Overview
overview
5Static
static
3TeamViewerQS_x64.exe
windows10-2004-x64
5TeamViewerQS_x64.exe
windows11-21h2-x64
4$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...on.dll
windows10-2004-x64
3$PLUGINSDI...on.dll
windows11-21h2-x64
3$PLUGINSDI...7z.dll
windows10-2004-x64
3$PLUGINSDI...7z.dll
windows11-21h2-x64
3TeamViewer.exe
windows10-2004-x64
5TeamViewer.exe
windows11-21h2-x64
3TeamViewer...op.exe
windows10-2004-x64
3TeamViewer...op.exe
windows11-21h2-x64
3TeamViewer_Note.exe
windows10-2004-x64
1TeamViewer_Note.exe
windows11-21h2-x64
1TeamViewer...ar.dll
windows10-2004-x64
1TeamViewer...ar.dll
windows11-21h2-x64
1TeamViewer...bg.dll
windows10-2004-x64
1TeamViewer...bg.dll
windows11-21h2-x64
1TeamViewer...cs.dll
windows10-2004-x64
1TeamViewer...cs.dll
windows11-21h2-x64
1TeamViewer...da.dll
windows10-2004-x64
1TeamViewer...da.dll
windows11-21h2-x64
1TeamViewer...de.dll
windows10-2004-x64
1TeamViewer...de.dll
windows11-21h2-x64
1TeamViewer...el.dll
windows10-2004-x64
1TeamViewer...el.dll
windows11-21h2-x64
1TeamViewer...en.dll
windows10-2004-x64
1TeamViewer...en.dll
windows11-21h2-x64
1TeamViewer...es.dll
windows10-2004-x64
1TeamViewer...es.dll
windows11-21h2-x64
1Analysis
- max time kernel
149s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
29/05/2026, 00:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
TeamViewerQS_x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
TeamViewerQS_x64.exe
Resource
win11-20260513-en
windows11-21h2-x64
13 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/TvGetVersion.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/TvGetVersion.dll
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
TeamViewer.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral12
Sample
TeamViewer.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
Behavioral task
behavioral13
Sample
TeamViewer_Desktop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
TeamViewer_Desktop.exe
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
TeamViewer_Note.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
TeamViewer_Note.exe
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral17
Sample
TeamViewer_Resource_ar.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
TeamViewer_Resource_ar.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
TeamViewer_Resource_bg.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
TeamViewer_Resource_bg.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
TeamViewer_Resource_cs.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
TeamViewer_Resource_cs.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
TeamViewer_Resource_da.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
TeamViewer_Resource_da.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
TeamViewer_Resource_de.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
TeamViewer_Resource_de.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
TeamViewer_Resource_el.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
TeamViewer_Resource_el.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
TeamViewer_Resource_en.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
TeamViewer_Resource_en.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
TeamViewer_Resource_es.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
TeamViewer_Resource_es.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
General
- Target TeamViewerQS_x64.exe
- Size 32.8MB
- Sample260529-age44set7m
- SHA256 a0154c403b0ac58b880aee26f1e7f236fbc60a8c2ad4c97b042f5ea008fcaf61
- MD5 509abefe4668d4adf7a0caf505ff557b
- SHA1 c02d9414cf8fd15738ec72dab5b5d23909d69cff
- SHA512 16a5a308edb0b541785b4b16d3923f30d321f7572820490d9ec60e936bd5fa074358b5095fc733edfaed5409ee41708e23dae8b9ed0c9cd3e8e7d2e8f725739e
