grandoreiro | f49b8db373001f075aacdf6d24aa2391a30f9c35cc0ec1223d3d258a553b6e86

Resubmissions

06/04/2023, 22:58

13/03/2023, 10:21

max time kernel
85s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2023, 22:58

Target
183db4e8ae1d5fdaf2190da7ea7ba6a4bc6a25fb5b67058fb347fd2032146836.dll
Size 302.6MB
Sample230406-2x9gfafe76
SHA256 183db4e8ae1d5fdaf2190da7ea7ba6a4bc6a25fb5b67058fb347fd2032146836
MD5 d331e921e6761597c9fe3778e9faa0fe
SHA1 ff908727cc1b5335e541fbcd80a327565f308bc7
SHA512 52e4fec1ea70c3c281f50ec3af891f73ded408b00506170b004b684c8f519e0e5b01ce18721489d2de61ca8e47584d1f2210211e2830a29c95499b6f43921797
SSDEEP 49152:taPimYY8DgSKR+wmB4b7y4clZ/STizh9UxKTdTn:taqTBESqkuy4CmiNEy
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Detects Grandoreiro payload 1 IoCs

resource	yara_rule
behavioral2/memory/1532-133-0x00000000022F0000-0x00000000032F0000-memory.dmp	family_grandoreiro_v1

Grandoreiro
Part of a group of banking trojans, targeting Spanish and Portuguese speaking countries.
trojan banker grandoreiro

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4596 wrote to memory of 1532	4596	regsvr32.exe	83
PID 4596 wrote to memory of 1532	4596	regsvr32.exe	83
PID 4596 wrote to memory of 1532	4596	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\183db4e8ae1d5fdaf2190da7ea7ba6a4bc6a25fb5b67058fb347fd2032146836.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\183db4e8ae1d5fdaf2190da7ea7ba6a4bc6a25fb5b67058fb347fd2032146836.dll
  2⤵
  PID:1532

memory/1532-133-0x00000000022F0000-0x00000000032F0000-memory.dmp

Download