8216f35ee79dac6bda3863064d4288831192ce31ab752d27a3094d17425eaab5

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 12:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
eitechsupport.exe
Size 15.2MB
Sample260730-pj56msxdma
SHA256 8216f35ee79dac6bda3863064d4288831192ce31ab752d27a3094d17425eaab5
MD5 7dad9a1b128f145c85a4859cd319436e
SHA1 7d829bbce1e643c8c50b57b05179b0c12654ddd5
SHA512 e182a7c872e03aef4a4f21c4286cc8833b1dd7840c4f7d1b6022c95d376b58021a7df6a86b0f3bd79c0b184f7f8f5191437d00e0ee234a473869f1452eddf183
SSDEEP 393216:uUclZsnAiEWl9kbQ7at4CIOzXzsv9BDrpyDy2H2dah:udlLiEWFatNIqjsv9xEucIah
TLSH
T1B7F633E4E3E74697F8316A36D342563824313FD464E46CFA4AC9BA2C89701DED21F96C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
940	TeamViewer.exe
5512	tv_w32.exe
5240	tv_x64.exe

Loads dropped DLL 11 IoCs

pid	Process
5732	eitechsupport.exe
5732	eitechsupport.exe
5732	eitechsupport.exe
5732	eitechsupport.exe
5732	eitechsupport.exe
5732	eitechsupport.exe
5732	eitechsupport.exe
5732	eitechsupport.exe
940	TeamViewer.exe
5512	tv_w32.exe
5240	tv_x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eitechsupport.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TeamViewer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tv_w32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	TeamViewer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	TeamViewer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	TeamViewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
940	TeamViewer.exe
940	TeamViewer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
940	TeamViewer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5732 wrote to memory of 940	5732	eitechsupport.exe	89

C:\Users\Admin\AppData\Local\Temp\eitechsupport.exe
"C:\Users\Admin\AppData\Local\Temp\eitechsupport.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5732
- C:\Users\Admin\AppData\Local\Temp\TeamViewer\TeamViewer.exe
  "C:\Users\Admin\AppData\Local\Temp\TeamViewer\TeamViewer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:940
- - C:\Users\Admin\AppData\Local\Temp\TeamViewer\tv_w32.exe
    "C:\Users\Admin\AppData\Local\Temp\TeamViewer\tv_w32.exe" --action hooks --log C:\Users\Admin\AppData\Roaming\TeamViewer\TeamViewer13_Logfile.log
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:5512
- - C:\Users\Admin\AppData\Local\Temp\TeamViewer\tv_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\TeamViewer\tv_x64.exe" --action hooks --log C:\Users\Admin\AppData\Roaming\TeamViewer\TeamViewer13_Logfile.log
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

TV_w32.dll

Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\TV_w32.dll
Size 395KB
SHA256 3337cf9b82b4e110636d6a7027ac35bd461e75bcd8fad9d640ed4e13ae69306d
MD5 573cb86cda6f6374cbcf08d2920f0e00
SHA1 dc6a87804c656ea0b17ae2f64af3d17170eca22a
SHA512 32fd6a67d926fc3bb2841592afe3e7dde2695684449cf4a8ed80181fb4ccdad591e67cbb86d11acc707aa26d7b182bb4f90858e4200e5d2306b1fadf07ea41ec
SSDEEP 12288:GS3ulDromrLjiRzvpV/LSSdsGCH6EdyVYFGUXiWp:RulDrogiNk6EdyVYFGUjp
TLSH
T1B4848E10F881C472C163387149B8E6B25CBC6D751B35AECF13982975AFB44D1BA3CA6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TV_w32.exe

Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\TV_w32.exe
Size 180KB
SHA256 c2a4b85bcfdcef2a3749fa7a35938f93ec34e79669dd7ab292dd97ad4c3e6631
MD5 b75c7acb0910cb0872e0bea6909c955e
SHA1 674bc4670a0e8f92f7b8656e9d599f8f1a897d65
SHA512 ff2fd3e0cf04d8756d90df50348c18d54faabf2bcb425880a27f387a97bc379acb1b8db59476517d48a561ce053314797a6f0b4787c834b4d5677b50acdc63cf
SSDEEP 3072:mZQ+UtILX2yDS683EXi6svJQKlJ8KCwhSJg3PWvPNwI7IKawlrV:nhtILoL3EXi6LKfOgSxdl9V
TLSH
T1A1047C22B5C1C072D5730A7019F5DB769ABCBD300F7459EB63880B3A5E346E16639E2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TV_x64.dll

Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\TV_x64.dll
Size 483KB
SHA256 ab3debc6b9558777fc588d81561ed82f25629d49927bd0301a70666feb9375a8
MD5 157f11ca8803eb9aa37eff006cac7f1b
SHA1 b95aeb3339438a1954fd3d15faccc7e1dbdadd27
SHA512 fbacc98d2e2f1522aaeecbcad7f65ffc0ff564d11537af31730b067ab3a8cb3bba13da7d7dd7e8d5035d8a26e45f0d0c132db7a389475ab735845b98c7da33ab
SSDEEP 12288:7+9viclW2fDCno694CoiLIdbb48dz/ZNIOl+HO:K96coeDCno694CoiLIxb46/ZNIpO
TLSH
T1C7B47D56F7A105B5D037D13DCA628A12E9B1780A4731A78F03E8E7760F237A16A7FB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TV_x64.exe

Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\TV_x64.exe
Size 209KB
SHA256 196fd72be1370d85515dbb6810740327856d921051c263c95eda7a59bac31b63
MD5 6aad3a9498b426924bb1b056a48887d4
SHA1 8218ba250d1dbc3d4d7a7b0d72b4d3d355e9adea
SHA512 cea14a2c63f6c257faede701e2292320961aa1b6a2c81330ad4df2989f48f28310bf257addabbd8a7288e2bdb15c2d1a921914707c9b8c099e899d31bf6f94b8
SSDEEP 6144:A5SXFhQj63dHi4ZY9Jfif12iMqsNnz+8clYFhbp/k1eUAigww/7S:A5SXFhm63dHi4ZY9JfifknqsNnz7SYF2
TLSH
T15A247C1AB69400F9E173C27DC9528956F672B8550730D6EF0364037AAF376E09E3EB26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TeamViewer.exe

Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\TeamViewer.exe
Size 33.1MB
SHA256 3262eb64ca5a7920f126dcd20e6dcebc14f1a57642d6a56c15169c90be2fb5e7
MD5 4f283436e5b309b1e729e907c6170a91
SHA1 9f03f91caaefdb3b98a7e575d169c60ad92521ad
SHA512 63444c4d9ccf6d2f4df0befce32b5f786f48c41eacb64f188f8238b92ed56e58c3852130d9907c4908ee57df6ab85324e29cbe57339d2f15ce5e162562010cfc
SSDEEP 786432:oKtczNtjbq6daavMgD6KCn57Xb1O3ZRi8cSukp/:ltczNtjbxdamzDsnnK3
TLSH
T117774D31BA46C65ED95282F16F7D991BC32CAF5407A448C7D398BD6F38349C24A33E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TeamViewer_Resource_de.dll

Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\TeamViewer_Resource_de.dll
Size 323KB
SHA256 14b3e0e21e4bb22ef61e05b953a1bbc8f8970d44e095e648232b122a56df6c3a
MD5 bab241a0f4a6fd44fbee95f156fe454a
SHA1 90984b97efb01e4b685503f10682d132c10dbb0c
SHA512 9d0550c8d2ca06c01451c2f86d1abb96ed1859c922eb2fb38015a2238df1bd3a9860dffb0addc1f828aca2c69083a3613ef4b019244837598b59bb832e1c1070
SSDEEP 3072:2isIPtpxZ4Z7lkfDbw1qBK/CuJct/bG2XgzEdHg72c1XLvuBMPKjFRnStnAb7dc8:7VMoIWtfB
TLSH
T15C64EB5117E98A18F2F33F74AEB863946E72BCE6FD7AE54D1710509C1871B809A60B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TeamViewer_Resource_en.dll

Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\TeamViewer_Resource_en.dll
Size 282KB
SHA256 b47b62e0c73d5baa4243e171aa910992c2936b0d30b7483bb54e6bc8f00f6051
MD5 0897ad65996e4db2c0c56bd35541bd6f
SHA1 8c3470530af67e0a569cbfb20ec0a7f395ab0c8e
SHA512 3acdd5c5c666b6687c1e601026fd3de7fd4035df819a77804d4ce44209308c579834cfd81f594d232438f80eea99c6b36b44e8c0439655b924d025b30f6d190e
SSDEEP 3072:2DQG45R4mShz4gSzk+3p4sihmBB7K+xk1NTKXdvd:UA5tVNNm0
TLSH
T1DF54995163F94208F6F77F74AEB926644E7ABCA6AD38D29C0250405E59B1F90DCB0B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TeamViewer_StaticRes.dll

Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\TeamViewer_StaticRes.dll
Size 5.8MB
SHA256 ff60b6aa90ad1e560cb7d0cfb520bb8a62c55fcd151f39dfc8a9438d9782de26
MD5 b9bef03108f1d7406aca7c8d5a57b814
SHA1 c6fbf1c8d0d89dde85a5f793a71d080c3853b875
SHA512 a06a9469ec2c9a248c02be9aad9b1bab2bf5734e9e6639dec7ec16ac1353855bc5920eff32bad9c965f5217216d4a11d565f7060b12af3a78cc777c0b82fa522
SSDEEP 98304:7zaJcYTl5i5pDoCwugR4sh0SjjwpA9ZuJCpHCNkE7g:7WCol5i/Sb4s2S3ZkCpHCNkEU
TLSH
T15856CFA4FEF27AA7D41962325AD514009C331EC3E9916C86B6CDB82D1F307CD8D8B65E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tvinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\tvinfo.ini
Size 43B
SHA256 4bb43371db64a197337ac083ef44dd9c169b300e7002651308ba5aea76dbf203
MD5 d6adec0494eb9ebd6f7df5c0fc402e91
SHA1 775d63a516248b30c849b180aae697da6e6a59b1
SHA512 f276e8a6341495454ccc0d10241f99e984645f2552acb17873ee0bb1600d9009daf92350ac79e9a2ff8d3dd4c0449e6ef25db1efaa1e473968aed34bf5c38d76
MD5 SHA1 SHA512

