Managed XDR

cur-1642194914.m647415...-s-223125-w-226220_2-s (WhisperGate) — malware analysis report

File info

Filename
cur-1642194914.m647415p552503.a2plcpnl0073.prod.iad2.secureserver.net-s-223125-w-226220_2-s
File type
SMTP mail, UTF-8 Unicode text
File size
217.9 KB
First seen
Last seen

Environment

w10/x64 en

Hashes

SHA1
066b4e4f3e4991769170293de58108d009d16021
SHA256
4116a0d390d07a839aca65b2ec199b4ca258fdaf6ec4270b6e12228806946499
MD5
b5320049db7308654508ec7c8db2296a

Malwares

  • WhisperGate

Signatures

Privilege Escalation

T1134 sets_privilegies_via_adjusttokenprivileges: Sets process privilege via AdjustTokenPrivileges
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1497.001 antivm_network_adapters: Checks NIC addresses
T1497 evasion_printers: Attempts to detect Sandbox by exploring existing printers
T1497.001 antivm_generic_productname: Checks system product name in registry, possibly for anti-virtualization
T1497.001 antivm_queries_computername: Retrieves the computer name
T1497.003 antisandbox_sleep: The process attempted to slow down analysis
T1134 sets_privilegies_via_adjusttokenprivileges: Sets process privilege via AdjustTokenPrivileges
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Credential Access

T1555.004 windows_credential_manager: Acquire credentials from the Windows Credential Manager

Discovery

T1497.001 antivm_network_adapters: Checks NIC addresses
T1497 evasion_printers: Attempts to detect Sandbox by exploring existing printers
T1497.001 antivm_generic_productname: Checks system product name in registry, possibly for anti-virtualization
T1497.001 antivm_queries_computername: Retrieves the computer name
T1497.003 antisandbox_sleep: The process attempted to slow down analysis

Command and Control

T1102.003 cloud_discord: Connects to cloud services of Discord (potentially for malicious payload delivery)
T1071.001 winhttp_https: Performs HTTP/HTTPS requests using WinHttp

Other

yara_rules: Static rules
suricata_alert: Malicious traffic detected
network_bind: Starts servers listening at None
process_crashed: One of the processes has failed
suspicious_network_port: Performs TCP or UDP request to non-standard port
test_check_service: Starts services
dotnet_downloader_possible_network_problem: Dotnet program possibly has network problem

Related reports

Managed XDR