Overview
overview
7Static
static
7TeamViewer_Setup.exe
windows10-2004-x64
4TeamViewer_Setup.exe
windows11-ltsc_2024-x64
4$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...on.dll
windows10-2004-x64
3$PLUGINSDI...on.dll
windows11-ltsc_2024-x64
3$_4_/TeamViewer_.exe
windows10-2004-x64
4$_4_/TeamViewer_.exe
windows11-ltsc_2024-x64
4$PLUGINSDI...64.dll
windows10-2004-x64
3$PLUGINSDI...64.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...rb.dll
windows10-2004-x64
3$PLUGINSDI...rb.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...on.dll
windows10-2004-x64
3$PLUGINSDI...on.dll
windows11-ltsc_2024-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...Ex.dll
windows10-2004-x64
3$PLUGINSDI...Ex.dll
windows11-ltsc_2024-x64
3Analysis
- max time kernel
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/08/2026, 18:14
Behavioral task
behavioral1
Sample
TeamViewer_Setup.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
TeamViewer_Setup.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/TvGetVersion.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/TvGetVersion.dll
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral7
Sample
$_4_/TeamViewer_.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
$_4_/TeamViewer_.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/Base64.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/Base64.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/InvokeShellVerb.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/InvokeShellVerb.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral24
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral25
Sample
$PLUGINSDIR/TvGetVersion.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral26
Sample
$PLUGINSDIR/TvGetVersion.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral27
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral28
Sample
$PLUGINSDIR/UAC.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral29
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral30
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral31
Sample
$PLUGINSDIR/dialogsEx.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral32
Sample
$PLUGINSDIR/dialogsEx.dll
Resource
win11ltsc2024-20260709-en
General
- Target TeamViewer_Setup.exe
- Size 25.1MB
- Sample260822-wvprcsar5s
- SHA256 85844c9f685e5b8cfaf0d8b9ffc7299c9c0c1626bd2fe9cc3ea8033bbe41a930
- MD5 9acea7d9db6b67967c2d480ce519e383
- SHA1 c7375a157d85fe67f7f7e7689fe510f93d3440c2
- SHA512 0ac09afa012cff3bfd15ab9a202d2d428d9f981a8da3e76acfabb34249c0d704edb99c62cc80cfa22e1fb28ecc05aef34b8dc6cde79f14f479945e806d360142
- SSDEEP 393216:6KwZsASdpjb5xY3vYEyCcQZIQaZzf080/l8nu+xG04XuJnDc+YKYlionZ:8Kpjb3PQ5aZf1QwuQlHYli
- TLSH T1A14733E9E3E352D3E8326A36DB92577850323EC564E41DF446C8BB2C49711DDE32A92C
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4512 TeamViewer_.exe - Loads dropped DLL 19 IoCs