- SSDEEP 786432:/RpFGY5V6eOgtE03bujoWHvE/8F/9Z+EdBwlNkRNbIvW6gZni:/TEEVK03yjuilByN3eP1i
- TLSH T10477337ACE18A60AF9EA2E307A2D751F9C762D1425742DDB5D31BB8B213A3420C51FCD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
pid Process 4640 TeamViewer.exe 5468 tv_w32.exe 3456 tv_x64.exe - Loads dropped DLL 9 IoCs
pid Process 4268 TeamViewerQS_x64.exe 4268 TeamViewerQS_x64.exe 4268 TeamViewerQS_x64.exe 4268 TeamViewerQS_x64.exe 4268 TeamViewerQS_x64.exe 4268 TeamViewerQS_x64.exe 4640 TeamViewer.exe 3456 tv_x64.exe 5468 tv_w32.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TeamViewerQS_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tv_w32.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates tv_x64.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{44DCF0CF-9587-4DF2-9435-4CAC76E741F5} TeamViewer.exe - Modifies system certificate store 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 TeamViewer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a TeamViewer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a TeamViewer.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4640 TeamViewer.exe 4640 TeamViewer.exe 4640 TeamViewer.exe 4640 TeamViewer.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4640 TeamViewer.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 4640 TeamViewer.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4640 TeamViewer.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4268 wrote to memory of 4640 4268 TeamViewerQS_x64.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\TeamViewerQS_x64.exe"C:\Users\Admin\AppData\Local\Temp\TeamViewerQS_x64.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\TeamViewer\TeamViewer.exe"C:\Users\Admin\AppData\Local\Temp\TeamViewer\TeamViewer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\TeamViewer\tv_w32.exe"C:\Users\Admin\AppData\Local\Temp\TeamViewer\tv_w32.exe" --log --action hooks3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:5468
-
-
C:\Users\Admin\AppData\Local\Temp\TeamViewer\tv_x64.exe"C:\Users\Admin\AppData\Local\Temp\TeamViewer\tv_x64.exe" --log --action hooks3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
PID:3456
-
-
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\TV_w32.dll
- Size 158KB
- SHA256 051134396e96775884ad2ad6066112533b2e0cf64895c5cec4b1b8f83fb5fea7
- MD5 1c5fdcbe2e3c355b87b3b818a3f0db03
- SHA1 be84b86a98f71b3e42f64ead1cd17802932bd4d2
- SHA512 6d8ee9a79c78d483ccc59061c4b737f9a9a9e0aa95539fe02ca69b44d4acd93174803bf0cfead89afba1f6431660d45330ded709b2b9154df80d2027ea1f36f8
- SSDEEP 3072:yqNCq05986N7NDUskSd5Bm9RBy4/Y8VpkEgO4DBu0ZiGsnBG/A:or986XUskoBmMMNX+6nBGY
- TLSH T166F39E0672C1C476DDBF143C19B49776873F7A20CB618ECB63981AA98E742C1EE35A17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\TV_w32.exe
- Size 343KB
- SHA256 6905c99ee3179d660c2b7e6225b6ef50d32df828f4f019a059e0b33112267e33
- MD5 88633a4aa4930aa559db024e39edc905
- SHA1 4027b6700f7a09ffe94a7a8fdcc6bf4d50af5ea7
- SHA512 9f5084c80f4efa095021c43e92822e7dc6460722b5fce5eefda066f62ff4b3327d44af6522777619d15527fa6bb98df5f52afad1132cd0373f8803cddffd1632
- SSDEEP 6144:SUi1t/hGWF++uZx5Pr7q36D3bfO5AntDfSifiPoGBoYXmW1sgQi:SUi1dIZx5Pr75D6ODfSi8WYXKgQi
- TLSH T161749E11BA81D433DE5305715A7BDB76C63EB8260F6094C763D84AEEC9306C1AB36B1B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\TV_x64.dll
- Size 189KB
- SHA256 d2e607580837d733164443615747e25018f0881d6e61ce6cc0d18fa284314fd1
- MD5 315269a27c12e97660c4fbbed5feab87
- SHA1 f4557e6c5a20315c87bf1961aea1ea7966ae48f4
- SHA512 94b20b2b2e3117c1b695da4a11e4cf46478d96b856c6a37bc465f8e7c3ee41d9d61185d36b6248737dafa1476c89c197bbd3c803ce9d87b6e0fb4a48b6697c1e
- SSDEEP 3072:Pp60WFgdtfiCRVd459BZ4LZ0o85cPv0pfAfs+qt1Wawr2E/rWG:L/PVu/BZ41uTuqCL3jx
- TLSH T1A5145B1A77E500AAEC738239C9630646E773785107709ADF03604375AF2B7D2BA3EB56