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsl522F.tmp\System.dll
Size 11KB
SHA256 982c5fb7ada7d8c9bc3e419d1c35da6f05bc5dd845940c179af3a33d00a36a8b
MD5 0ff2d70cfdc8095ea99ca2dabbec3cd7
SHA1 10c51496d37cecd0e8a503a5a9bb2329d9b38116
SHA512 cb5fc0b3194f469b833c2c9abf493fcec5251e8609881b7f5e095b9bd09ed468168e95dda0ba415a7d8d6b7f0dee735467c0ed8e52b223eb5359986891ba6e2e
SSDEEP 192:eK24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlASl:u8QIl975eXqlWBrz7YLOlA
TLSH
T12B325C02135481F3E4918138C86B3A276B6A15029BF98E57DFD39646BE30BE3BD7D603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TvGetVersion.dll

Path C:\Users\Admin\AppData\Local\Temp\nsl522F.tmp\TvGetVersion.dll
Size 210KB
SHA256 c67cbd5e35e1ce0c7ba17c55d8e2bc33afd5e0a68774554a1fe7216d330c709e
MD5 05f51bc8ffb2c8f5a2825bf5680301cf
SHA1 30f7f77dce1fb3526142780e9f5bd5c11622d6b6
SHA512 1e041aaa37dd00414ad955ebc8c0f708589014d2085a5a0b95a31f4d694bb1cc4994bb1324d4b983cbad0449fb0a05560d82c60fdbfc78be67ff61275e451233
SSDEEP 3072:4J7KJkcma0VkpOG/374vnriZ1nmTaK405/+ncMCQ2bDh:6EkcmYOG/37MnGZoeKxpuuQ
TLSH
T1D7245B0177E4843AF2F726746DF6C6604EBDBC725934D18FE780892A2E70A85DB24727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsl522F.tmp\nsis7z.dll
Size 175KB
SHA256 66b2f36274ddfeef35b1d6ae6e5755f834446e5d78a719063347543793987161
MD5 87853c0f20f065793bdc707ece66190b
SHA1 738e11a9a565923ec75400a0cd4bce4db257b21d
SHA512 febfcd11795f4ef0ff3d25cbf1856be01e7f6423a9f16028c927988c04ab21de5f0b076d7f4ce9294aa7603c0db61ea5ffb888af2e9f7c6a6a11bcabfe9795a2
SSDEEP 3072:eBFxfbJUIW9WGExPYD5JFBJOYWjm8KCmRv1fPIVF2tbRp:6xzJSAGEdYD5JcYl78Fs
TLSH
T110049D2337E0C175E21F0732DE56EB9122BAB6504E62C8873F990F5C4F726989E2D716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TeamViewer13_Logfile.log

Path C:\Users\Admin\AppData\Roaming\TeamViewer\TeamViewer13_Logfile.log
Size 5KB
SHA256 3d1663c5d4eca848895d8361c576fb45c53c1fa506b29fa6f2af8491ce13f117
MD5 b79ff311a98fa1f4bc8a695d391fe571
SHA1 47e012b0fa2a32c222eae15425c3bfe12ccea834
SHA512 2cd5b51572a442a8c3056ae93e12fd869ae6c5190b40b4dcfb50294278bded4ca12dc0cec782b0d43ff0a2ea08e7c2574f05deb706a033504c281aaa4173d706
SSDEEP 96:nD1r2PziNyiNvD8tYxDcwIDUQRqbSyrH3ru+4zC+5zwQShh:npwXobFcwIjMbSyrHowQMh
TLSH
T1E1B1FE8391B852F93B69D1E9EBB2E0CA8EBD1102E19F14D2795F99B44B41C48DBD0DCC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TeamViewer13_Logfile.log

Path C:\Users\Admin\AppData\Roaming\TeamViewer\TeamViewer13_Logfile.log
Size 6KB
SHA256 7ee8bab87d3753d98d58060a0629146edd1975a5590e0d594b91c65e51aefada
MD5 726f9af41b0369c4c5e3be100242ac91
SHA1 71e63ac5231e9b0f8715027a60d139ccc7347009
SHA512 3ea0919769fe96e222af63004cec8a80c76439f35cdf373a040542d1002162d542dae4f92c06352a7f28fb101d2bb4630519a639678d289599ffbae5cf0f7180
SSDEEP 96:nD1r2PziNyiNvD8tYxDcwIDUQRqbSyrH3ru+4zC+5zwQShH3ZbA5+r5A4Y+5K:npwXobFcwIjMbSyrHowQMH3Zb+BF
TLSH
T14FD12F8391BC12F53B69D1D9ABB294CACDBE1102E19F14E3795FA9B40B40D48EBC48CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5732-23-0x00000000074D0000-0x0000000007502000-memory.dmp

Download