Overview
overview
7Static
static
75c476b47ec...f9.exe
windows7-x64
75c476b47ec...f9.exe
windows10-2004-x64
7$TEMP/Team...r_.exe
windows7-x64
7$TEMP/Team...r_.exe
windows10-2004-x64
7$PLUGINSDI...ol.dll
windows7-x64
3$PLUGINSDI...ol.dll
windows10-2004-x64
3$PLUGINSDI...64.dll
windows7-x64
3$PLUGINSDI...64.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...SC.dll
windows7-x64
3$PLUGINSDI...SC.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows7-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...on.dll
windows7-x64
3$PLUGINSDI...on.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows7-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows7-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3$PROGRAMFI...AS.exe
windows7-x64
1$PROGRAMFI...AS.exe
windows10-2004-x64
1$TEMP/Team...TV.dll
windows7-x64
1$TEMP/Team...TV.dll
windows10-2004-x64
3$TEMP/Team...er.exe
windows7-x64
7$TEMP/Team...er.exe
windows10-2004-x64
7Analysis
-
max time kernel
148s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
15-01-2024 05:41
Behavioral task
behavioral1
Sample
5c476b47ecc73dbd3412c5d37676f6f9.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5c476b47ecc73dbd3412c5d37676f6f9.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
$TEMP/TeamViewer/Version5/TeamViewer_.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
$TEMP/TeamViewer/Version5/TeamViewer_.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/AccessControl.dll
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/AccessControl.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/Base64.dll
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/Base64.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/SimpleSC.dll
Resource
win7-20231129-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/SimpleSC.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/TvGetVersion.dll
Resource
win7-20231215-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/TvGetVersion.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/UAC.dll
Resource
win7-20231215-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win7-20231215-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20231129-en
Behavioral task
behavioral24
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral25
Sample
$PLUGINSDIR/nsisFirewall.dll
Resource
win7-20231215-en
Behavioral task
behavioral26
Sample
$PLUGINSDIR/nsisFirewall.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral27
Sample
$PROGRAMFILES/TeamViewer/Version5/SAS.exe
Resource
win7-20231215-en
Behavioral task
behavioral28
Sample
$PROGRAMFILES/TeamViewer/Version5/SAS.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral29
Sample
$TEMP/TeamViewer/Version5/TV.dll
Resource
win7-20231215-en
Behavioral task
behavioral30
Sample
$TEMP/TeamViewer/Version5/TV.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral31
Sample
$TEMP/TeamViewer/Version5/TeamViewer.exe
Resource
win7-20231215-en
General
-
Target
$TEMP/TeamViewer/Version5/TeamViewer.exe
-
Size
4.8MB
-
MD5
163d51041a322b849ce16c2c019d8335
-
SHA1
4b1458abe96fd493dcebd1cf7831ba9f28d6c7f4
-
SHA256
e6279ef293ac389c7d0f91f529d70c601aa30fb5f1c88b14715347b2be1caf18
-
SHA512
b9195ccf9781a795eb114fa9f65c89f4d68d8a6d9aadc2e89086d0f31a097167c7d91a1b6467abf5409c4896f49e68cc45656061cb0ee9f38c0bff75925e54cf
-
SSDEEP
98304:VAj+gvcIommkHwzP7qXDbd3yjpiuxbrOTMklzuZknEX0lvY5jq18ne5QV+3u:VAq2cIomZQzzqV3yliuxm/MKE8vYT
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\International\Geo\Nation TeamViewer.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1916 TeamViewer.exe 1916 TeamViewer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1916 TeamViewer.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1916 TeamViewer.exe 1916 TeamViewer.exe 1916 TeamViewer.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1916 TeamViewer.exe 1916 TeamViewer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\$TEMP\TeamViewer\Version5\TeamViewer.exe"C:\Users\Admin\AppData\Local\Temp\$TEMP\TeamViewer\Version5\TeamViewer.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1916
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C3948BE6E525B8A8CEE9FAC91C9E392_EEB8C7E9A435DC539B7A34AD155842C4
Filesize5B
MD55bfa51f3a417b98e7443eca90fc94703
SHA18c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA256bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
SHA5124cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C3948BE6E525B8A8CEE9FAC91C9E392_EEB8C7E9A435DC539B7A34AD155842C4
Filesize412B
MD590cade1afd5686a7d0fb361cfd554eb5
SHA1abcb77844b96579a01e4626c0498f369da451f41
SHA256a7afbaa9b558411b7922db5997a30f6de239ec783edb5829e33eb72ca7a7fee2
SHA5122a04a0cfc297dbba8fa64a337ad45c1b3c1aa080e805b27a0ecfb9b3cbc74e7a5d6ffcf722b536d1db34b3fbf13b7266840c9711ede07b37e41c5fa167b413d5