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\TV_x64.exe
- Size 410KB
- SHA256 9cd374c6692095582252854aff6f47f98b12a3c91992abae173f7ca4e19538b6
- MD5 318b8c48bf41d14062cf7b57f575d350
- SHA1 554f64d414b27e5f736533142070ea2ac38eb1c8
- SHA512 631eab2200510ade633ccdda79af2a2493ae291eda0cabd99067400821353715d97b2a7d445fe72dbd1f7975238bdf19379338b7647884a6540537df754200a7
- SSDEEP 6144:okUq7x4o8BprT8P/VoL6EJxD0PRhFNnr2m5AF/l0Mm0X4IOdDXcfCzYIsHlr8LAt:Mo84vGsHCzNGof594w
- TLSH T124947C16E7A804F9E177D138C9A38502EB723C8D47B196DF139446AA2F376E09E3D712
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\TeamViewer_Resource_de.dll
- Size 440KB
- SHA256 f5e61bfebf56aef9294d8fbb38ec9df7f76f100e051656ca3f534e0540fe427b
- MD5 26d624eae0471bc9de1760e1051cb7e6
- SHA1 511cb9dcaf7f31dd49584aa77ca33b21355a88a2
- SHA512 40421a94441990bf24fa263ff3a6cffdedb8d6b91c8b6b6865f2d31a47fa6e5267084b4a040c7a743d8ab3974b1e694107d0dc76f8ca06f30ad35867c3d9011b
- SSDEEP 3072:1K7PM1HDB74Zp0Fk0k0C0spiVCuuY15XyzTFPT8y1OWZ15Afx9quxM8lsKjSCNHj:12ane1WtT3lUKtn
- TLSH T19FA4EB6153E98618F2F37F34AEB862946EB2BCE6FD79E54D1710509C1871A80D9B0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\TeamViewer_Resource_en.dll
- Size 383KB
- SHA256 208f64705f7d37855dab60f7c9ef6ce4e67bdf57fd1c93373ed1965ed41bfa82
- MD5 c06087554a7c708b4c0d4ff46e04e6eb
- SHA1 9718d923633be11b76c29fee66f76c453401d59d
- SHA512 b471f69f3def6a6ce69f19492b815609b510218947b8fa6ca977b8acafe59a9eec78b2cd00348bc464b32067129aa0352641388fc4f22f28dee0ee215bd0ed39
- SSDEEP 3072:U6g8C3PdpSnTIgSU73g4WK0yfsP7nMJ7WkQ539L3qJvuq1khE/i:Ubp1AsDnqCz5Z3Qra
- TLSH T19D84965163F94608F6FB7F74AEB926604E7ABC96AD38C29C1250405E59B1F90DCB0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\TeamViewer_StaticRes.dll
- Size 9.3MB
- SHA256 36d7dfaa2d55d1eab76ceeb0d87f55fe204aee446ddd6ee8177be8315e0ad2c4
- MD5 100c36d185493c0d28d0ec7a0326793a
- SHA1 b0242dd42576a6f04f9f1077098c8971c3c60e10
- SHA512 6db9f0344c2a2b5c8da6ec256c316d57abb8ebb8839b8496a271ae79dcf39bdbcaea23541e939f4c31c3c19ceade7bbcd118d050005f85791ea443bd4345ea47
- SSDEEP 196608:ubhbMjYPqfg/TdFDA6+0d4s2Sg/Veo+KgZkK2Jk//:ublsWfDA66Sgw3KgsJkH
- TLSH T183A602E7EBA1EC31C5194A3615E714F1ED334DD3B6525A0A76CEB82F2F317884C96282
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\tvinfo.ini
- Size 46B
- SHA256 54a256126db2625dbb3a4183cc0102a4463c0471f97c42b7b3b2b52c5575d6ae
- MD5 0391cd89e17bf7b81e4a637a98ad6cf0
- SHA1 2b56c9cde5fda0b73bcccbe5ea5b903c82361f4d
- SHA512 2ec450ff936f847bd9bf3a9ddc66c77762a978c08fcee60955bea9fb1055ba3b769a8f81bbecf88999a77594e48f4ccc0c68702dc73ff7b2d092cafe73bc62b5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nso40FE.tmp\System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nso40FE.tmp\TvGetVersion.dll
- Size 696KB
- SHA256 e35396c7d7e32a8fe771895ed9ea16bd85c8544410bf4dc70a42ccd2884cfd83
- MD5 41c3a6594060581d3bf1a16ed4ae6a72
- SHA1 62bdf8c2a3fa5f70e8b25e83c946debf80c8fd47
- SHA512 3fee7ea74b4173b2815d631c8e69f5a21f2a170a46ce60424f9b9fb03cf7a35eab6933210497f851816a1a85eb3fdb682781ccb5e2607b7ade6dbc7a098368bd
- SSDEEP 12288:1vN6jZ0SoGsZwrbV22NJPNKwhtFXWKRc/VL5dAXfyud15bMVq03D:1vN6aSoGsZwXV22NNNKwhfmH5abEP
- TLSH T182E49E017AD0C036E6BB25721974EB754AFEB831193097DF5398963E6F30681E72A327
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nso40FE.tmp\nsis7z.dll
- Size 187KB
- SHA256 5d71aaeefbc81732017e9040c8087e6686a16dd54e6d9bcd5ba7a47af68cc925
- MD5 7fe20cee9277556f4ef137e61d29d9f5
- SHA1 d53c37dbf548914ed20c8ebb21186a95beef1ee3
- SHA512 a90250214c6c5048b098e031fca5a8097854a8667330551d7694740e3bc83f7d77791d314e3ac75617ef1834b75c41e3e3d3c74da9794a207894c13fb2d4bef7
- SSDEEP 3072:OBFxfbJUIW9WGExPYD5JFBJOYWjm8KCmRv1fPIVF2tbRpj/uxe:qxzJSAGEdYD5JcYl78FsLP
- TLSH T12E14AD2337E0C175E21F0732DE56EBA162BAB6404E61C4873B9D4F5C4F726889E2D71A
- MD5 SHA1 SHA512 SSDEEP TLSH