renamer | e674b8a6513382355a1a576bc730e749ee5de0c1f94be3e3b5de14ff4a1f0d7d | Triage

Submit
Reports

Overview

overview

Static

static

e674b8a651...7d.exe

windows7-x64

e674b8a651...7d.exe

windows10-2004-x64

Sharing

General

Target

e674b8a6513382355a1a576bc730e749ee5de0c1f94be3e3b5de14ff4a1f0d7d
Size

824KB
Sample

241108-f6sdmawhpr
MD5

9f25f450bf79404ad433c6d89346a56e
SHA1

190f61fc7cf14274ead75263c42c8c4821f89843
SHA256

e674b8a6513382355a1a576bc730e749ee5de0c1f94be3e3b5de14ff4a1f0d7d
SHA512

12fa4eb0c1e90bb9ddc5d5671a46a9c34f269b6e6c7f005e5a76b235f9d8958cead98ccde8498e13e6a46eb2a6900a9e07dee0a2d05b149b379d42f9beec053b
SSDEEP

12288:rwCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ihozEY888888888888W8888888J:3NzCtUpQ9WWPBSSRMTEpXNy

Score

10^/10

renamer discovery worm

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

e674b8a6513382355a1a576bc730e749ee5de0c1f94be3e3b5de14ff4a1f0d7d.exe

Resource

win7-20240903-en

renamer discovery worm

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

e674b8a6513382355a1a576bc730e749ee5de0c1f94be3e3b5de14ff4a1f0d7d.exe

Resource

win10v2004-20241007-en

renamer discovery worm

windows10-2004-x64

9 signatures

150 seconds

Malware Config

Targets

- Target
  
  e674b8a6513382355a1a576bc730e749ee5de0c1f94be3e3b5de14ff4a1f0d7d
- Size
  
  824KB
- MD5
  
  9f25f450bf79404ad433c6d89346a56e
- SHA1
  
  190f61fc7cf14274ead75263c42c8c4821f89843
- SHA256
  
  e674b8a6513382355a1a576bc730e749ee5de0c1f94be3e3b5de14ff4a1f0d7d
- SHA512
  
  12fa4eb0c1e90bb9ddc5d5671a46a9c34f269b6e6c7f005e5a76b235f9d8958cead98ccde8498e13e6a46eb2a6900a9e07dee0a2d05b149b379d42f9beec053b
- SSDEEP
  
  12288:rwCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ihozEY888888888888W8888888J:3NzCtUpQ9WWPBSSRMTEpXNy
Score

10^/10

renamer discovery worm
- Detects Renamer worm.
  Renamer aka Grename is worm written in Delphi.
- Renamer family
  renamer
- Renamer, Grenam
  Renamer aka Grenam is a worm written in Delphi.
  worm renamer
- Drops startup file
- Loads dropped DLL
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Replication Through Removable Media

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

renamerdiscoveryworm

behavioral2

renamerdiscoveryworm

© 2018-2024

Terms | Privacy