Analysis
-
max time kernel
170s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
-
submitted
30/11/2023, 17:31
General
-
Target
grand.exe
-
Size
5.5MB
-
MD5
47f7101191190d132a438444ee64a798
-
SHA1
1b17f49c98c7a0dcf7d40752dacf6b9e99ebe2d3
-
SHA256
c5195273e6bed87762880598a2a08bdeadab8d84fab3e78b6726c7eadd08ed54
-
SHA512
6fdd4755a6c6fa157fef65e88dd5d702df7a053fa36f5646a258edb9900c2f34fd4af440ff6d06d8a8ac11fd55273244f346b064a120d172846f09ac3dbd77c3
-
SSDEEP
98304:vyghDiIufzZIKj5Ahc3x8x/3a1UVG+5T8wNyxZnkkYOW:vJhZuf+W1xGSUVG+x8wQZXY
Malware Config
Signatures
-
Detects Grandoreiro payload 10 IoCs
-
Grandoreiro
Part of a group of banking trojans, targeting Spanish and Portuguese speaking countries.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\grand.exe"C:\Users\Admin\AppData\Local\Temp\grand.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\randpp.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\randpp.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
266.0MB
MD50459857c70102a31285f822f4d5da1d6
SHA1a906ecdb8fbd4770ca765da1fcf2fccbb1cd3291
SHA256a67775bf2e0a0f0816a2157760991f581c5fddcdeb8893b25febe5703ff03e9a
SHA51253e34d5919f4609c6e124aa443649c916574a6bc11899803e28128de910c7b38ec7ca3bbe9722767968106218293f4fec73a4e9e360cdba14a93489d1156cce7
-
Filesize
266.0MB
MD50459857c70102a31285f822f4d5da1d6
SHA1a906ecdb8fbd4770ca765da1fcf2fccbb1cd3291
SHA256a67775bf2e0a0f0816a2157760991f581c5fddcdeb8893b25febe5703ff03e9a
SHA51253e34d5919f4609c6e124aa443649c916574a6bc11899803e28128de910c7b38ec7ca3bbe9722767968106218293f4fec73a4e9e360cdba14a93489d1156cce7
-
Filesize
266.0MB
MD50459857c70102a31285f822f4d5da1d6
SHA1a906ecdb8fbd4770ca765da1fcf2fccbb1cd3291
SHA256a67775bf2e0a0f0816a2157760991f581c5fddcdeb8893b25febe5703ff03e9a
SHA51253e34d5919f4609c6e124aa443649c916574a6bc11899803e28128de910c7b38ec7ca3bbe9722767968106218293f4fec73a4e9e360cdba14a93489d1156cce7
-
Filesize
266.0MB
MD50459857c70102a31285f822f4d5da1d6
SHA1a906ecdb8fbd4770ca765da1fcf2fccbb1cd3291
SHA256a67775bf2e0a0f0816a2157760991f581c5fddcdeb8893b25febe5703ff03e9a
SHA51253e34d5919f4609c6e124aa443649c916574a6bc11899803e28128de910c7b38ec7ca3bbe9722767968106218293f4fec73a4e9e360cdba14a93489d1156cce7
-
Filesize
266.0MB
MD50459857c70102a31285f822f4d5da1d6
SHA1a906ecdb8fbd4770ca765da1fcf2fccbb1cd3291
SHA256a67775bf2e0a0f0816a2157760991f581c5fddcdeb8893b25febe5703ff03e9a
SHA51253e34d5919f4609c6e124aa443649c916574a6bc11899803e28128de910c7b38ec7ca3bbe9722767968106218293f4fec73a4e9e360cdba14a93489d1156cce7
-
Filesize
692KB
MD56cd81e6343ab21a1d118243af54833a8
SHA1bbe1a06bd85af7099fb111ac13d19df5f7f22cc0
