Grandoreiro Banking Trojan & BTMOB RAT: Detection and Incident Response Guide

---
title: Potential Grandoreiro Banking Trojan Execution via MSI
id: 8a4b2c91-2d3e-4f5a-9b1c-3d6e7f8a9b0c
status: experimental
description: Detects potential execution of Grandoreiro banking trojan via MSI installers spawned from user directories, a common delivery vector.
references:
  - https://www.watchguard.com/wgrd-resource-center/security-center/threat-views/grandoreiro
author: Security Arsenal
date: 2026/05/06
tags:
  - attack.execution
  - attack.t1204
  - attack.initial_access
  - attack.t1566
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\\msiexec.exe'
    CommandLine|contains:
      - '/i'
      - '/package'
  filter_generic:
    ParentImage|contains:
      - '\\System32\'
      - '\\SysWOW64\'
  selection_suspicious_path:
    CommandLine|contains:
      - '\\AppData\\Local\\Temp'
      - '\\AppData\\Roaming'
      - '\\Downloads'
  condition: selection and not filter_generic and selection_suspicious_path
falsepositives:
  - Legitimate software installations by users (rare in enterprise environments without approval)
level: high
---
title: Suspicious PowerShell Web Request (Grandoreiro Downloader)
id: 9b5c3d02-3e4f-5a6b-0c2d-4e7f8a9b1c2d
status: experimental
description: Detects PowerShell commands used to download payloads, a technique frequently used in the initial stages of banking trojan infections like Grandoreiro.
references:
  - https://attack.mitre.org/techniques/T1059/001/
author: Security Arsenal
date: 2026/05/06
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\\powershell.exe'
      - '\\pwsh.exe'
    CommandLine|contains:
      - 'Invoke-WebRequest'
      - 'IEX'
      - 'DownloadString'
  condition: selection
falsepositives:
  - System administration scripts
  - Legitimate software update mechanisms
level: medium

// Hunt for Grandoreiro MSI execution patterns
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ \"msiexec.exe\"
| where ProcessCommandLine has_any (\"/i\", \"/package\")
| where ProcessCommandLine has_any (\"AppData\\\Local\\\Temp\", \"AppData\\\Roaming\", \"Downloads\")
| extend InitiatedBy = AccountName, DeviceName = DeviceName
| project Timestamp, DeviceName, InitiatedBy, FolderPath, ProcessCommandLine, InitiatingProcessFileName
| join kind=leftanti (
    DeviceProcessEvents
    | where FileName =~ \"msiexec.exe\"
    | where InitiatingProcessFileName in~ (\"services.exe\", \"svchost.exe\", \"explorer.exe\") 
    // Note: explorer.exe is a common parent for user-initiated msiexec, but we filter for system paths in the main query logic conceptually
) on DeviceName, Timestamp
// Correlate with network connections to potential C2
| join kind=inner (DeviceNetworkEvents | where Timestamp > ago(7d) | where RemotePort in (443, 80) | project DeviceName, RemoteUrl, RemoteIP, RemotePort) on DeviceName
| summarize Count=count() by DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName
| where Count > 0

-- Hunt for Grandoreiro persistence mechanisms and suspicious MSI files
SELECT 
  OSPath,
  Mtime,
  Atime,
  Size,
  Mode
FROM glob(globs=\"\\\Users\\\*\\\AppData\\\Roaming\\\*.msi\", root=\"/\")
WHERE Mtime > now() - 7d

UNION ALL

-- Hunt for suspicious Run Key persistence
SELECT 
  key.FullPath as RegistryPath,
  key.Data.mtime as ModifiedTime,
  value.name as ValueName,
  value.data as ValueData
FROM read_reg_key(globs=\"HKEY_USERS\\\*\\\Software\\\Microsoft\\\Windows\\\CurrentVersion\\\Run\\\*\")
WHERE ValueData =~ \".exe\" AND NOT ValueData =~ \"Program Files\" AND NOT ValueData =~ \"ProgramData\"
  AND ModifiedTime > now() - 30d

# Security Arsenal - Grandoreiro Incident Response Script
# Run as Administrator

function Invoke-GrandoreiroRemediation {
    Write-Host \"[+] Starting Grandoreiro Artifact Scan and Remediation...\" -ForegroundColor Cyan
    
    # 1. Check for suspicious MSI files in User Profiles (Common Dropper)
    Write-Host \"[*] Scanning for suspicious MSI files in user profiles...\" -ForegroundColor Yellow
    $msiPaths = @(\"C:\\Users\\*\\AppData\\Local\\Temp\\*.msi\", \"C:\\Users\\*\\Downloads\\*.msi\")
    $suspiciousMSI = Get-ChildItem -Path $msiPaths -Force -ErrorAction SilentlyContinue | 
                    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) }
    
    if ($suspiciousMSI) {
        foreach ($file in $suspiciousMSI) {
            Write-Host \"[!] Suspicious MSI found: $($file.FullName)\" -ForegroundColor Red
            # Quarantine logic placeholder or removal
            # Remove-Item -Path $file.FullName -Force -WhatIf
        }
    } else {
        Write-Host \"[-] No recent suspicious MSI files found.\" -ForegroundColor Green
    }

    # 2. Check Registry Run Keys for Suspicious Persistence
    Write-Host \"[*] Auditing Registry Run Keys for suspicious persistence...\" -ForegroundColor Yellow
    $runKeys = @(
        \"HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\",
        \"HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\",
        \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\"
    )
    
    foreach ($key in $runKeys) {
        if (Test-Path $key) {
            Get-Item -Path $key | ForEach-Object {
                $_.Property | ForEach-Object {
                    $propValue = (Get-ItemProperty -Path $key -Name $_).$_
                    # Flag binaries not in Program Files or Windows
                    if ($propValue -match \"^.*\.exe$\" -and $propValue -notmatch \"Program Files\" -and $propValue -notmatch \"Windows\") {
                        Write-Host \"[!] Suspicious Run Key Entry: $key\\$_ = $propValue\" -ForegroundColor Red
                    }
                }
            }
        }
    }

    # 3. Network Hardening (Block known C2 ranges - Placeholder for Intel)
    # Note: Add specific Grandoreiro IPs/URLs here based on current intel feeds
    Write-Host \"[*] Ensure firewall blocks outbound connections to non-corporate IPs on non-standard ports.\" -ForegroundColor Yellow
    Write-Host \"[+] Remediation scan complete. Manual review required for flagged artifacts.\" -ForegroundColor Green
}

Invoke-GrandoreiroRemediation