renamer | c9e546a73a149407dd884a267261cd7644e28ea3803cf43f8fcb7efcfba00000 | Triage

Submit
Reports

Overview

overview

Static

static

3

c9e546a73a...00.exe

windows7-x64

c9e546a73a...00.exe

windows10-2004-x64

Sharing

General

Target

c9e546a73a149407dd884a267261cd7644e28ea3803cf43f8fcb7efcfba00000.exe
Size

924KB
Sample

250116-rqblqavpej
MD5

0f19557a9da139fc9fee1dbfc7b471fa
SHA1

ee355b74f40e90cd1dea64c2b5c783fba36461b4
SHA256

c9e546a73a149407dd884a267261cd7644e28ea3803cf43f8fcb7efcfba00000
SHA512

4ad4bf112503428b2e2829395233884d248b6dfaf96b1c8247a7a9a6a187681d56bd76a9d422e5fa8854109e9809700f0d85c8bf2ab114f84eb6c8e06fb28309
SSDEEP

12288:Wytm2WSk/SSs/O0OOlkmJ5pIJYgEl2yjreZiOt+nW2wk/D3W:9tmdiEOlk26aVeZiOmW2pW

Score

10^/10

renamer discovery worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

c9e546a73a149407dd884a267261cd7644e28ea3803cf43f8fcb7efcfba00000.exe

Resource

win7-20240903-en

renamer discovery worm

windows7-x64

13 signatures

120 seconds

Behavioral task

behavioral2

Sample

c9e546a73a149407dd884a267261cd7644e28ea3803cf43f8fcb7efcfba00000.exe

Resource

win10v2004-20241007-en

renamer discovery worm

windows10-2004-x64

12 signatures

120 seconds

Malware Config

Targets

- Target
  
  c9e546a73a149407dd884a267261cd7644e28ea3803cf43f8fcb7efcfba00000.exe
- Size
  
  924KB
- MD5
  
  0f19557a9da139fc9fee1dbfc7b471fa
- SHA1
  
  ee355b74f40e90cd1dea64c2b5c783fba36461b4
- SHA256
  
  c9e546a73a149407dd884a267261cd7644e28ea3803cf43f8fcb7efcfba00000
- SHA512
  
  4ad4bf112503428b2e2829395233884d248b6dfaf96b1c8247a7a9a6a187681d56bd76a9d422e5fa8854109e9809700f0d85c8bf2ab114f84eb6c8e06fb28309
- SSDEEP
  
  12288:Wytm2WSk/SSs/O0OOlkmJ5pIJYgEl2yjreZiOt+nW2wk/D3W:9tmdiEOlk26aVeZiOmW2pW
Score

10^/10

renamer discovery worm
- Detects Renamer worm.
  Renamer aka Grename is worm written in Delphi.
- Renamer family
  renamer
- Renamer, Grenam
  Renamer aka Grenam is a worm written in Delphi.
  worm renamer
- Drops startup file
- Loads dropped DLL
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Replication Through Removable Media

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

renamerdiscoveryworm

behavioral2

renamerdiscoveryworm

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.