Overview

overview

10

Static

static

3

1dde3009ce...e4.exe

windows7-x64

10

1dde3009ce...e4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1dde3009cebda5c139c4ddf98574b2ac5cdc9a82b3e2402efaad66d0246bdee4

  • Size

    2.6MB

  • Sample

    240928-x6crlssenl

  • MD5

    693d588667850d58b0257906ef0c08ce

  • SHA1

    cb4366dd06a62bd35549722b282e86f0dcdde60a

  • SHA256

    1dde3009cebda5c139c4ddf98574b2ac5cdc9a82b3e2402efaad66d0246bdee4

  • SHA512

    aab2d29d59c9caaabfc40e0b4b04a5ff835975e571d4bef121fdb5b9e25eb213658a77609595339b00f3059a3367d54965650060beaafb4833357300b34a62a7

  • SSDEEP

    49152:igTUS7p9aBZbTChxKCnFnQXBbrtgb/iQvu0UHOi:uZ6hxvWbrtUTrUHOi

Score
10/10
ramnitrenamerbankerdiscoverypersistencespywarestealertrojanupxworm

Malware Config

Targets

    • Target

      1dde3009cebda5c139c4ddf98574b2ac5cdc9a82b3e2402efaad66d0246bdee4

    • Size

      2.6MB

    • MD5

      693d588667850d58b0257906ef0c08ce

    • SHA1

      cb4366dd06a62bd35549722b282e86f0dcdde60a

    • SHA256

      1dde3009cebda5c139c4ddf98574b2ac5cdc9a82b3e2402efaad66d0246bdee4

    • SHA512

      aab2d29d59c9caaabfc40e0b4b04a5ff835975e571d4bef121fdb5b9e25eb213658a77609595339b00f3059a3367d54965650060beaafb4833357300b34a62a7

    • SSDEEP

      49152:igTUS7p9aBZbTChxKCnFnQXBbrtgb/iQvu0UHOi:uZ6hxvWbrtUTrUHOi

    Score
    10/10
    ramnitrenamerbankerdiscoveryspywarestealertrojanupxwormpersistence

    • Detects Renamer worm.

      Renamer aka Grename is worm written in Delphi.

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

      trojanspywarestealerwormbankerramnit

    • Renamer, Grenam

      Renamer aka Grenam is a worm written in Delphi.

      wormrenamer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks