renamer | 3a00c4a61f024c2601a2add2f6da0f3c5773ca4b0ae7b84948e7fc6bbceb4a6b | Triage

Submit
Reports

Overview

overview

Static

static

3a00c4a61f...bN.exe

windows7-x64

3a00c4a61f...bN.exe

windows10-2004-x64

Sharing

General

Target

3a00c4a61f024c2601a2add2f6da0f3c5773ca4b0ae7b84948e7fc6bbceb4a6bN
Size

824KB
Sample

240919-m9m2mswbrr
MD5

f1ae23ccdb23d6c2c99ad51b7ceb0220
SHA1

25afc37d527d84931c62edb08e2c7878a563a4b9
SHA256

3a00c4a61f024c2601a2add2f6da0f3c5773ca4b0ae7b84948e7fc6bbceb4a6b
SHA512

d8a387925459bd12d911fc5035cdcd3b6a122ba04bc73c798fc12ba7641d7bbb3ca71ae7cb7cc7603d51aab9ab0f38c7fcd56b926b9a83424aaef1e7f5d47e4f
SSDEEP

12288:3wCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ihozE9888888888888W8888888J:jNzCtUpQ9WWPBSSRMTEpXN1

Score

10^/10

renamer discovery worm

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

3a00c4a61f024c2601a2add2f6da0f3c5773ca4b0ae7b84948e7fc6bbceb4a6bN.exe

Resource

win7-20240708-en

renamer discovery worm

windows7-x64

9 signatures

120 seconds

Behavioral task

behavioral2

Sample

3a00c4a61f024c2601a2add2f6da0f3c5773ca4b0ae7b84948e7fc6bbceb4a6bN.exe

Resource

win10v2004-20240802-en

renamer discovery worm

windows10-2004-x64

8 signatures

120 seconds

Malware Config

Targets

- Target
  
  3a00c4a61f024c2601a2add2f6da0f3c5773ca4b0ae7b84948e7fc6bbceb4a6bN
- Size
  
  824KB
- MD5
  
  f1ae23ccdb23d6c2c99ad51b7ceb0220
- SHA1
  
  25afc37d527d84931c62edb08e2c7878a563a4b9
- SHA256
  
  3a00c4a61f024c2601a2add2f6da0f3c5773ca4b0ae7b84948e7fc6bbceb4a6b
- SHA512
  
  d8a387925459bd12d911fc5035cdcd3b6a122ba04bc73c798fc12ba7641d7bbb3ca71ae7cb7cc7603d51aab9ab0f38c7fcd56b926b9a83424aaef1e7f5d47e4f
- SSDEEP
  
  12288:3wCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ihozE9888888888888W8888888J:jNzCtUpQ9WWPBSSRMTEpXN1
Score

10^/10

renamer discovery worm
- Detects Renamer worm.
  Renamer aka Grename is worm written in Delphi.
- Renamer, Grenam
  Renamer aka Grenam is a worm written in Delphi.
  worm renamer
- Drops startup file
- Loads dropped DLL
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Replication Through Removable Media

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

renamerdiscoveryworm

behavioral2

renamerdiscoveryworm

© 2018-2025

Terms | Privacy