Grandoreiro DLL Sideloading Campaign + PRIVATELOADER Residential Proxy SDK: OTX Pulse Analysis — Enterprise Detection Pack

---
title: Grandoreiro DLL Sideloading via Duplicate Files Finder
id: 7f3a1c2e-9b4d-4e8a-a1f5-3c6d9e2b8a01
status: experimental
description: Detects DLL sideloading execution of the legitimate Duplicate Files Finder binary loading an unsigned or non-standard DLL, consistent with the Grandoreiro Mexico/Spain campaign.
author: Security Arsenal Threat Intelligence
references:
    - https://www.acronis.com/en/tru/posts/grandoreiro-goes-north-from-brazil-to-mexico-with-a-new-dll-sideloading-campaign/
date: 2026/08/22
tags:
    - attack.defense_evasion
    - attack.t1574.002
logsource:
    category: image_load
    product: windows
detection:
    selection_process:
        Image|endswith:
            - '\duplicatefilesfinder.exe'
            - '\dff.exe'
    selection_dll:
        ImageLoaded|contains:
            - '\AppData\'
            - '\Temp\'
            - '\Downloads\'
            - '\Users\Public\'
    filter_signed:
        Signed: 'true'
    condition: selection_process and selection_dll and not filter_signed
falsepositives:
    - Legitimate portable application usage (rare in enterprise)
level: high
---
title: Grandoreiro C2 Dynamic DNS Communication
id: 2b8d4f1a-6c3e-4a9b-b7d2-5e1f8c3a9d02
status: experimental
description: Detects DNS resolution of known Grandoreiro C2 and staging hostnames identified in OTX pulse data.
author: Security Arsenal Threat Intelligence
references:
    - https://otx.alienvault.com/
date: 2026/08/22
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1568.002
logsource:
    category: dns
    product: windows
detection:
    selection:
        query|contains:
            - 'voyage.mydissent.net'
            - 'beeges.health-carereform.com'
            - 'nhlfan.net'
            - 'workisboring.com'
    condition: selection
falsepositives:
    - None expected for full hostname matches
level: critical
---
title: PRIVATELOADER Peer2Profit Bandwidth Sharing Agent Installation
id: 9e5c2a7d-1f8b-4d6c-c3a9-7b2e4d1f6a03
status: experimental
description: Detects installation or execution of Peer2Profit bandwidth-sharing SDK components delivered via PRIVATELOADER, which enroll endpoints into residential proxy networks.
author: Security Arsenal Threat Intelligence
references:
    - https://www.silentpush.com/blog/peer2profit-astroproxy/
date: 2026/08/22
tags:
    - attack.command_and_control
    - attack.t1102
    - attack.t1543.003
logsource:
    category: process_creation
    product: windows
detection:
    selection_image:
        Image|contains:
            - '\peer2profit'
            - '\p2papp'
            - '\traffmonetizer'
    selection_cli:
        CommandLine|contains:
            - 'peer2profit'
            - 'astroproxy'
    condition: selection_image or selection_cli
falsepositives:
    - User intentionally installed bandwidth-sharing software (still a policy violation in enterprise)
level: high

// Hunt: Grandoreiro C2 DNS + PRIVATELOADER proxy agent network beacons
// Microsoft Sentinel / Defender XDR — 30-day retro-hunt
let GrandoreiroC2 = dynamic([
    "voyage.mydissent.net",
    "beeges.health-carereform.com",
    "b744156103040828396040.nhlfan.net",
    "streamlinepdf-8m2x.workisboring.com"
]);
let ProxyHashes = dynamic([
    "eb8826bac873442045a6a05f1fa25b410ca18db6942053f6d146467c00d5338d",
    "0b10a1e48df2884a7a8a1ebf5aa903207955433c8ea00d7602c78be6e6c177cc",
    "8871d12a7bb7529ff6e90ad5a18c86e92a402a2d02d3283d1385bdb52ba2b0f2",
    "c85c7436fdb71cf52db6ef134b336d66c7dbd3738a7866f8b9992434d1208a4b"
]);
let DnsHits = DeviceNetworkEvents
    | where Timestamp > ago(30d)
    | where RemoteUrl has_any (GrandoreiroC2)
    | summarize ConnectionCount = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp)
        by DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP;
let HashHits = DeviceProcessEvents
    | where Timestamp > ago(30d)
    | where SHA256 has_any (ProxyHashes) or MD5 in (
        "0fac99f58640171164d979d5529b00f8",
        "320633a89e2f8b55cf45e4377bb8d041",
        "48bf5850f83ac9bf7289b4473e0317b0",
        "5d6cb9b58fcd2eb04da562d8249fc59f")
    | summarize by DeviceName, FileName, FolderPath, SHA256, ProcessCommandLine;
// Bandwidth-sharing behavior: long-lived high-volume outbound TLS from workstations
let BeaconBehavior = DeviceNetworkEvents
    | where Timestamp > ago(7d)
    | where RemotePort in (443, 8443)
    | where InitiatingProcessFileName has_any ("peer2profit", "p2p", "traff", "proxy")
    | summarize TotalConnections = count(), DistinctRemotes = dcount(RemoteIP)
        by DeviceName, InitiatingProcessFileName
    | where TotalConnections > 100;
union DnsHits, HashHits, BeaconBehavior
| sort by LastSeen desc

