Grandoreiro Targets Mexico with a New DLL Sideloading Technique

Summary

Grandoreiro, a long-running Brazilian banking trojan, has launched a new campaign primarily targeting users in Mexico. The attackers abuse the legitimate Duplicate Files Finder application for DLL sideloading to execute malicious code. The malware also includes extensive anti-analysis and sandbox evasion capabilities designed to bypass security environments.

Investigation

The investigation focused on a ZIP archive containing decoy files and a malicious DLL sideloading chain. Researchers identified a clear mismatch between the PE compilation timestamps of the legitimate parent application from 2008 and the malicious implant compiled in 2026. Analysts also decoded a custom Base64 and XOR-based string obfuscation routine used by the malware.

Mitigation

Defenders should monitor for legitimate binaries, including Duplicate Files Finder, loading unexpected DLLs from the same directory. EDR/XDR solutions capable of detecting process hollowing and suspicious GUI suppression are recommended. Organizations should also watch for unauthorized DNS-over-HTTPS requests to Google’s DoH service.

Response

If Grandoreiro activity is detected, the affected host should be isolated immediately to disrupt C2 communication over TCP port 6432. Responders should perform memory forensics to identify the decrypted second-stage payload. System uptime and installed software should also be reviewed for signs of sandbox evasion checks.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary is performing environmental keying to ensure they are not being analyzed in a sandbox. First, they attempt to check system uptime to detect freshly reverted VM snapshots. Second, they check for the presence of common user application shortcuts (e.g., chrome.lnk) to confirm a “real” user environment. Finally, they scan for the presence of debugging tools (e.g., procmon.exe) to ensure no active monitoring is occurring. To trigger the rule, we will execute commands that simulate these exact strings.

• Regression Test Script:

  # Simulation of Grandoreiro Anti-Analysis behaviors
  
  Write-Host "[+] Starting Anti-Analysis Simulation..." -ForegroundColor Cyan
  
  # 1. Simulate Uptime Check (Selection 1)
  Write-Host "[*] Simulating Uptime Check..."
  Start-Process cmd.exe -ArgumentList "/c echo Checking system uptime..." -WindowStyle Hidden
  
  # 2. Simulate Shortcut Presence Check (Selection 2 & 3)
  # To trigger the 'AND' condition: (selection2 AND selection3)
  # We need a command line containing a .lnk file AND a debugging tool name.
  Write-Host "[*] Simulating Shortcut and Debugger detection..."
  Start-Process cmd.exe -ArgumentList "/c echo Searching for chrome.lnk and procmon.exe" -WindowStyle Hidden
  
  # 3. Simulate Debugger Execution (Selection 3)
  Write-Host "[*] Simulating direct execution of a debugger..."
  # Note: We use 'calc.exe' but pass the string in the command line to simulate the detection trigger
  Start-Process cmd.exe -ArgumentList "/c echo Running Wireshark.exe simulation" -WindowStyle Hidden
  
  Write-Host "[+] Simulation Complete. Check SIEM for alerts." -ForegroundColor Green

• Cleanup Commands:

  # No persistent artifacts are created by this simulation, 
  # but we clear the command history for cleanliness.
  Clear-History
  Write-Host "[+] Cleanup complete." -ForegroundColor Cyan