grandoreiro | 08da2414b97649f0b0ff698dc811828a467c14920dc23a26db95f668ccae7119

Resubmissions

06/04/2023, 23:02

13/03/2023, 10:24

max time kernel
29s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
06/04/2023, 23:02

Target

84c71f7d2147673b3298b5ab6f4dce8a6bb488f8d4235b580799872e4c00e862.dll
Size

336.9MB
MD5

245257717c97504cdd4dbe261a2c47d0
SHA1

eba71c5923560e405201f467bcefa41b47887298
SHA256

84c71f7d2147673b3298b5ab6f4dce8a6bb488f8d4235b580799872e4c00e862
SHA512

b6c1cfef353e0df9a8c37ce8532f84cdc35cd852f34554f2748cbd74dd259329a6c733af5f8515faa8605070660afbac08f88af86f4f85b6f71f5a8a938868da
SSDEEP

49152:snKYCefvv6dyezQTbcPCg8vZ37FSc4o6qyeQVTQTPvTd1c:sXCe3sEcPX86X5388

Score

10^/10

Detects Grandoreiro payload 1 IoCs

resource	yara_rule
behavioral1/memory/548-54-0x0000000001D30000-0x0000000002D30000-memory.dmp	family_grandoreiro_v1

Grandoreiro
Part of a group of banking trojans, targeting Spanish and Portuguese speaking countries.
trojan banker grandoreiro

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 548	1384	regsvr32.exe	28
PID 1384 wrote to memory of 548	1384	regsvr32.exe	28
PID 1384 wrote to memory of 548	1384	regsvr32.exe	28
PID 1384 wrote to memory of 548	1384	regsvr32.exe	28
PID 1384 wrote to memory of 548	1384	regsvr32.exe	28
PID 1384 wrote to memory of 548	1384	regsvr32.exe	28
PID 1384 wrote to memory of 548	1384	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\84c71f7d2147673b3298b5ab6f4dce8a6bb488f8d4235b580799872e4c00e862.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\84c71f7d2147673b3298b5ab6f4dce8a6bb488f8d4235b580799872e4c00e862.dll
  2⤵
  PID:548

memory/548-54-0x0000000001D30000-0x0000000002D30000-memory.dmp

Filesize
16.0MB

Download