# Security Arsenal - Grandoreiro + Peer2Profit IOC Hunt Script
# Run elevated on suspect endpoints or via remote PS session / EDR live response

$Report = @()

# 1. Registry Run key persistence check (Grandoreiro T1547.001)
$RunKeys = @(
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run"
)
foreach ($key in $RunKeys) {
    if (Test-Path $key) {
        Get-ItemProperty $key | ForEach-Object {
            $_.PSObject.Properties | Where-Object {
                $_.Value -match "AppData|Temp|Public" -and
                $_.Value -notmatch "Microsoft|OneDrive|Teams"
            } | ForEach-Object {
                $Report += [PSCustomObject]@{
                    Type = "SuspiciousRunKey"; Path = $key
                    Name = $_.Name; Value = $_.Value
                }
            }
        }
    }
}

# 2. Grandoreiro payload hash check in common staging paths
$MD5s = @("0fac99f58640171164d979d5529b00f8","320633a89e2f8b55cf45e4377bb8d041",
          "48bf5850f83ac9bf7289b4473e0317b0","5d6cb9b58fcd2eb04da562d8249fc59f")
$SHA256s = @("eb8826bac873442045a6a05f1fa25b410ca18db6942053f6d146467c00d5338d",
             "0b10a1e48df2884a7a8a1ebf5aa903207955433c8ea00d7602c78be6e6c177cc",
             "8871d12a7bb7529ff6e90ad5a18c86e92a402a2d02d3283d1385bdb52ba2b0f2",
             "c85c7436fdb71cf52db6ef134b336d66c7dbd3738a7866f8b9992434d1208a4b")
$SearchPaths = @("$env:APPDATA","$env:LOCALAPPDATA","$env:TEMP","C:\Users\Public")
foreach ($path in $SearchPaths) {
    Get-ChildItem -Path $path -Recurse -File -ErrorAction SilentlyContinue |
        Where-Object { $_.Extension -in ".exe",".dll",".msi" } | ForEach-Object {
        $m = (Get-FileHash $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
        $s = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($MD5s -contains $m.ToLower() -or $SHA256s -contains $s.ToLower()) {
            $Report += [PSCustomObject]@{Type="IOC_HASH_MATCH"; Path=$_.FullName; Name=$_.Name; Value=$s}
        }
    }
}

# 3. Peer2Profit / bandwidth-sharing service and scheduled task check
Get-Service | Where-Object { $_.Name -match "peer2profit|p2papp|traffmonetizer|astroproxy" } |
    ForEach-Object { $Report += [PSCustomObject]@{Type="ProxyService"; Path=$_.Name; Name=$_.DisplayName; Value=$_.Status} }
Get-ScheduledTask | Where-Object { $_.TaskName -match "peer2profit|proxy|p2p" } |
    ForEach-Object { $Report += [PSCustomObject]@{Type="ProxyScheduledTask"; Path=$_.TaskPath; Name=$_.TaskName; Value=$_.State} }

# 4. Active connections to Grandoreiro C2 dynamic-DNS domains
$C2Patterns = "mydissent.net|health-carereform.com|nhlfan.net|workisboring.com"
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | ForEach-Object {
    $dns = (Resolve-DnsName $_.RemoteAddress -ErrorAction SilentlyContinue).NameHost
    if ($dns -match $C2Patterns) {
        $Report += [PSCustomObject]@{Type="C2_Connection"; Path=$dns; Name=$_.OwningProcess; Value="$($_.RemoteAddress):$($_.RemotePort)"}
    }
}

# 5. Duplicate Files Finder sideload artifact check
Get-ChildItem -Path "C:\Program Files","C:\Program Files (x86)","$env:LOCALAPPDATA" -Recurse -ErrorAction SilentlyContinue -Include "duplicatefilesfinder.exe" |
    ForEach-Object {
        $dir = $_.DirectoryName
        Get-ChildItem $dir -Filter *.dll | Where-Object { -not ($_.VersionInfo.CompanyName) } |
            ForEach-Object { $Report += [PSCustomObject]@{Type="SideloadCandidate"; Path=$dir; Name=$_.Name; Value="Unsigned DLL beside DFF binary"} }
    }

if ($Report.Count -gt 0) {
    Write-Host "[!] $($Report.Count) suspicious artifacts found:" -ForegroundColor Red
    $Report | Format-Table -AutoSize
    $Report | Export-Csv "Grandoreiro_P2P_Hunt_$(Get-Date -Format 'yyyyMMdd_HHmm').csv" -NoTypeInformation
} else {
    Write-Host "[+] No IOC artifacts detected on this host." -ForegroundColor Green
}