renamer | e7424a105984c3edd28be5a26995bd837e4321147dc2a62c5aa725d717a1564f | Triage

Submit
Reports

Overview

overview

Static

static

e7424a1059...fN.exe

windows7-x64

e7424a1059...fN.exe

windows10-2004-x64

Sharing

General

Target

e7424a105984c3edd28be5a26995bd837e4321147dc2a62c5aa725d717a1564fN
Size

824KB
Sample

241031-hsdz7atrdn
MD5

5b6e80fda4a73d57a89cabe991a4f1d0
SHA1

4be471040fd43526e2e96ce2ceb6601da2863727
SHA256

e7424a105984c3edd28be5a26995bd837e4321147dc2a62c5aa725d717a1564f
SHA512

92bafa2f34e8e24982542ca4027aa0fba799eee3b311c5b2a8c4333e96421e83b554458ffaa6c4db43ee2b417c608d8b2f48b33e9295dff72ad06c85925271d5
SSDEEP

12288:2wCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ihozEx888888888888W8888888J:2NzCtUpQ9WWPBSSRMTEpXNh

Score

10^/10

renamer discovery worm

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

e7424a105984c3edd28be5a26995bd837e4321147dc2a62c5aa725d717a1564fN.exe

Resource

win7-20240903-en

renamer discovery worm

windows7-x64

10 signatures

120 seconds

Behavioral task

behavioral2

Sample

e7424a105984c3edd28be5a26995bd837e4321147dc2a62c5aa725d717a1564fN.exe

Resource

win10v2004-20241007-en

renamer discovery worm

windows10-2004-x64

9 signatures

120 seconds

Malware Config

Targets

- Target
  
  e7424a105984c3edd28be5a26995bd837e4321147dc2a62c5aa725d717a1564fN
- Size
  
  824KB
- MD5
  
  5b6e80fda4a73d57a89cabe991a4f1d0
- SHA1
  
  4be471040fd43526e2e96ce2ceb6601da2863727
- SHA256
  
  e7424a105984c3edd28be5a26995bd837e4321147dc2a62c5aa725d717a1564f
- SHA512
  
  92bafa2f34e8e24982542ca4027aa0fba799eee3b311c5b2a8c4333e96421e83b554458ffaa6c4db43ee2b417c608d8b2f48b33e9295dff72ad06c85925271d5
- SSDEEP
  
  12288:2wCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ihozEx888888888888W8888888J:2NzCtUpQ9WWPBSSRMTEpXNh
Score

10^/10

renamer discovery worm
- Detects Renamer worm.
  Renamer aka Grename is worm written in Delphi.
- Renamer family
  renamer
- Renamer, Grenam
  Renamer aka Grenam is a worm written in Delphi.
  worm renamer
- Drops startup file
- Loads dropped DLL
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Replication Through Removable Media

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

renamerdiscoveryworm

behavioral2

renamerdiscoveryworm

© 2018-2024

Terms | Privacy