ffaea974b833b60366bdaad55f5e6dbd71238dbd0d49d1621e00934c1a1f29d6

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/04/2026, 06:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TeamViewer.exe
Size 32.4MB
Sample260416-g438sabz21
SHA256 ffaea974b833b60366bdaad55f5e6dbd71238dbd0d49d1621e00934c1a1f29d6
MD5 eceb04790be45cce5ebda66209d2f419
SHA1 719c4485d8c293e625bc7f5768bd521d9330189f
SHA512 33e07e6f95502cebeb55b073c4d82087a20da89805caec9c572b06d24a8af7cf292db75b646d0c9386dba6ce28fa16a2c1265c99ebb85b3eb8cb579cf3eaa347
SSDEEP 786432:QMtIzLt9PY9paMpmXHiw/ljLf3/rYhW7mE:7tIzLtRYTaOxw/lj/+WyE
TLSH
T1FE776D71B6C686DAD59A11F25A3D5E5F831CAE29077400C763E8A9AE2C305C30F72F67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Control Panel\International\Geo\Nation	TeamViewer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TeamViewer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tv_w32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	TeamViewer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	TeamViewer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	TeamViewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4652	TeamViewer.exe
4652	TeamViewer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4652	TeamViewer.exe

C:\Users\Admin\AppData\Local\Temp\TeamViewer.exe
"C:\Users\Admin\AppData\Local\Temp\TeamViewer.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4652
- C:\Users\Admin\AppData\Local\Temp\tv_w32.exe
  "C:\Users\Admin\AppData\Local\Temp\tv_w32.exe" --action hooks --log C:\Users\Admin\AppData\Roaming\TeamViewer\TeamViewer13_Logfile.log
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4768
- C:\Users\Admin\AppData\Local\Temp\tv_x64.exe
  "C:\Users\Admin\AppData\Local\Temp\tv_x64.exe" --action hooks --log C:\Users\Admin\AppData\Roaming\TeamViewer\TeamViewer13_Logfile.log
  2⤵
  PID:4864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

TeamViewer13_Logfile.log

Path C:\Users\Admin\AppData\Roaming\TeamViewer\TeamViewer13_Logfile.log
Size 4KB
SHA256 521b7126f9625f06bd60c4d11a9855bff13d8da06bace74902de60d5ff478b28
MD5 efde3d671e0a73efea8ff5b180df7037
SHA1 ca21c6d474e149d61b270cb404c9808337869161
SHA512 abca8c74b745a934a46327583db1c7807e0b3095d4274357b5565cd0b76e866e0398d3073803d73644879bc788c18d9bced8944be1b77193fd5b82f0d8ca9b4d
SSDEEP 96:PDV8Orho6JiNOiNCD80/W0MHFCLBGdXHtouR5Zt1krCr14QC+5K:P2ADlj/MHSBGdXtPR5Zt1IF
TLSH
T188A1DE0123648EF70DE9818BE51E969BC952A95AB72F343675FC2904F7C1E0593D3C8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TeamViewer13_Logfile.log

Path C:\Users\Admin\AppData\Roaming\TeamViewer\TeamViewer13_Logfile.log
Size 5KB
SHA256 bb92e1f461c0c403e8621de344bbac715de4f62dd2d1e75e3ed8854d877c8ba8
MD5 e11403fe428b3967240eaa10142ddcf4
SHA1 69f471467208d67b284eecdf41bc03852521180a
SHA512 a001ec7b69c5b807171ce53b9c3a1ea5a4ad041ea3f9945a31e0cf01a45d03cd322c34294b331afd8fe1b2babb5396eeb875b16792a46ca93a0ccbf3705cf42a
SSDEEP 96:PDV8Orho6JiNOiNCD80/W0MHFCLBGdXHtouR5Zt1krCr14QC+5Q347+5K:P2ADlj/MHSBGdXtPR5Zt1I6F
TLSH
T10FB1DE0123648EF70DE9818BE51E965BC852985ABB2E343675FC2914F7C1E0993D3C8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4652-4-0x0000000004F90000-0x0000000004FA9000-memory.dmp

Download

memory/4652-5-0x00000000053D0000-0x00000000054A3000-memory.dmp

Download