pid Process 5524 TeamViewer_Setup.exe 4512 TeamViewer_.exe 4512 TeamViewer_.exe 4512 TeamViewer_.exe 4512 TeamViewer_.exe 4512 TeamViewer_.exe 4512 TeamViewer_.exe 4512 TeamViewer_.exe 4512 TeamViewer_.exe 4512 TeamViewer_.exe 4512 TeamViewer_.exe 4512 TeamViewer_.exe 4512 TeamViewer_.exe 4512 TeamViewer_.exe 4512 TeamViewer_.exe 4512 TeamViewer_.exe 4512 TeamViewer_.exe 4512 TeamViewer_.exe 4512 TeamViewer_.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TeamViewer_Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TeamViewer_.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5524 wrote to memory of 4512 5524 TeamViewer_Setup.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\TeamViewer_Setup.exe"C:\Users\Admin\AppData\Local\Temp\TeamViewer_Setup.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\Users\Admin\AppData\Local\Temp\TeamViewer\TeamViewer_.exe"C:\Users\Admin\AppData\Local\Temp\TeamViewer\TeamViewer_.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4512
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
- Size 24.3MB
- SHA256 ea65fc2f4c8b912b30612bc08836d8db6ad3b7314b78cbf9395ea88f8b165f9b
- MD5 8dec13dc9f1645b3b67c4919a0c3e731
- SHA1 f6e1c310f7e21ad69879f839f73731a9fa1ba237
- SHA512 5404b7d8f6becadae1e22f556600d12f03b17917203c3e5df804944ae28c251fe519304d3dfaef354013a7cdecda46058608b6040cdf0317ea9f59fbe94400b7
- SSDEEP 393216:/wZsASdpjb5xY3vYEyCcQZIQaZzf080/l8nu+xG04XuJnDc+YKYlionZv:wKpjb3PQ5aZf1QwuQlHYli+
- TLSH T1894733E9E3F352D3E8326A3ADA92577810323EC570E01DF449C9BB2C59715D9E32992C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\tvinfo.ini
- Size 46B
- SHA256 cdbb63b7564a66278d31af41f9c22a9b7d2bb2a0f186d3f7ec01cf65ac5d4614
- MD5 acd6cd3df0f488a6571d5a4723b32115
- SHA1 552cd3eec0561fc5f58b974b3a381ef90b9a63f7
- SHA512 549713a40e3d4aa4ab8a08fc005d5a6a9547e12b9291c548ee9f8b7bd4bfcb0ea92d4f0a646777ad37ac4137705540ba21b56d8ca32646f96c6e1a0ee4293ddf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsp6808.tmp\TvGetVersion.dll
- Size 205KB
- SHA256 4dc85036cd8ea9d97d5d01380bd2cf9bf3dd3c5874c5c5826b035b6fccf09389
- MD5 cfaf5a7b835810073da17c54e63aa242
- SHA1 4bfaaa629b770af34bbf3f92227303e2dac005a1
- SHA512 9c47abd8b79ad08b4051fc07f92e0200d9421fc74da37d8bbb7f578f78c382d8dba135073488a343dae76ca82731a100d205d41c3053f1fe3fd63a2771119171
- SSDEEP 3072:hJot4lHTjsWbMocuRzWuHB/JhuU7etqc0CtXi53d2sfafYiqRNbDKwJ4fNT9vz/d:WOR6urhuT8eJ8NRagiONZsB9rl
- TLSH T13D247E227680C036C1E7013099AA67721BFDBC714AB5D4CBEBD88F661FA46D5DB2431B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsv69FD.tmp\InstallOptions.dll
- Size 27KB
- SHA256 822f75b69dd87332b5995528771923ec74dc5329c65094bf4e372eb8ef42bb8e
- MD5 e87068563fc18e67a78230067cc240e5
- SHA1 37cd2cb5581fc575b8c46383d877926bda85883b
- SHA512 dab6b330d73abadb63f6eb02a5bc87ce9b9d1bc64fcb9289581cfc2e04be0254893945b3bdb762b382bb491388e34bc018f098a489908dfbc9feca2a9ba13d5d
- SSDEEP 384:E4C43tPegZ3eBaRwCPOYY7nNYXCT/YosaiZSf+VIYiWL3LU9Pxh8E9VF0NyzDcHF:ElTgZ3eBTCmrnNAho/YiWk9PxWEZsOe
- TLSH T1FDC27C6267D45C33EA975E307AD192269FB4F7525881CA83823B8E021B553827FFC375
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsv69FD.tmp\System.dll
