618cf871f4836b4b53e2cf8a8c46d6d3313631528794beec0740fdb73d8f53d0

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TeamViewer.exe
Size 15.2MB
Sample260804-pg8hzsem41
SHA256 618cf871f4836b4b53e2cf8a8c46d6d3313631528794beec0740fdb73d8f53d0
MD5 22c15243df7db4e59f7204edb7a28ca3
SHA1 7aad802551e9cd1e930fa43d7368c3f7f765b715
SHA512 64678e984d66710a73f6a35cbd98902c6ebfe2c1aa6dd59248ea14e11b50c7614c786e0c27f0714167e443cea8cceca7ce2688432309a844b0658603b836a69a
SSDEEP 196608:hziOmjpRS0UZQPfLyHDIJXwCxnlOY2ghEQsbapSaqk6qF60rIyo5hNnHhpifyGZi:hzINAZ98R79hEQsmfqkdfrs5hNHqfWOA
TLSH
T191F633E9D7F286D7F8325E34D3925A7464323EC9A8E52DF515C8B72C4A301DED20A86C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4808	TeamViewer.exe
4160	tv_w32.exe
4652	tv_x64.exe

Loads dropped DLL 11 IoCs

pid	Process
688	TeamViewer.exe
688	TeamViewer.exe
688	TeamViewer.exe
688	TeamViewer.exe
688	TeamViewer.exe
688	TeamViewer.exe
688	TeamViewer.exe
688	TeamViewer.exe
4808	TeamViewer.exe
4160	tv_w32.exe
4652	tv_x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TeamViewer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TeamViewer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tv_w32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	TeamViewer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	TeamViewer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	TeamViewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4808	TeamViewer.exe
4808	TeamViewer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4808	TeamViewer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 688 wrote to memory of 4808	688	TeamViewer.exe	89

C:\Users\Admin\AppData\Local\Temp\TeamViewer.exe
"C:\Users\Admin\AppData\Local\Temp\TeamViewer.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:688
- C:\Users\Admin\AppData\Local\Temp\TeamViewer\TeamViewer.exe
  "C:\Users\Admin\AppData\Local\Temp\TeamViewer\TeamViewer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4808
- - C:\Users\Admin\AppData\Local\Temp\TeamViewer\tv_w32.exe
    "C:\Users\Admin\AppData\Local\Temp\TeamViewer\tv_w32.exe" --action hooks --log C:\Users\Admin\AppData\Roaming\TeamViewer\TeamViewer13_Logfile.log
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4160
- - C:\Users\Admin\AppData\Local\Temp\TeamViewer\tv_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\TeamViewer\tv_x64.exe" --action hooks --log C:\Users\Admin\AppData\Roaming\TeamViewer\TeamViewer13_Logfile.log
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

TV_w32.dll

Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\TV_w32.dll
Size 399KB
SHA256 c3e5db64240af7d3b576afb8eb844a0b9843d2ea1cbb6ebedbe83e9b1070bdb7
MD5 28a0784ecc6bd23a0a6d26317bd7cb31
SHA1 52617c399ff71419077d63ceea639dbb881bf7a2
SHA512 3efed9c2e75c94abc7a64fbcb2c8fa3d372f947f56115905c3d421677d4371c1ce97595f696a567b973e0e4cc59f82c8fda1abc9b39986f6f17c96c43143e626
SSDEEP 12288:I6On5eFeWPayaGop7WARwLAKY3Rs/fWrVeGsDHuHx:yn5eFjayaGms/fWrVeGsqHx
TLSH
T173947D10BD82C472D1B334354679E6B10CBCAD210B359DCB63A92979AFB45C1BA3D63B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TV_w32.exe

Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\TV_w32.exe
Size 185KB
SHA256 4a92cf1b982eaaafe6ab8e62ff80d2d75ca3aa4e81bf2f173035470b41f8a053
MD5 f1c45804ee7fa4bc76cbc23935e3cd42
SHA1 57f0e36691e0ae81efb8636b375e93acf2bded03
SHA512 bb5850885af41e3178d4a1d98772211746c7af81e5314bfd33eb2044397234d9c77142cbaacecc339cfe0a1ebbdac24dfb97516b9819ba128db8c9a53789abb9
SSDEEP 3072:wL+hAuPHlH8ocoEz+NRBrcx1BvbcssnvGvtqXQozt3ehNdIrIKBdfVE9VFAb:LAuPHlHpEgcx1OVevuDOOrwVFAb
TLSH
T12E047C21B5C1C432D5B3553019F9EB75AABCBD301BB548DBA3C40B2A4F706E26635E2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TV_x64.dll

Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\TV_x64.dll
Size 507KB
SHA256 21366e9e0a69dec99c7783c34f7bde51e1fd1c03d9610a85d99712d0fe36fe96
MD5 4e8b4c04f0841d486148494ad51c4add
SHA1 ec1ecbb85e1767f48e51f1854b366728ca77e500
SHA512 40853c85d3693528cb968b0b5229dabab763d0b4968525490dc2acfc993e91276dfdd965e765bdea64ffb3d8e2c0193dfb72bc065f6d2903eb816a00b9afb30c
SSDEEP 12288:oRxo8RdGPoturMOFMFViF7BBGM88KrPkIR0CEfl7j:2xo8PGiOFMFViF7BBGM8lrPkItEfl7j
TLSH
T14DB47C16F7A50BB5D13BD23DC9528A02E9B278454721A6CF03E8E3760F23BA1697F711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TV_x64.exe

Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\TV_x64.exe
Size 213KB
SHA256 bda0a502d1df304ffdbf14fed5322f65ae582672fa4f010444500996ed276685
MD5 fc0a160ba33004b62827fecd5f61cc19
SHA1 d4803916e2561ac703de8c8ec4e12e0820c69b95
SHA512 8ee8cb221883794707fc9688ff59dc8547bf399153769402f14da1afc9ab49fbb35421e9a46db3a29443cd02e0ec26133478854609d1a72c3262b462931f663f
SSDEEP 3072:yVP586WbgfJHYvCEmea+B7eVaUb5jEygvXgeQv9loW/Kvl+F/ycnQK:M58tcfJHYvZNa+JC1VElhKRhqcQK
TLSH
T16E246C1AB39408F8E167C238CD528911E67778450B71DAEF1394037A9F677E19E3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TeamViewer.exe

Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\TeamViewer.exe
Size 32.4MB
SHA256 23ad1b0af1badc4bf855f0caa63fb914ac9d4358a1f0a2cf094a23b263e66777
MD5 c3a158d69dd236d9da8a0733cc1f93b2
SHA1 7a96ff4c7b27d823e959161b2bbe04d53969d907
SHA512 45ffe1e2e4de546e3839b127345b9a01417891aac0af42d6ba0d8c3b21e4edf9cb3e88e8f3b583692f55f79009e8af1b565d71ff65e6fd4960134e09d525001a
SSDEEP 786432:nzGtIzLtJS10nB4gkrmLu7wgcgGflCC3pM:CtIzLt01OB/5u7wgc/l0
TLSH
T162776D71BA85865AF59241F25F3D5B1F8B1CBE09077441DB62E8BA7E2C344C30A32E76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TeamViewer_Resource_de.dll

Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\TeamViewer_Resource_de.dll
Size 325KB
SHA256 61c27e8134b0f34d558503ba02a5d5cdf5683e1ef78b9c1401f5d118d746b7e4
MD5 94a8117645ff6745f957124ee9e37edd
SHA1 e7a8f7ca35f172d24c39f3b2235f3afde36b24a4
SHA512 284181fa64b1f4252e4acd1d69afa3da6c6a27cf6a95989a00f14c18b44b5a9f6d5cf4a10e71ce32b59679333a0ca9453eca67f63527a7d59c0af2a59914b067
SSDEEP 3072:OuPbSsz4Zbl/vPDbrlqpISCuJqtDbKYXQzEdNyJ271B9Ru/MPKj1RnStnNZdcvmD:Iz9b1tl3T
TLSH
T18F64EB2157E98A18F2F37F34AEB863946E72BCE6FD79E54D1710509C1871A80DA60B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TeamViewer_Resource_en.dll

Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\TeamViewer_Resource_en.dll
Size 284KB
SHA256 b4060107525f7ff66d0d3f4f0defaa792ecf33153c58e7742fbe2596f1fabbcc
MD5 1017f9bbeca24ff1da599b671c35ae49
SHA1 b27f0346af06564ebdcfc9cf23021896c9115ff2
SHA512 3ddb35f097d0939ddf4960d3fcaf755ea2d8250708301583c9a10a2f3e1d774f963cf1dc06224e759e9bc6d0800a8c3c41e13bb02edb59f846012cf52f3350ca
SSDEEP 3072:Qm55U7SljACSZEs3t4siBmBB7fvEkTvWKDdffQ:X50lN0ATQ
TLSH
T1CB54985163F94608F6FB7F74AEB926644E7ABC96AD38C29C0250405E59B1F90DCB0B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TeamViewer_StaticRes.dll

Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\TeamViewer_StaticRes.dll
Size 5.8MB
SHA256 ac9bca02deee40b37ba198bdcab36e929a5813ebb9c1522b33043bcb25c40131
MD5 1ab62a4135e25c90859fab364aa9ee6d
SHA1 c5c692f852f1f410e92f5530bfcfcae494cf47de
SHA512 16a5a285ec7c0715ba421991ad8db2d70594178ecf5b7c03d0eac49a536dc09518d27c55f849cd4830ff846a6da894b3f242a7b875fb1324b38bc2891bb04e7a
SSDEEP 98304:nzaJcYTl5i5pDoCwugF4sh0Sjj2sZOIBGVk6WB:nWCol5i/Sn4s2SlXBGVk6m
TLSH
T18E56CFA5FEF27AA7E41962325AD504009C331EC3E9916C46B6CDB82D1F307CD8D8F65A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tvinfo.ini

Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\tvinfo.ini
Size 40B
SHA256 16b582087a939afb1af4c33340e03fedcfd495271633023f2f48c5d74aeaf4b9
MD5 9808734a69b5b2c20c0e4219ed5a84b3
SHA1 4d97221d18b36696896b0da7c3e26e51fbbce53c
SHA512 4ab98ea17e746cb863a3426e15f13bcccd55e601c324426b95749ef8d079885ab6c903d1088ebad41d36322383c10fb41b23be8cd92b47a5946d8fbdae0a169a
MD5 SHA1 SHA512

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nst1A27.tmp\System.dll
Size 11KB
SHA256 982c5fb7ada7d8c9bc3e419d1c35da6f05bc5dd845940c179af3a33d00a36a8b
MD5 0ff2d70cfdc8095ea99ca2dabbec3cd7
SHA1 10c51496d37cecd0e8a503a5a9bb2329d9b38116
SHA512 cb5fc0b3194f469b833c2c9abf493fcec5251e8609881b7f5e095b9bd09ed468168e95dda0ba415a7d8d6b7f0dee735467c0ed8e52b223eb5359986891ba6e2e
SSDEEP 192:eK24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlASl:u8QIl975eXqlWBrz7YLOlA
TLSH
T12B325C02135481F3E4918138C86B3A276B6A15029BF98E57DFD39646BE30BE3BD7D603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TvGetVersion.dll

Path C:\Users\Admin\AppData\Local\Temp\nst1A27.tmp\TvGetVersion.dll
Size 210KB
SHA256 c67cbd5e35e1ce0c7ba17c55d8e2bc33afd5e0a68774554a1fe7216d330c709e
MD5 05f51bc8ffb2c8f5a2825bf5680301cf
SHA1 30f7f77dce1fb3526142780e9f5bd5c11622d6b6
SHA512 1e041aaa37dd00414ad955ebc8c0f708589014d2085a5a0b95a31f4d694bb1cc4994bb1324d4b983cbad0449fb0a05560d82c60fdbfc78be67ff61275e451233
SSDEEP 3072:4J7KJkcma0VkpOG/374vnriZ1nmTaK405/+ncMCQ2bDh:6EkcmYOG/37MnGZoeKxpuuQ
TLSH
T1D7245B0177E4843AF2F726746DF6C6604EBDBC725934D18FE780892A2E70A85DB24727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nst1A27.tmp\nsis7z.dll
Size 175KB
SHA256 66b2f36274ddfeef35b1d6ae6e5755f834446e5d78a719063347543793987161
MD5 87853c0f20f065793bdc707ece66190b
SHA1 738e11a9a565923ec75400a0cd4bce4db257b21d
SHA512 febfcd11795f4ef0ff3d25cbf1856be01e7f6423a9f16028c927988c04ab21de5f0b076d7f4ce9294aa7603c0db61ea5ffb888af2e9f7c6a6a11bcabfe9795a2
SSDEEP 3072:eBFxfbJUIW9WGExPYD5JFBJOYWjm8KCmRv1fPIVF2tbRp:6xzJSAGEdYD5JcYl78Fs
TLSH
T110049D2337E0C175E21F0732DE56EB9122BAB6504E62C8873F990F5C4F726989E2D716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TeamViewer13_Logfile.log

Path C:\Users\Admin\AppData\Roaming\TeamViewer\TeamViewer13_Logfile.log
Size 6KB
SHA256 6f68dd1d36e6ed2c1407375ea8f41f4fbd6e2709294b85aecee28808fc3f57f2
MD5 e9c57ce8aac35c290ca0cb3dfd630124
SHA1 b3c6bc896f5596e17ec0422d66e6300dbd56569c
SHA512 59f9e2bb5ccc30cdb1df00d0a622e8b0ac1eb434d1ffcb4874587561e351a35de7203476eeacd74985b7bdd7b8dd9384fcf150abc362ba8035724019cb1ac51d
SSDEEP 96:rDm6XmRiNfdiN2D8s3g8R7D3F1lZIQcydyTPQLhHwrn4zC+5kpq8BEfK:rvMudFzVR7rLcydyzQtHeP1
TLSH
T147D1124F06AC0AFA2F6182B39502420DD8F2210BBD5EDDF772FDA7845B5644C96D6CAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TeamViewer13_Logfile.log

Path C:\Users\Admin\AppData\Roaming\TeamViewer\TeamViewer13_Logfile.log
Size 7KB
SHA256 31921989cad2163a6beef5c4a2f436a2d5cc3fb57209e132f4ab6370fdb682f6
MD5 0c59fe12c261c974bd850914584f3891
SHA1 3e62b2bed7e2e7ece4b59dac75a4000ab2e3d6a5
SHA512 4504f8d7ea5667d518f679c3c0fb11d6af416095c72d3b4b5463e8ba09034aa2ba8404999c0fa3199a6db8315c026cce3764b327a81b4c01283b234a4d9a7741
SSDEEP 192:rvMudFzVR7rLcydyzQtHePik9IiQQsRjO:Dd1RhQzhaU
TLSH
T1ABF1118F02AD1AFA2F5182739502420DD8F3310BBE1EDEF672BD97845B5644CD696CAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/688-23-0x0000000002390000-0x00000000023C2000-memory.dmp

Download