SHA256306970a9d265a45abbd2efaf61002980695b2de7961504cf71e2833f415e82a9
SHA512295446e3732281b3afb6b06684e2642a79e6b284608305291cc01967c45d2ba5892ef687de084dbc9a22180233f1602a8c2236ec969ddda34c25d4f4e6691328
-
Filesize
692KB
MD56cd81e6343ab21a1d118243af54833a8
SHA1bbe1a06bd85af7099fb111ac13d19df5f7f22cc0
SHA256306970a9d265a45abbd2efaf61002980695b2de7961504cf71e2833f415e82a9
SHA512295446e3732281b3afb6b06684e2642a79e6b284608305291cc01967c45d2ba5892ef687de084dbc9a22180233f1602a8c2236ec969ddda34c25d4f4e6691328
-
Filesize
692KB
MD56cd81e6343ab21a1d118243af54833a8
SHA1bbe1a06bd85af7099fb111ac13d19df5f7f22cc0
SHA256306970a9d265a45abbd2efaf61002980695b2de7961504cf71e2833f415e82a9
SHA512295446e3732281b3afb6b06684e2642a79e6b284608305291cc01967c45d2ba5892ef687de084dbc9a22180233f1602a8c2236ec969ddda34c25d4f4e6691328
-
Filesize
1.4MB
MD5b16ad0dd6c69c0c117c9d3647517786c
SHA1825a54040c8e8dfe9ffb243796df806ee5b05708
SHA256e8eace4e643ba86e5c4d1b966037a47e53836b5d328f2295713184613a72020f
SHA51223512007a593d62c446923c446b07d64476cecf9f7ea22dbdbe48965daa482517c7f3f50a55b7b6ed3989be3df2f96004cafe3bb2204bcde401aae00ffd44632
-
Filesize
1.4MB
MD5b16ad0dd6c69c0c117c9d3647517786c
SHA1825a54040c8e8dfe9ffb243796df806ee5b05708
SHA256e8eace4e643ba86e5c4d1b966037a47e53836b5d328f2295713184613a72020f
SHA51223512007a593d62c446923c446b07d64476cecf9f7ea22dbdbe48965daa482517c7f3f50a55b7b6ed3989be3df2f96004cafe3bb2204bcde401aae00ffd44632
-
Filesize
2.0MB
MD5db67e9196605d61d8278e5278777c71f
SHA16fe39b3ace96505269745ed2b81975abb5aea647
SHA2569b5f85fb164d177a24a521df6a9515f1dfb502d1b83581d37dae8ac3f1ad9010
SHA512d2a77d6c1c7771e714f5a19db82823a8a4dd0f0402aca0751d17e7b4d66219049aa33eab3f3841de251f7393f0d01e3c7664ef0aa17f5593ba0f569d2bfe7022
-
Filesize
2.0MB
MD5db67e9196605d61d8278e5278777c71f
SHA16fe39b3ace96505269745ed2b81975abb5aea647
SHA2569b5f85fb164d177a24a521df6a9515f1dfb502d1b83581d37dae8ac3f1ad9010
SHA512d2a77d6c1c7771e714f5a19db82823a8a4dd0f0402aca0751d17e7b4d66219049aa33eab3f3841de251f7393f0d01e3c7664ef0aa17f5593ba0f569d2bfe7022
-
Filesize
4KB
MD53e7d1bf85c27b185a920dc26b776758e
SHA13623ff4e4d244d951426647b5f765dec5bbdd99a
SHA256d5be03e38f60722dca24be527e5e97b60e383dbb6c88452964c9ce4683dcd6f5
SHA512e744594e22afbdc8482cdcad8540ebfe8444e9e4fc093fbfe785421cb77d8543f7525327e3b5ba299194944bf45afb896f7d5688ea44f840c57e2c2460b77869
-
Filesize
4KB
-
Filesize
16.0MB
-
Filesize
4KB
-
Filesize
736KB
-
Filesize
2.1MB
-
Filesize
736KB
-
Filesize
16.0MB
-
Filesize
2.1MB
-
Filesize
736KB
-
Filesize
16.0MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
2.1MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
2.1MB