ffaea974b833b60366bdaad55f5e6dbd71238dbd0d49d1621e00934c1a1f29d6

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/04/2026, 06:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TeamViewer.exe
Size 32.4MB
Sample260416-g438sabz21
SHA256 ffaea974b833b60366bdaad55f5e6dbd71238dbd0d49d1621e00934c1a1f29d6
MD5 eceb04790be45cce5ebda66209d2f419
SHA1 719c4485d8c293e625bc7f5768bd521d9330189f
SHA512 33e07e6f95502cebeb55b073c4d82087a20da89805caec9c572b06d24a8af7cf292db75b646d0c9386dba6ce28fa16a2c1265c99ebb85b3eb8cb579cf3eaa347
SSDEEP 786432:QMtIzLt9PY9paMpmXHiw/ljLf3/rYhW7mE:7tIzLtRYTaOxw/lj/+WyE
TLSH
T1FE776D71B6C686DAD59A11F25A3D5E5F831CAE29077400C763E8A9AE2C305C30F72F67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TeamViewer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tv_w32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	TeamViewer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	TeamViewer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	TeamViewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5804	TeamViewer.exe
5804	TeamViewer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5804	TeamViewer.exe

C:\Users\Admin\AppData\Local\Temp\TeamViewer.exe
"C:\Users\Admin\AppData\Local\Temp\TeamViewer.exe"
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5804
- C:\Users\Admin\AppData\Local\Temp\tv_w32.exe
  "C:\Users\Admin\AppData\Local\Temp\tv_w32.exe" --action hooks --log C:\Users\Admin\AppData\Roaming\TeamViewer\TeamViewer13_Logfile.log
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4048
- C:\Users\Admin\AppData\Local\Temp\tv_x64.exe
  "C:\Users\Admin\AppData\Local\Temp\tv_x64.exe" --action hooks --log C:\Users\Admin\AppData\Roaming\TeamViewer\TeamViewer13_Logfile.log
  2⤵
  PID:3344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

TeamViewer13_Logfile.log

Path C:\Users\Admin\AppData\Roaming\TeamViewer\TeamViewer13_Logfile.log
Size 4KB
SHA256 388f7c3a7cdbf8df3c2b96658d67f4e4be5c623093fdbaeb84e5a12021002d9d
MD5 30a17805f88d6f8e38032fe38d7da7c9
SHA1 9fa21682f43336481f1654b837c08e1743bc6b41
SHA512 f5d28c1778987501aa85552a525fa6805bfcd370e1741f0a3a6a3867acee66550327934728c089f7a41b9243d8297379f012873ec6a1ac299483549eb8648bde
SSDEEP 96:PD+2FeXFyEhiNUiN7D8Py80oxeUdMKw4ursr34QC+5K:Pivt0TNox/yKPUF
TLSH
T139A1CD194B4C8AF70DE58389D45F851BC563900AE62F3837B5FE1D98BBC160DD5E6888
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TeamViewer13_Logfile.log

Path C:\Users\Admin\AppData\Roaming\TeamViewer\TeamViewer13_Logfile.log
Size 5KB
SHA256 3403defd571d0b03853466a6f0b9147053e40e40a6f25eebeffc4c6ea74e0c71
MD5 b4047f9a3ae833ae35060bdf488d2c75
SHA1 69cf8ad64ea3277a023bcf0c272c711e885535dd
SHA512 b08f34028b71f8ff085665616971d011ab4b19904a839c93c099444b69607c49d9b169f732550ae84a2b131efd36e3cf61fe8eb1fd5154ff2787b2226350fcaa
SSDEEP 96:PD+2FeXFyEhiNUiN7D8Py80oxeUdMKw4ursr34QC+59j47+5K:Pivt0TNox/yKPUEwF
TLSH
T111B1DE194B4CCAF70DE58389D45F851BC563900AE62F3837B5FE1D987BC1A0DD5E6888
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3344-6-0x0000025980DE0000-0x0000025980E3D000-memory.dmp

Download

memory/4048-5-0x0000000001530000-0x000000000157A000-memory.dmp

Download

memory/5804-4-0x0000000004E40000-0x0000000004E8A000-memory.dmp

Download