renamer | 65c9703b79d95c34421c34bfddf433ac16738bd97f5b7c1e2fc1097f1b1810b3 | Triage

Submit
Reports

Overview

overview

Static

static

65c9703b79...b3.exe

windows7-x64

65c9703b79...b3.exe

windows10-2004-x64

Sharing

General

Target

65c9703b79d95c34421c34bfddf433ac16738bd97f5b7c1e2fc1097f1b1810b3
Size

816KB
Sample

241112-2t7tfashkn
MD5

f987113ab71e169cd9926bf6822606d0
SHA1

b51d7a2fb4852c97498c1d54f60ed125876bdf3b
SHA256

65c9703b79d95c34421c34bfddf433ac16738bd97f5b7c1e2fc1097f1b1810b3
SHA512

b9373289ce80b8ff17e2a636c6c4018130ca54c107267c6c76d703a7170a019ae2e4c5dce7cefd9511423d6e7db1890e9de1441a7ca084107bf5c04286ad733d
SSDEEP

12288:CqkAx8i7pC8PapFTUt6xIuFrb9OKcEKfBKSNqvnSNgFCV4tuRd888888888888WX:f8i7pjPapFTUt6xIyHGBKSNqvn5K4tku

Score

10^/10

renamer discovery persistence worm

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

65c9703b79d95c34421c34bfddf433ac16738bd97f5b7c1e2fc1097f1b1810b3.exe

Resource

win7-20241010-en

renamer discovery persistence worm

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

65c9703b79d95c34421c34bfddf433ac16738bd97f5b7c1e2fc1097f1b1810b3.exe

Resource

win10v2004-20241007-en

renamer discovery persistence worm

windows10-2004-x64

9 signatures

150 seconds

Malware Config

Targets

- Target
  
  65c9703b79d95c34421c34bfddf433ac16738bd97f5b7c1e2fc1097f1b1810b3
- Size
  
  816KB
- MD5
  
  f987113ab71e169cd9926bf6822606d0
- SHA1
  
  b51d7a2fb4852c97498c1d54f60ed125876bdf3b
- SHA256
  
  65c9703b79d95c34421c34bfddf433ac16738bd97f5b7c1e2fc1097f1b1810b3
- SHA512
  
  b9373289ce80b8ff17e2a636c6c4018130ca54c107267c6c76d703a7170a019ae2e4c5dce7cefd9511423d6e7db1890e9de1441a7ca084107bf5c04286ad733d
- SSDEEP
  
  12288:CqkAx8i7pC8PapFTUt6xIuFrb9OKcEKfBKSNqvnSNgFCV4tuRd888888888888WX:f8i7pjPapFTUt6xIyHGBKSNqvn5K4tku
Score

10^/10

renamer discovery persistence worm
- Detects Renamer worm.
  Renamer aka Grename is worm written in Delphi.
- Renamer family
  renamer
- Renamer, Grenam
  Renamer aka Grenam is a worm written in Delphi.
  worm renamer
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Replication Through Removable Media

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

renamerdiscoverypersistenceworm

behavioral2

renamerdiscoverypersistenceworm

© 2018-2024

Terms | Privacy