grandoreiro | 97c00910940f43ed12c20466cac4541a2f874a42ae02dd7a4ff8b2c64499ffda

Resubmissions

06/04/2023, 23:01

13/03/2023, 09:58

max time kernel
27s
max time network
32s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
06/04/2023, 23:01

Target

35c0744bec0e123d24a9ffd3d7a9edeb07d9341ab45619b5fc881ce7dd81276a.dll
Size

254.5MB
MD5

98ef8e5ef3bef928537d4fd25c53380a
SHA1

7d3255275bff63faa31bca7d2ec87ec4408151a5
SHA256

35c0744bec0e123d24a9ffd3d7a9edeb07d9341ab45619b5fc881ce7dd81276a
SHA512

57fb7b746068f6a626f850d438acdeeeaf1e2f0c68e7ea0ed98082b3bcce914f5e050423ad0095e7d1268d6e9415ba12134a03b9a689b9533ccf13a9f940fd2c
SSDEEP

49152:0hha9qUyO2Dmpso/Xls3L1NRRuU0gjMAlwLhdBf7hd3RZHFTcTPfT56xnhY:0hw9qUy5G/VsbvREgKxVd3jglwhY

Score

10^/10

Detects Grandoreiro payload 1 IoCs

resource	yara_rule
behavioral1/memory/1232-54-0x0000000002060000-0x0000000003060000-memory.dmp	family_grandoreiro_v1

Grandoreiro
Part of a group of banking trojans, targeting Spanish and Portuguese speaking countries.
trojan banker grandoreiro

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 1232	1424	regsvr32.exe	27
PID 1424 wrote to memory of 1232	1424	regsvr32.exe	27
PID 1424 wrote to memory of 1232	1424	regsvr32.exe	27
PID 1424 wrote to memory of 1232	1424	regsvr32.exe	27
PID 1424 wrote to memory of 1232	1424	regsvr32.exe	27
PID 1424 wrote to memory of 1232	1424	regsvr32.exe	27
PID 1424 wrote to memory of 1232	1424	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\35c0744bec0e123d24a9ffd3d7a9edeb07d9341ab45619b5fc881ce7dd81276a.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\35c0744bec0e123d24a9ffd3d7a9edeb07d9341ab45619b5fc881ce7dd81276a.dll
  2⤵
  PID:1232

memory/1232-54-0x0000000002060000-0x0000000003060000-memory.dmp

Filesize
16.0MB

Download