renamer | c9509cb124dc90f499684a1db6393c1067ad3172324e8dd8b34a4a05aa013760 | Triage

Submit
Reports

Overview

overview

Static

static

c9509cb124...0N.exe

windows7-x64

c9509cb124...0N.exe

windows10-2004-x64

Sharing

General

Target

c9509cb124dc90f499684a1db6393c1067ad3172324e8dd8b34a4a05aa013760N
Size

824KB
Sample

241022-yjy7rstbpm
MD5

14aed76da7a1fcb3deccc5940227d200
SHA1

4520009450f9bf0d93f02dbd8515341352e33929
SHA256

c9509cb124dc90f499684a1db6393c1067ad3172324e8dd8b34a4a05aa013760
SHA512

2fd76d39d35a111d388a186d0092d0022d7ca1292afd403cfba92d607da68b6f930362e3390b6bde790c64296cf6b649e140bfea86158cc6cfab7d75bec45d26
SSDEEP

12288:UwCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ihozEp888888888888W8888888J:kNzCtUpQ9WWPBSSRMTEpXNZ

Score

10^/10

renamer discovery worm

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

c9509cb124dc90f499684a1db6393c1067ad3172324e8dd8b34a4a05aa013760N.exe

Resource

win7-20241010-en

renamer discovery worm

windows7-x64

9 signatures

120 seconds

Behavioral task

behavioral2

Sample

c9509cb124dc90f499684a1db6393c1067ad3172324e8dd8b34a4a05aa013760N.exe

Resource

win10v2004-20241007-en

renamer discovery worm

windows10-2004-x64

8 signatures

120 seconds

Malware Config

Targets

- Target
  
  c9509cb124dc90f499684a1db6393c1067ad3172324e8dd8b34a4a05aa013760N
- Size
  
  824KB
- MD5
  
  14aed76da7a1fcb3deccc5940227d200
- SHA1
  
  4520009450f9bf0d93f02dbd8515341352e33929
- SHA256
  
  c9509cb124dc90f499684a1db6393c1067ad3172324e8dd8b34a4a05aa013760
- SHA512
  
  2fd76d39d35a111d388a186d0092d0022d7ca1292afd403cfba92d607da68b6f930362e3390b6bde790c64296cf6b649e140bfea86158cc6cfab7d75bec45d26
- SSDEEP
  
  12288:UwCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ihozEp888888888888W8888888J:kNzCtUpQ9WWPBSSRMTEpXNZ
Score

10^/10

renamer discovery worm
- Detects Renamer worm.
  Renamer aka Grename is worm written in Delphi.
- Renamer, Grenam
  Renamer aka Grenam is a worm written in Delphi.
  worm renamer
- Drops startup file
- Loads dropped DLL
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Replication Through Removable Media

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

renamerdiscoveryworm

behavioral2

renamerdiscoveryworm

© 2018-2024

Terms | Privacy