grandoreiro | 1112505820b2ddfbc0c1306073bd504635895fe865e4b03ecf76b4ef30051e73

Resubmissions

06/04/2023, 23:00

13/03/2023, 10:25

max time kernel
146s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
06/04/2023, 23:00

Target

ec07e185f5df2d07b1c83f65e13e5cc9a77dd1c42aa311bac2eaf7cc921d8d4d.dll
Size

298.0MB
MD5

fefc02dd495ab8b6adf74b6f9d69e774
SHA1

699246876e6140a4dc3a7c44578565628f1accfa
SHA256

ec07e185f5df2d07b1c83f65e13e5cc9a77dd1c42aa311bac2eaf7cc921d8d4d
SHA512

ce579859d7d97952e444ee2ac5e1fa83f5957451045da1ad8dccf928d1c9e1e2abd18063f8c0deabf1a8d21322b6c44e10ecfde7cb58ec027f653cdb842fc32c
SSDEEP

196608:dywqPjZL2prjsEr5NUR4ureIXH5yJ7nxkYuQPP3r7DbGF/UALgV:dy8jsEr5NUR4ureIXYjTuQPPy/UQ

Score

10^/10

Detects Grandoreiro payload 2 IoCs

resource	yara_rule
behavioral1/memory/2032-54-0x00000000022D0000-0x00000000032D0000-memory.dmp	family_grandoreiro_v1
behavioral1/memory/2032-60-0x00000000022D0000-0x00000000032D0000-memory.dmp	family_grandoreiro_v1

Grandoreiro
Part of a group of banking trojans, targeting Spanish and Portuguese speaking countries.
trojan banker grandoreiro

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 2032	1216	regsvr32.exe	27
PID 1216 wrote to memory of 2032	1216	regsvr32.exe	27
PID 1216 wrote to memory of 2032	1216	regsvr32.exe	27
PID 1216 wrote to memory of 2032	1216	regsvr32.exe	27
PID 1216 wrote to memory of 2032	1216	regsvr32.exe	27
PID 1216 wrote to memory of 2032	1216	regsvr32.exe	27
PID 1216 wrote to memory of 2032	1216	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ec07e185f5df2d07b1c83f65e13e5cc9a77dd1c42aa311bac2eaf7cc921d8d4d.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ec07e185f5df2d07b1c83f65e13e5cc9a77dd1c42aa311bac2eaf7cc921d8d4d.dll
  2⤵
  PID:2032

memory/2032-54-0x00000000022D0000-0x00000000032D0000-memory.dmp

Filesize
16.0MB

Download
memory/2032-55-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/2032-58-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/2032-59-0x0000000000B70000-0x0000000000B71000-memory.dmp

Filesize
4KB

Download
memory/2032-60-0x00000000022D0000-0x00000000032D0000-memory.dmp

Filesize
16.0MB

Download