000-0x000000000603A000-memory.dmp
memory/4680-7-0x00000000063A0000-0x0000000006432000-memory.dmp
memory/4680-8-0x00000000069F0000-0x0000000006F94000-memory.dmp
memory/4680-9-0x00000000071A0000-0x000000000729A000-memory.dmp
memory/4680-10-0x0000000007970000-0x0000000007B32000-memory.dmp
memory/4680-11-0x0000000006960000-0x00000000069B0000-memory.dmp
memory/4680-12-0x0000000007320000-0x0000000007396000-memory.dmp
memory/4680-13-0x0000000008390000-0x00000000088BC000-memory.dmp
memory/4680-14-0x0000000074770000-0x0000000074F20000-memory.dmp
memory/4680-15-0x00000000073A0000-0x00000000073BE000-memory.dmp
memory/4680-17-0x0000000007480000-0x000000000751C000-memory.dmp
memory/4680-25-0x0000000007540000-0x00000000077C0000-memory.dmp
memory/4680-48-0x0000000074770000-0x0000000074F20000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2025-03-25 12:04
Reported
2025-03-25 12:07
Platform
win10ltsc2021-20250314-en
Max time kernel
149s
Max time network
151s
Command Line
Signatures
Detect XenoRat Payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
XenorRat
Xenorat family
Reads user/profile data of web browsers
Browser Information Discovery
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\sigmacode.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\sigmacode.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\sigmacode.exe
"C:\Users\Admin\AppData\Local\Temp\sigmacode.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | issue-vernon.gl.at.ply.gg | udp |
| US | 147.185.221.25:7560 | issue-vernon.gl.at.ply.gg | tcp |
| US | 147.185.221.25:7560 | issue-vernon.gl.at.ply.gg | tcp |
| US | 147.185.221.25:7560 | issue-vernon.gl.at.ply.gg | tcp |
| US | 147.185.221.25:7560 | issue-vernon.gl.at.ply.gg | tcp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| GB | 142.250.179.227:80 | c.pki.goog | tcp |
Files
memory/5476-0-0x0000000074ACE000-0x0000000074ACF000-memory.dmp
memory/5476-1-0x0000000000A40000-0x0000000000A52000-memory.dmp
memory/5476-2-0x0000000074AC0000-0x0000000075271000-memory.dmp
memory/5476-3-0x0000000074ACE000-0x0000000074ACF000-memory.dmp
memory/5476-4-0x0000000074AC0000-0x0000000075271000-memory.dmp
memory/5476-5-0x0000000005F60000-0x0000000005FC6000-memory.dmp
memory/5476-6-0x0000000006410000-0x000000000650A000-memory.dmp
memory/5476-7-0x00000000066E0000-0x00000000068A2000-memory.dmp
memory/5476-8-0x0000000006560000-0x00000000065B0000-memory.dmp
memory/5476-9-0x0000000006630000-0x00000000066A6000-memory.dmp
memory/5476-10-0x0000000006DE0000-0x000000000730C000-memory.dmp
memory/5476-11-0x0000000006930000-0x000000000694E000-memory.dmp
memory/5476-12-0x00000000069F0000-0x0000000006A8C000-memory.dmp
memory/5476-13-0x0000000006A90000-0x0000000006D10000-memory.dmp