f66295b532144eb3ce1fd3d60cdf1cb1ae63f6e5fcfa68f2e4bfd929a8fe87a8

Analysis

max time kernel
150s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/04/2026, 06:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TeamViewer.exe
Size 15.2MB
Sample260416-g438sabz21
SHA256 f66295b532144eb3ce1fd3d60cdf1cb1ae63f6e5fcfa68f2e4bfd929a8fe87a8
MD5 21508645e8689c1972621b15bc4cd965
SHA1 02666f0d190abb10a66d388ae4fe63c00761a02f
SHA512 3c1de7af2c505f3bbd6ac1fac1c7839423f7499f78d318a98093c2dfc3c161378b5ee965c8c6bd421d5943f1812f013139b1091bf111ef3bab99de8fc04cafab
SSDEEP 393216:RgGAjDcSOcJKKcwUXsFvqxq5fDtzJ7l5LuYbl:GDlOGO5Xspqk9BH5iYbl
TLSH
T1B9F633E9E7E756E3E4331B36CBA1427461363FC468F81DF64585772C89341DEA22A82C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4088	TeamViewer.exe
220	tv_w32.exe
4900	tv_x64.exe

Loads dropped DLL 11 IoCs

pid	Process
3008	TeamViewer.exe
3008	TeamViewer.exe
3008	TeamViewer.exe
3008	TeamViewer.exe
3008	TeamViewer.exe
3008	TeamViewer.exe
3008	TeamViewer.exe
3008	TeamViewer.exe
4088	TeamViewer.exe
220	tv_w32.exe
4900	tv_x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TeamViewer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TeamViewer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tv_w32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	TeamViewer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	TeamViewer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	TeamViewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4088	TeamViewer.exe
4088	TeamViewer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4088	TeamViewer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 4088	3008	TeamViewer.exe	80

C:\Users\Admin\AppData\Local\Temp\TeamViewer.exe
"C:\Users\Admin\AppData\Local\Temp\TeamViewer.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Users\Admin\AppData\Local\Temp\TeamViewer\TeamViewer.exe
  "C:\Users\Admin\AppData\Local\Temp\TeamViewer\TeamViewer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4088
- - C:\Users\Admin\AppData\Local\Temp\TeamViewer\tv_w32.exe
    "C:\Users\Admin\AppData\Local\Temp\TeamViewer\tv_w32.exe" --action hooks --log C:\Users\Admin\AppData\Roaming\TeamViewer\TeamViewer13_Logfile.log
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:220
- - C:\Users\Admin\AppData\Local\Temp\TeamViewer\tv_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\TeamViewer\tv_x64.exe" --action hooks --log C:\Users\Admin\AppData\Roaming\TeamViewer\TeamViewer13_Logfile.log
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

TV_w32.dll

Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\TV_w32.dll
Size 398KB
SHA256 6ebf8b582b35aca6d700bc1a9243ac7b78dca52ebfe53ee7fe191a5156a3e169
MD5 fa0e687c19b3f562b795b2cc571c1841
SHA1 b587a28b768f868f103f8c7ff35f22c01c493d9d
SHA512 80d1032d364720efe914bf7ecf0ecf43d56a3ae118f88de11029dae823d6551f38b5ed67b3111718ca10d5a2160af0bb2bd815b353347ea4446daaefc3d91092
SSDEEP 12288:96On5eFeOPayaG4pzWQRwLAKY3RsqKfr1XeGAq0Hu4z:rn5eF7ayaGesqKfr1XeGAqF4z
TLSH
T1BA948D10BD82C472D1B334354679E6B10CBCAD210B359DCB63A92979AFB45C1BA3D63B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TV_w32.exe

Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\TV_w32.exe
Size 184KB
SHA256 a700e4695856adb3eff2a3ce2f5db8252af2bc89d448cd4a5afc8a6a50dd2cc3
MD5 d2c0bcf6eae010b972706a82baa7c9a1
SHA1 c4eb9b383b89b978a0a42e673eb9169588c5aaf2
SHA512 69adb788008fc232914a8d2842a012eba23cebf1b88b3e0eaefeaefb79266baba53fdb2a378b09ab6a57b225660355d16407e5748944d64dace8a7f8577b49f8
SSDEEP 3072:nL+hAuPHlH8ocoEz+NxBN1x1BvKcssnXhvta3nVzt3ehNdIgIKBd4vE9H0M:6AuPHlHpEG1x1dVxveHOxrZH0M
TLSH
T1E6047C21B5C1C432D5B3553019F9EB75AABCBD301BB548DBA3C40B2A4F706E26635E2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TV_x64.dll

Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\TV_x64.dll
Size 507KB
SHA256 ad3992dae09d2678780c2152d382c2dde1b7ad516f1fe1aec38f6b1b80589eb9
MD5 aeff19b35f2a8daccc9269ad46193afb
SHA1 38b3f8df4266e3bbf127d3ad9fbf81c3a57a0e30
SHA512 4d7d02a62d4dff75cf4af0d285e26539fc496262f664b293d1fa3ffe18e04d85f7e0204bdb1b47ed3c1e2ce4629c435c7b53baf4e1f0d9e902e0dc5f9b16e1f0
SSDEEP 12288:nAhVtVwp/MB7r1c1F1VKRK2D9WQNAB3I+0W07:AhVtepQr1c1F1VKRK2D9hNAB3IO4
TLSH
T13CB47D16F7A50BB5D07BD23DC9628A02E9B178465721A38F03E8E3760F237A1697F711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TV_x64.exe

Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\TV_x64.exe
Size 213KB
SHA256 4d378da436b9e8af8159dbaae33cf22e21de04843b63b2a3d9f3123f74b1ded4
MD5 caa20e242e521dde983333d35f323f04
SHA1 3f06936cbb50f17eced84e881639adad0cac1e99
SHA512 8e5f6ca58facc487ecf97e03e793ac2ec32efed4641e96ee845689a1666bee50519230b27e4220ef538821335deb4329385c0100fa015007f69acae39a363158
SSDEEP 3072:gvs1ZZrM9CvoPZEW5ciMCTmbkVcoczmgeQv9lobkWLwO+F/Srw1d1W:n1ZZrQCvoPeCcsSCcrWKdWoK8BW
TLSH
T1D5246D1AB39548F8E167C138CD528A15E67374050B71CAEF1394037A9F677E1AE3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TeamViewer.exe

Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\TeamViewer.exe
Size 32.4MB
SHA256 ffaea974b833b60366bdaad55f5e6dbd71238dbd0d49d1621e00934c1a1f29d6
MD5 eceb04790be45cce5ebda66209d2f419
SHA1 719c4485d8c293e625bc7f5768bd521d9330189f
SHA512 33e07e6f95502cebeb55b073c4d82087a20da89805caec9c572b06d24a8af7cf292db75b646d0c9386dba6ce28fa16a2c1265c99ebb85b3eb8cb579cf3eaa347
SSDEEP 786432:QMtIzLt9PY9paMpmXHiw/ljLf3/rYhW7mE:7tIzLtRYTaOxw/lj/+WyE
TLSH
T1FE776D71B6C686DAD59A11F25A3D5E5F831CAE29077400C763E8A9AE2C305C30F72F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TeamViewer_Resource_de.dll

Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\TeamViewer_Resource_de.dll
Size 323KB
SHA256 ab8cbe4483bfc70ae58d219d34fd620fb5e1f6b6d29924e77a929bb78d80bd73
MD5 b5f60eab60413501ea4f9f4f26e74a36
SHA1 e923130ec860167c4fc615ec9ebbfbf136c0f359
SHA512 612af07cb58796c1d078a0d2579734c2ad584603705a411e791c8b4abe9847a13c91333084e202b226e29ae71e318889a1da2cfd0e7297ea573152294a9dea0b
SSDEEP 3072:BQPbjxz4ZblHPDbrlqMK/CuJctzbMYXQzEdHg72C1XLvuBMPKj1RnStnAKdcvmoq:7dj4Wt1Bs1
TLSH
T1A364DB1157E98A18F2F33F74AEB862946E72BCE6FD7AE54D1710509C1871B80DA60B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TeamViewer_Resource_en.dll

Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\TeamViewer_Resource_en.dll
Size 281KB
SHA256 b076e4c261c93638516c649dbb12b700705ce5f4946f78cab0435f9e5d7442f1
MD5 f501a782281b73dc618a3812519046aa
SHA1 08cc4153a597054485fe095d76cbc0e060d99fde
SHA512 73858c6cf417d3daf38c605a5549a17094ddeab89b988f34408ea1b32ec3fbfc1e3186871305a5b89e6687a44f9e2bf5e3da30de3391dad9c62a2465b1d03e73
SSDEEP 3072:RIo5PGoSlzzoSzk+3i4sLHmBB7NVakj6WKXde1y:R55tSNuwjy
TLSH
T17954885163F94208F6F77F74AEB926644E7ABCA6AD38D29C0250405E59B1F90DCB0B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TeamViewer_StaticRes.dll

Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\TeamViewer_StaticRes.dll
Size 5.8MB
SHA256 13a7c7459ba75a90717a0479598ec9ada256df67d908e184b0711a54952b1660
MD5 db272ef63b949ac670d6bd017b79eacc
SHA1 3b631d6a2e70daf7c9667ced09ee293e90cd8124
SHA512 5123866b327eb812fb69e30d39d9d5765e0590b4656500958671225fb4937c4353e052d2183156ae4e53a1fb8f0a2b8f28d41b28661a2eedd7005e52ea8d6e7e
SSDEEP 98304:7zaJcYTl5i5pDoCwug/4sh0SjjipEpieJCGHENk8NX:7WCol5i/SR4s2SdiUCGHENk85
TLSH
T1EE56DFA5FEF27AA7E41962325AD504009C331EC3E9916C46B6CDB82D1F307CD8D8B65E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tvinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\tvinfo.ini
Size 40B
SHA256 16b582087a939afb1af4c33340e03fedcfd495271633023f2f48c5d74aeaf4b9
MD5 9808734a69b5b2c20c0e4219ed5a84b3
SHA1 4d97221d18b36696896b0da7c3e26e51fbbce53c
SHA512 4ab98ea17e746cb863a3426e15f13bcccd55e601c324426b95749ef8d079885ab6c903d1088ebad41d36322383c10fb41b23be8cd92b47a5946d8fbdae0a169a
MD5 SHA1 SHA512

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nse1BE2.tmp\System.dll
Size 11KB
SHA256 982c5fb7ada7d8c9bc3e419d1c35da6f05bc5dd845940c179af3a33d00a36a8b
MD5 0ff2d70cfdc8095ea99ca2dabbec3cd7
SHA1 10c51496d37cecd0e8a503a5a9bb2329d9b38116
SHA512 cb5fc0b3194f469b833c2c9abf493fcec5251e8609881b7f5e095b9bd09ed468168e95dda0ba415a7d8d6b7f0dee735467c0ed8e52b223eb5359986891ba6e2e
SSDEEP 192:eK24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlASl:u8QIl975eXqlWBrz7YLOlA
TLSH
T12B325C02135481F3E4918138C86B3A276B6A15029BF98E57DFD39646BE30BE3BD7D603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TvGetVersion.dll

Path C:\Users\Admin\AppData\Local\Temp\nse1BE2.tmp\TvGetVersion.dll
Size 210KB
SHA256 c67cbd5e35e1ce0c7ba17c55d8e2bc33afd5e0a68774554a1fe7216d330c709e
MD5 05f51bc8ffb2c8f5a2825bf5680301cf
SHA1 30f7f77dce1fb3526142780e9f5bd5c11622d6b6
SHA512 1e041aaa37dd00414ad955ebc8c0f708589014d2085a5a0b95a31f4d694bb1cc4994bb1324d4b983cbad0449fb0a05560d82c60fdbfc78be67ff61275e451233
SSDEEP 3072:4J7KJkcma0VkpOG/374vnriZ1nmTaK405/+ncMCQ2bDh:6EkcmYOG/37MnGZoeKxpuuQ
TLSH
T1D7245B0177E4843AF2F726746DF6C6604EBDBC725934D18FE780892A2E70A85DB24727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nse1BE2.tmp\nsis7z.dll
Size 175KB
SHA256 66b2f36274ddfeef35b1d6ae6e5755f834446e5d78a719063347543793987161
MD5 87853c0f20f065793bdc707ece66190b
SHA1 738e11a9a565923ec75400a0cd4bce4db257b21d
SHA512 febfcd11795f4ef0ff3d25cbf1856be01e7f6423a9f16028c927988c04ab21de5f0b076d7f4ce9294aa7603c0db61ea5ffb888af2e9f7c6a6a11bcabfe9795a2
SSDEEP 3072:eBFxfbJUIW9WGExPYD5JFBJOYWjm8KCmRv1fPIVF2tbRp:6xzJSAGEdYD5JcYl78Fs
TLSH
T110049D2337E0C175E21F0732DE56EB9122BAB6504E62C8873F990F5C4F726989E2D716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TeamViewer13_Logfile.log

Path C:\Users\Admin\AppData\Roaming\TeamViewer\TeamViewer13_Logfile.log
Size 5KB
SHA256 3716474ec8f0302d519957834d7585356b23ce9e4ea6173b4276f5d69328c849
MD5 23c8d90bbaaf49eea3bcfb3a3f5c3716
SHA1 5f0d63accf504cf9a6606ebd0a965a7757977cf7
SHA512 0d472620a7595c1ab2874b8e98eacf3dadaeb0b930f6913a53b4a0690299878d9d5f7b9708501587a9b9bca1ed032bd7efe8e274b5ca6811570ccfa6c6da34a5
SSDEEP 96:o4DxVfrHTAiNyiNwD86tf0PIxYsiEbLwdnArRrO4Y+524zC+5Hzq:o49lwLvvsPI+FEfwLvIzq
TLSH
T129C103030E0C66F78DE4C289D26E8547955B500EB73B393B75FC29847B86A09E1D7C8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3008-23-0x0000000006B40000-0x0000000006B72000-memory.dmp

Download