- Size 23KB
- SHA256 a91aa7c0ead677fc01b1c864e43e0cace110afb072b76ad47f4b3d1563f4dc20
- MD5 938c37b523d7fc08166e7a5810dd0f8e
- SHA1 47b9663e5873669211655e0010e322f71b5a94be
- SHA512 77afe83fb4e80a775dae0a54a2f0ff9710c135f9f1cf77396bc08a7fe46b016a8c079b4fa612e764eea5d258703f860688e38b443e33b1f980e04831739517c1
- SSDEEP 384:58QIl975eXqlWBrz7YLOlACZSf+VIYiWLbLWQaZdPxh8E9VF0Ny0W3N9:5gPgrfYLOWJ/YiW8PxWE6Y9
- TLSH T1EFB28D2346505CB2DD46893074D92936AFB5768299E0C9D3A357C142AFA07C37FFC2BA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsv69FD.tmp\TvGetVersion.dll
- Size 221KB
- SHA256 1ac196c947f91055d2f55d90a60e80f9f17a788ac09955390ad52823644f7580
- MD5 5cd69da9c6befb3b57bc8cf29ae7a2df
- SHA1 e79fcb842ba8e51a0ae969acf18b916d3f217bdf
- SHA512 121fff679b199884d666766bc08077f3f6a0f3c8fb60826d93d71a7a007846eac6ff7bb576b9ed138e334e8990c2e879ed76ecf1557f841d249bb7d1a69ae220
- SSDEEP 3072:HZ7FQwEs7sdkiOGov5RWZnGDTaKP08XTgD9fjfCfFbDK/+:ZKwEscOG850ZaeKcyTgJrKfQW
- TLSH T1E1245B0137E4843AE5F72A346DF6C6604EBDBC726974D18FE384C92A1E70A85DB24727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsv69FD.tmp\UserInfo.dll
- Size 15KB
- SHA256 e1cb80a23786b02cb2c6a2f9e391b63cbf3ad911e42bbdc14cc6879c84b7404e
- MD5 77ff6a927940a0e4b8dc07bdde6ab5db
- SHA1 8d0035242289504d050d237f7e3e548c1ddff077
- SHA512 6a3050dc8e3f4eaaa85a43cdf1ac4f69745c07efe48268103ee7d8927ec574b6866740f95e6b3aff154ba74cd05024223a3ea4957cb773dd065cfd797f8a07e3
- SSDEEP 192:hxvcecjqZSF8VG+VIYiYF8u7a7JV+A0MLyfP+noPOJB3hy2sE9jBF0NyH0lQkzkT:QrWZSf+VIYiWLyLvPxh8E9VF0NyHka
- TLSH T1E672397786642C12DD568F7270D9483AAFB1B7925A90C1D3221FC1914B90783BBED2BE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsv69FD.tmp\advanced_unicode.ini
- Size 1KB
- SHA256 cd8149a2e89373075ee6db800b7f2496bacbfe21b23e4a06a3453632503b3965
- MD5 f68824a4130ebaf6bc7ab0f62256d7d7
- SHA1 40af19a0d92b3c9e1a8b1eaab7d12c69e5df436a
- SHA512 6a173aaa183be0e5a516cad484802dae1fc53a414f870f93ea846a9ef9f9df35153766ef632eb5e8ced8f94c2ed09a9decdf3465d46b0dcc44a6918d88e242cb
- TLSH T1C42147533FF80014F5AAF648EBF59431A7397449A82EC95E81D00A0F09F9AC0566BBDB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsv69FD.tmp\linker.dll
- Size 56KB
- SHA256 7817f79bcdf54ef8617f15b5c0b9b92053549d5a51fa280722ee7179311b69a1
- MD5 b05a97bb3f532b7cf57b8eedf198d7af
- SHA1 83c13a90f4a3c1c62e132f5f3bc70c97c2ecfc80
- SHA512 40706c5fc72198148962d24046722fc5e488c0cc4b3374a9f4b652175919e97a8712e882940db8c26479619a26ec4e2d41744627a9ca52ec7cb1ce4f91d7ee8c
- SSDEEP 768:ZmTLl3rmEgLMP/rLqgidfwHJQDEExmE+Ji4RdVt//wf/YiWGoPxWEfQy:ZgLFm8OdfwpJS/fqt//wf/70Pxf
- TLSH T191437C12B150C877D81B427824998B169BBA7D111BF5C0833BAB934E9F713D1BB3E356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsv69FD.tmp\start_unicode.ini
- Size 2KB
- SHA256 dadfcda2f6c0263ea221d60a20d900145d90800369b3d81173bc590646308569
- MD5 21b0e577d56a98d8ddda1d465f39920c
- SHA1 8ea048d7200ed53fec3c0edb5712d8be8597457f
