renamer | 940128e16d2ba02fd1598b58b0f40a04afa9b13238ac1f9c8dfb43469cefec90 | Triage

Sharing

General

Target

940128e16d2ba02fd1598b58b0f40a04afa9b13238ac1f9c8dfb43469cefec90
Size

848KB
Sample

241030-chcfqavblj
MD5

da09d53c0ea19616574f0949f3e8989e
SHA1

a53694754dce1e768068bddac41d55eb06dfe1e1
SHA256

940128e16d2ba02fd1598b58b0f40a04afa9b13238ac1f9c8dfb43469cefec90
SHA512

3ea49961548fd7f95b23124c63da51d0b6664ff0d0a31b28979b83ea2ce9d0c5bbd79114b3a55be5cf7ad2fcb77b13aa794611289f57faeedd550516d8b943d7
SSDEEP

12288:CwCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4WhozEz888888888888W8888888o:yNzCtUpQ9WWPBSSRMTEpPNg

Score

10^/10

renamer discovery evasion worm

Malware Config

Targets

- Target
  
  940128e16d2ba02fd1598b58b0f40a04afa9b13238ac1f9c8dfb43469cefec90
- Size
  
  848KB
- MD5
  
  da09d53c0ea19616574f0949f3e8989e
- SHA1
  
  a53694754dce1e768068bddac41d55eb06dfe1e1
- SHA256
  
  940128e16d2ba02fd1598b58b0f40a04afa9b13238ac1f9c8dfb43469cefec90
- SHA512
  
  3ea49961548fd7f95b23124c63da51d0b6664ff0d0a31b28979b83ea2ce9d0c5bbd79114b3a55be5cf7ad2fcb77b13aa794611289f57faeedd550516d8b943d7
- SSDEEP
  
  12288:CwCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4WhozEz888888888888W8888888o:yNzCtUpQ9WWPBSSRMTEpPNg
Score

10^/10

renamer discovery worm evasion
- Detects Renamer worm.
  Renamer aka Grename is worm written in Delphi.
- Modifies firewall policy service
  evasion
- Renamer family
  renamer
- Renamer, Grenam
  Renamer aka Grenam is a worm written in Delphi.
  worm renamer
- Drops file in Drivers directory
- Drops startup file
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Replication Through Removable Media

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

renamerdiscoveryworm

behavioral2

renamerdiscoveryevasionworm