Analysis
-
max time kernel
146s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
14/10/2023, 04:25
General
-
Target
grand.exe
-
Size
5.5MB
-
MD5
47f7101191190d132a438444ee64a798
-
SHA1
1b17f49c98c7a0dcf7d40752dacf6b9e99ebe2d3
-
SHA256
c5195273e6bed87762880598a2a08bdeadab8d84fab3e78b6726c7eadd08ed54
-
SHA512
6fdd4755a6c6fa157fef65e88dd5d702df7a053fa36f5646a258edb9900c2f34fd4af440ff6d06d8a8ac11fd55273244f346b064a120d172846f09ac3dbd77c3
-
SSDEEP
98304:vyghDiIufzZIKj5Ahc3x8x/3a1UVG+5T8wNyxZnkkYOW:vJhZuf+W1xGSUVG+x8wQZXY
Malware Config
Signatures
-
Detects Grandoreiro payload 7 IoCs
-
Grandoreiro
Part of a group of banking trojans, targeting Spanish and Portuguese speaking countries.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\grand.exe"C:\Users\Admin\AppData\Local\Temp\grand.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\randpp.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\randpp.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105.1MB
MD53da7b7b421a3ac2a187e3166e3b2dffa
SHA1e464f887c13c5191eca101d9cc54daa095f1c643
SHA2561f75a713d0aadd785f1a10ab91e008fd8283b624dd28b4e01781f95cdb560893
SHA5124609c66158f6b920f1dc167a4d3d18fbd3d83924a181038ce7806dcc62249e4bb4f3022385b6e7bea59fd97844029fc14bd561d55272a40717831187f6a71225
-
Filesize
692KB
MD56cd81e6343ab21a1d118243af54833a8
SHA1bbe1a06bd85af7099fb111ac13d19df5f7f22cc0
SHA256306970a9d265a45abbd2efaf61002980695b2de7961504cf71e2833f415e82a9
SHA512295446e3732281b3afb6b06684e2642a79e6b284608305291cc01967c45d2ba5892ef687de084dbc9a22180233f1602a8c2236ec969ddda34c25d4f4e6691328
-
Filesize
1.4MB
MD5b16ad0dd6c69c0c117c9d3647517786c
SHA1825a54040c8e8dfe9ffb243796df806ee5b05708
SHA256e8eace4e643ba86e5c4d1b966037a47e53836b5d328f2295713184613a72020f
SHA51223512007a593d62c446923c446b07d64476cecf9f7ea22dbdbe48965daa482517c7f3f50a55b7b6ed3989be3df2f96004cafe3bb2204bcde401aae00ffd44632
-
Filesize
2.0MB
MD5db67e9196605d61d8278e5278777c71f
SHA16fe39b3ace96505269745ed2b81975abb5aea647
SHA2569b5f85fb164d177a24a521df6a9515f1dfb502d1b83581d37dae8ac3f1ad9010
SHA512d2a77d6c1c7771e714f5a19db82823a8a4dd0f0402aca0751d17e7b4d66219049aa33eab3f3841de251f7393f0d01e3c7664ef0aa17f5593ba0f569d2bfe7022
-
Filesize
2.0MB
MD5db67e9196605d61d8278e5278777c71f
SHA16fe39b3ace96505269745ed2b81975abb5aea647
SHA2569b5f85fb164d177a24a521df6a9515f1dfb502d1b83581d37dae8ac3f1ad9010
SHA512d2a77d6c1c7771e714f5a19db82823a8a4dd0f0402aca0751d17e7b4d66219049aa33eab3f3841de251f7393f0d01e3c7664ef0aa17f5593ba0f569d2bfe7022
-
Filesize
4KB
MD53e7d1bf85c27b185a920dc26b776758e
SHA13623ff4e4d244d951426647b5f765dec5bbdd99a
SHA256d5be03e38f60722dca24be527e5e97b60e383dbb6c88452964c9ce4683dcd6f5
SHA512e744594e22afbdc8482cdcad8540ebfe8444e9e4fc093fbfe785421cb77d8543f7525327e3b5ba299194944bf45afb896f7d5688ea44f840c57e2c2460b77869
-
Filesize
104.2MB
MD5a37b0d363553efaa95d1f57c3af1e3c9
SHA1f7e33f927518b74b61c175b109b1f27372ad171a
SHA256ae901bdd10650339e79b91611857b53f1807b09307b7dd4414f2db1c427c3ba0
SHA5122eae9289df07fde155998f6f67caec2b2baf7b690c889c7e727e06698e0d5345adfc78eb1a4539602c7c8a2aa53cc5f95b7f579db7c47a05a06387d31ceaadbc
-
Filesize
692KB
MD56cd81e6343ab21a1d118243af54833a8
SHA1bbe1a06bd85af7099fb111ac13d19df5f7f22cc0
SHA256306970a9d265a45abbd2efaf61002980695b2de7961504cf71e2833f415e82a9
SHA512295446e3732281b3afb6b06684e2642a79e6b284608305291cc01967c45d2ba5892ef687de084dbc9a22180233f1602a8c2236ec969ddda34c25d4f4e6691328
-
Filesize
1.4MB
MD5b16ad0dd6c69c0c117c9d3647517786c
SHA1825a54040c8e8dfe9ffb243796df806ee5b05708
SHA256e8eace4e643ba86e5c4d1b966037a47e53836b5d328f2295713184613a72020f
SHA51223512007a593d62c446923c446b07d64476cecf9f7ea22dbdbe48965daa482517c7f3f50a55b7b6ed3989be3df2f96004cafe3bb2204bcde401aae00ffd44632
-
Filesize
2.1MB
-
Filesize
16.0MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
736KB
-
Filesize
16.0MB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
736KB
-
Filesize
16.0MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
2.1MB