home

renault.exe

This is a setup program which is used to install the application. It runs as a scheduled task under the Windows Task Scheduler. The file has been seen being downloaded from s10003.chomikuj.pl and multiple other hosts.
MD5:
3c86bd115ef8a895e2588585eb0e0fd3

SHA-1:
73bea29e8b37fff46b84edbc0ad68c28a46accfe

SHA-256:
f787e3658cd8fba2b89b8df12d49ae9e739290c8552422ef089703a1cfc28541

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/14/2024 2:50:10 PM UTC  (today)

File size:
29.6 KB (30,352 bytes)

File type:
Executable application (Win64 EXE)

Common path:
C:\users\{user}\downloads\renault immo test kit\renault.exe

File PE Metadata
OS version:
6702.0

OS bitness:
Win64

.NET CLR dependent:
Yes

CTPH (ssdeep):
768:3ycomGpDDtHk+Nz5js5xvY6/ZBFi2M+uvY6/r/YsdiqOpcC:9ItHk+OY6/4xY6/7fOpcC

Entry address:
0x19EC

Entry point:
4D, 5A, 90, 00, 3C, 00, E1, 02, BA, 00, 32, 04, 32, A4, E1, 06, 00, 40, 00, 00, C5, 27, 00, 00, 1C, 00, 00, 00, 09, 00, 00, 00, 34, 00, 00, 00, 42, 00, 00, 00, 50, 00, 00, 00, 84, 00, 00, 00, 92, 00, 00, 00, BF, 00, 00, 00, E6, 00, 00, 00, F4, 00, 00, 00, 0B, 01, 00, 00, 19, 01, 00, 00, 30, 01, 00, 00, 3E, 01, 00, 00, 55, 01, 00, 00, 63, 01, 00, 00, 73, 01, 00, 00, 7D, 01, 00, 00, 87, 01, 00, 00, 91, 01, 00, 00, 9F, 01, 00, 00, B3, 01, 00, 00, 92, 03, 00, 00, A3, 03, 00, 00, AE, 03, 00, 00, BF, 03, 00, 00...
 
[+]

Code size:
6.3 KB (6,497 bytes)

Scheduled Task
Task name:
{BA128ECB-860D-4D53-9595-75BBEAE434A8}

Trigger:
Registration (Runs on registration)


The file renault.exe has been seen being distributed by the following 12 URLs.

http://s10003.chomikuj.pl/File.aspx?e=9dGYh9OUKMxZ3ypC5zgx-tpvhtxutdq3v9G3ZOXKSnEdd8LM8rR5705yYolAFo9kL-m3v92OJFYhSZy4VO5mxqj6pVo8nke3B9s-hilw2JpFxiyLZEnqvSNIIRwffkyxl9NG-fFdMcC5PtH1YHOMeQ&pv=2

http://s5960.chomikuj.pl/File.aspx?e=9dGYh9OUKMxZ3ypC5zgx-tpvhtxutdq3v9G3ZOXKSnGYMFfbje2PgdsVDHDyZfvE4Vl9Vlj2hTHJF-Z6B_PKD53Bdh6fuowYzkWpMKHoLEpB1h-Gveu-Qg2uLMo5Ud-TPoZ1txd1a0HwEpkY8r_wcg&pv=2

http://westwind.6f.sk/.../megane_IMO_kod_generator.exe

http://s10003.chomikuj.pl/File.aspx?e=9dGYh9OUKMxZ3ypC5zgx-oRTlddw0mSamdX_By9z9nrUG8is3TgIOQ9m0Cjgx-q135DCu5Qw5Az2u16Ozp3QVWKaaD5ZVIRKdQsjLSFbrJimPv682FS3t0yQdXBEFXhNC6NbOaroSAgD5AA7tw5DcQ&pv=2

http://coach.free.bg/trantir.exe

http://s5960.chomikuj.pl/File.aspx?e=9dGYh9OUKMxZ3ypC5zgx-tpvhtxutdq3v9G3ZOXKSnEhBnqe3SSvw9sFoyenRSZQ1XWpJmjDHvfGHoNamHKCKURNPDvQtK9GRg-TH0242WiE7Yx7ifLkU0GOWqyZnpC-i3sE1K31C9oSS9T2mXuhWg&pv=2

http://s5960.chomikuj.pl/File.aspx?e=9dGYh9OUKMxZ3ypC5zgx-tpvhtxutdq3v9G3ZOXKSnEO2l82MJExylpYq2iDVmBtHrjF_bJnsSQeWltC1oJSa9T8Ns2dp8_zwy2xvtR_t9_UBl7dB3F4FjCWg1Jpp1ZOFKbr2GXwV4XLwGdRnKFgDw&pv=2

http://s10003.chomikuj.pl/File.aspx?e=9dGYh9OUKMxZ3ypC5zgx-tpvhtxutdq3v9G3ZOXKSnGgjcwDXKFPiWpi4B-mTupncbxtz0mSpi6nvrupTYrQOOJLXAlTydeozwbU8EWiY8LpN4roneZ_t8W1jufGBz5fbIlSPMFpd7E4AOYOpgyX_A&pv=2

http://s10003.chomikuj.pl/File.aspx?e=9dGYh9OUKMxZ3ypC5zgx-tpvhtxutdq3v9G3ZOXKSnHrRfnHW6-D4qYXfLHtJzyeCP5wYdBDvQV5Q4R8oatfDd4nuFiOKpFj2nKNSvSs9I-K-o_SWLaOGDhXwDH-KQD8sMYFvkFhEiOGlFSPaD0BAA&pv=2

http://s10003.chomikuj.pl/File.aspx?e=9dGYh9OUKMxZ3ypC5zgx-tpvhtxutdq3v9G3ZOXKSnF1BIWJLxlV5HdGptYv8EOGXP1_ASMU65GQePPMLt9KgaGsH2M7YyOYt0mYGOXrYzAnu_SYNwtjxWiQLE16nPx1bKhR_H8_jUshCCBhWDeGUQ&pv=2

http://s10003.chomikuj.pl/File.aspx?e=9dGYh9OUKMxZ3ypC5zgx-tpvhtxutdq3v9G3ZOXKSnFr1hejtCy7aCcT_MEKj4QwmHzk_iRhi3nPZ_AyJOK2cEjrNimfQQy4t6xpS7FCU60b6_UO8ZG5islbFVP_w_C0dA6Jl81hexWkn4j3POfopg&pv=2

http://bargainspares.com/wp-content/uploads/2011/.../RenaultImmCode.exe

Scan renault.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.