renamer | da5c104d66f5aa210589a8fbf085f4ea5ff8e9f4bf16bd44a68ac7d950369415 | Triage

Submit
Reports

Overview

overview

Static

static

da5c104d66...15.exe

windows7-x64

da5c104d66...15.exe

windows10-2004-x64

Sharing

General

Target

da5c104d66f5aa210589a8fbf085f4ea5ff8e9f4bf16bd44a68ac7d950369415
Size

824KB
Sample

241017-cg4htawgmh
MD5

06e198b92f3931b8511bea4635ca9912
SHA1

60e5f62c71b901ace2dfaa99f2ad59329854671f
SHA256

da5c104d66f5aa210589a8fbf085f4ea5ff8e9f4bf16bd44a68ac7d950369415
SHA512

ca3c560e5c37dca20707693f41a895fd91c666150b34bb568078fd27117c04292e80c00ca68107f0019d54391801dc89c69e6deb7bb58d1228cdbb2b9525d67e
SSDEEP

12288:RwCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ihozEq888888888888W8888888J:VNzCtUpQ9WWPBSSRMTEpXNw

Score

10^/10

renamer discovery worm

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

da5c104d66f5aa210589a8fbf085f4ea5ff8e9f4bf16bd44a68ac7d950369415.exe

Resource

win7-20240729-en

renamer discovery worm

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

da5c104d66f5aa210589a8fbf085f4ea5ff8e9f4bf16bd44a68ac7d950369415.exe

Resource

win10v2004-20241007-en

renamer discovery worm

windows10-2004-x64

8 signatures

150 seconds

Malware Config

Targets

- Target
  
  da5c104d66f5aa210589a8fbf085f4ea5ff8e9f4bf16bd44a68ac7d950369415
- Size
  
  824KB
- MD5
  
  06e198b92f3931b8511bea4635ca9912
- SHA1
  
  60e5f62c71b901ace2dfaa99f2ad59329854671f
- SHA256
  
  da5c104d66f5aa210589a8fbf085f4ea5ff8e9f4bf16bd44a68ac7d950369415
- SHA512
  
  ca3c560e5c37dca20707693f41a895fd91c666150b34bb568078fd27117c04292e80c00ca68107f0019d54391801dc89c69e6deb7bb58d1228cdbb2b9525d67e
- SSDEEP
  
  12288:RwCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ihozEq888888888888W8888888J:VNzCtUpQ9WWPBSSRMTEpXNw
Score

10^/10

renamer discovery worm
- Detects Renamer worm.
  Renamer aka Grename is worm written in Delphi.
- Renamer, Grenam
  Renamer aka Grenam is a worm written in Delphi.
  worm renamer
- Drops startup file
- Loads dropped DLL
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Replication Through Removable Media

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

renamerdiscoveryworm

behavioral2

renamerdiscoveryworm

© 2018-2024

Terms | Privacy