Grandoreiro DLL Side-Loading via Legitimate Software in AppData (T1574.002)

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•2

Detects behavior patterns associated with the Grandoreiro banking trojan, specifically focusing on DLL side-loading from user-writable directories (AppData, Temp, Downloads) and the execution of randomized executables spawned by wscript.exe, which is characteristic of its VBS dropper mechanism.