- SHA512 0c4756f7638ae12124b7b7bd1a731c61de044260c2898e9c430b70ba5677ec5f243e0916596d9ab802c7f3293120435aae9d45de5abcbb3149c8842655dbc589
- TLSH T1CD5191633FF80125E5BBF648EBF58035E7397901582DC41E81D10A0F49E6A90566BBDF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsv69FD.tmp\start_unicode.ini
- Size 2KB
- SHA256 49e6b8fa09db8235d8152e1a7a041086f05d4f4cfec9dd1c09291d8c0ce924fe
- MD5 64ab1eb3e0da7f038544d65d22dd0dfa
- SHA1 f558444c0a46a368cef7d59c271abe717380e811
- SHA512 ede40c8f51f5bb3623d5d4ed611ab1ea1ca67dda26c008dcaa0812f2edd22f889d58b56f719d322d9294745c95566b5fc5e36cf9674d064502cc724873c0d4a0
- TLSH T18751A0232FF80125E5BBF648EBF68031E7393902582DC41E81D10A0F49E6A90566BBDF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsv69FD.tmp\start_unicode.ini
- Size 2KB
- SHA256 0d2c3a195a2224b64e57305b8a2301eb925a477b7f09479de41ef2e7cfc7ad58
- MD5 949261eca6e0b4057a7486be5a66fb94
- SHA1 4261fd879b026ec91e6ed5cc1bf14b11ba4a13d7
- SHA512 d28706da1a3d807f2ab3509a557e7ff88e67b65d0f53303994bef875ffc7560df9d9a5342cd895ef697fbe6dff65fd33e09a8d0e1b80d721d5fc9477f77d69e3
- TLSH T14151B1232FF80125E5BBF608EBF58031E7397902582DC41E91D10A0F49F6A90566BBDF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsv69FD.tmp\start_unicode.ini
- Size 2KB
- SHA256 02d4df250e6fd30d0ae720e97aae7bf6b55abe64d53b05b8fc92d8ae5f069e0f
- MD5 9052c2741e22f3e1e406d34020aed9d7
- SHA1 acb0fc7a9aa3cc792be28ecdfd0c72b1fd015970
- SHA512 bdb59e4f572d6397346431ac2e25bf6d9fe1bba401d6bd2446c765afdd7767b589ed1b527a5baeb3cc64a4e4ad0809e7277535180b08368d87e3bf74a45893df
- TLSH T1ED51B1232FF80125E5BBF608EBF58031E7397902582DC41E81D10A0F49F6A90566BBDF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsv69FD.tmp\start_unicode.ini
- Size 2KB
- SHA256 0982faab9ba32f08f7ec58f77818fd36927efc721619a8d835aed06c4c343f0b
- MD5 8650b5b2c20e756f106e07274a287fa1
- SHA1 bc133f6d46388d4d2b6d1ebd4406ddadc54dba3f
- SHA512 af285e5c821d3e5c05335accfd1577e851f8ea299de5c29817df58083a6692b070e73f55babc7c14e7a61289ba107a4e1d4646efd8516101b0f408a7625f856c
- TLSH T14351A0232FF80125E5BBF648EBF68031E7393902582DC41E91D10A0F49E6A90566BBDF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsv69FD.tmp\start_unicode.ini
- Size 2KB
- SHA256 94bde605292510f8ae6df19083130770ae8c754906007ea93150cab63962190b
- MD5 2a8a139cdab38b5f4264ae82850cbd22
- SHA1 816e8acb2adc36c7f138f963a9802622dfc9536a
- SHA512 d6f99e88e72cfb28afc4af0780d2ac380f00f9fe9265cbbb4b8e6390e9b6ee5870a723e1971288783fd919158659ff214bab383242fa22470d9f6f1a170e2cf1
- TLSH T1F55151633FF80124E5BBF608EBF6903197397905582DC51E81D10A0E49E6A90926BBDF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsv69FD.tmp\start_unicode.ini
- Size 2KB
- SHA256 4d841a5a394484fa7ee986b56ad1e58fffb4a57fa11add97c5c1223d2491c6c9
- MD5 a0a55d9c66c02b91b6272c7975371e06
- SHA1 07132283d28a09f74dbe11b9612e243b4096b8ab
- SHA512 65a6d21f1d1306017cb50d9c4b3100c446a94d4dcdf5059987f4c039135a3188c052f672b42ac6f585f495590ae0d7de9c84735f89a78a5868153cfb076ebcf1
- TLSH T10551B1232FF80125E5BBF608EBF58031E7397902582DC41E91D10A0F49F6A90566BBDF
- MD5 SHA1 SHA512 TLSH