23ad1b0af1badc4bf855f0caa63fb914ac9d4358a1f0a2cf094a23b263e66777

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TeamViewer.exe
Size 32.4MB
Sample260804-pg8hzsem41
SHA256 23ad1b0af1badc4bf855f0caa63fb914ac9d4358a1f0a2cf094a23b263e66777
MD5 c3a158d69dd236d9da8a0733cc1f93b2
SHA1 7a96ff4c7b27d823e959161b2bbe04d53969d907
SHA512 45ffe1e2e4de546e3839b127345b9a01417891aac0af42d6ba0d8c3b21e4edf9cb3e88e8f3b583692f55f79009e8af1b565d71ff65e6fd4960134e09d525001a
SSDEEP 786432:nzGtIzLtJS10nB4gkrmLu7wgcgGflCC3pM:CtIzLt01OB/5u7wgc/l0
TLSH
T162776D71BA85865AF59241F25F3D5B1F8B1CBE09077441DB62E8BA7E2C344C30A32E76
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TeamViewer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tv_w32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	TeamViewer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	TeamViewer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	TeamViewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
708	TeamViewer.exe
708	TeamViewer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
708	TeamViewer.exe

C:\Users\Admin\AppData\Local\Temp\TeamViewer.exe
"C:\Users\Admin\AppData\Local\Temp\TeamViewer.exe"
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:708
- C:\Users\Admin\AppData\Local\Temp\tv_w32.exe
  "C:\Users\Admin\AppData\Local\Temp\tv_w32.exe" --action hooks --log C:\Users\Admin\AppData\Roaming\TeamViewer\TeamViewer13_Logfile.log
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1176
- C:\Users\Admin\AppData\Local\Temp\tv_x64.exe
  "C:\Users\Admin\AppData\Local\Temp\tv_x64.exe" --action hooks --log C:\Users\Admin\AppData\Roaming\TeamViewer\TeamViewer13_Logfile.log
  2⤵
  PID:292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

TeamViewer13_Logfile.log

Path C:\Users\Admin\AppData\Roaming\TeamViewer\TeamViewer13_Logfile.log
Size 4KB
SHA256 5f060fa495902fbe55c82dc1df5c414e7cb4dbcb187564763612e70ff11458aa
MD5 0b683bde47cbbd1ce26e61e17719bd4c
SHA1 7a6185f3214fa7a9eead48868131a7d29f5efd93
SHA512 f9ad5a62a94e19d61163ce7933331e620b32e3fad1b3b5efa23602f0c230640327cd11ecb6e6b02547151f25f7a05eabeed6191aa72b921d9af2951c960d660d
SSDEEP 96:5rDitlloiNxiN2D8Kdh8Q+EDLvEyXHfzr44QC+5M:5rUgKdPSQ+EPnXH5t
TLSH
T18CA1CE8310F836F969484383D36286C98CFB304DAD0ED99E76BCD889DF4181E95A1CAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TeamViewer13_Logfile.log

Path C:\Users\Admin\AppData\Roaming\TeamViewer\TeamViewer13_Logfile.log
Size 5KB
SHA256 524eba9e16d54495a6ecf6680cd8298e4495e00c803fad403bbe757272ae2232
MD5 fd70e3889a040a36cfe1e336a622aa46
SHA1 17084d0af5e5e14eec70c3fa8a88caf43bb5c356
SHA512 2a340681f01565b4553bd8f0e499dedf2ebee44931d7fca79f2d28eedf3085eef3ddbbe08ff93e767afd53560f26c93d356e1cb1c103a58610d8c36e76eb62bc
SSDEEP 96:5rDitlloiNxiN2D8Kdh8Q+EDLvEyXHfzr44QC+5VrUQFhHP47+566qHV:5rUgKdPSQ+EPnXH5xQHHEl6q1
TLSH
T1BFC1F04311FC35F96A458383D252468A8CF7300EAD1ED9EE71BCC889EF4195ED9A5CAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download