Analysis

  • max time kernel
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/08/2026, 18:14

General

  • Target
    TeamViewer_Setup.exe
  • Size 25.1MB
  • Sample260822-wvprcsar5s
  • SHA256 85844c9f685e5b8cfaf0d8b9ffc7299c9c0c1626bd2fe9cc3ea8033bbe41a930
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TeamViewer_Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\TeamViewer_Setup.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5524
    • C:\Users\Admin\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
      "C:\Users\Admin\AppData\Local\Temp\TeamViewer\TeamViewer_.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:4512

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        TeamViewer_.exe

        • Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
        • Size 24.3MB
        • SHA256 ea65fc2f4c8b912b30612bc08836d8db6ad3b7314b78cbf9395ea88f8b165f9b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tvinfo.ini

        • Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\tvinfo.ini
        • Size 46B
        • SHA256 cdbb63b7564a66278d31af41f9c22a9b7d2bb2a0f186d3f7ec01cf65ac5d4614
        • MD5 SHA1 SHA512

        TvGetVersion.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsp6808.tmp\TvGetVersion.dll
        • Size 205KB
        • SHA256 4dc85036cd8ea9d97d5d01380bd2cf9bf3dd3c5874c5c5826b035b6fccf09389
        • MD5 SHA1 SHA512 SSDEEP TLSH

        InstallOptions.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsv69FD.tmp\InstallOptions.dll
        • Size 27KB
        • SHA256 822f75b69dd87332b5995528771923ec74dc5329c65094bf4e372eb8ef42bb8e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsv69FD.tmp\System.dll
        • Size 23KB
        • SHA256 a91aa7c0ead677fc01b1c864e43e0cace110afb072b76ad47f4b3d1563f4dc20
        • MD5 SHA1 SHA512 SSDEEP TLSH

        TvGetVersion.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsv69FD.tmp\TvGetVersion.dll
        • Size 221KB
        • SHA256 1ac196c947f91055d2f55d90a60e80f9f17a788ac09955390ad52823644f7580
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UserInfo.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsv69FD.tmp\UserInfo.dll
        • Size 15KB
        • SHA256 e1cb80a23786b02cb2c6a2f9e391b63cbf3ad911e42bbdc14cc6879c84b7404e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        advanced_unicode.ini

        • Path C:\Users\Admin\AppData\Local\Temp\nsv69FD.tmp\advanced_unicode.ini
        • Size 1KB
        • SHA256 cd8149a2e89373075ee6db800b7f2496bacbfe21b23e4a06a3453632503b3965
        • MD5 SHA1 SHA512 TLSH

        linker.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nsv69FD.tmp\linker.dll
        • Size 56KB
        • SHA256 7817f79bcdf54ef8617f15b5c0b9b92053549d5a51fa280722ee7179311b69a1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        start_unicode.ini

        • Path C:\Users\Admin\AppData\Local\Temp\nsv69FD.tmp\start_unicode.ini
        • Size 2KB
        • SHA256 dadfcda2f6c0263ea221d60a20d900145d90800369b3d81173bc590646308569
        • MD5 SHA1 SHA512 TLSH

        start_unicode.ini

        • Path C:\Users\Admin\AppData\Local\Temp\nsv69FD.tmp\start_unicode.ini
        • Size 2KB
        • SHA256 49e6b8fa09db8235d8152e1a7a041086f05d4f4cfec9dd1c09291d8c0ce924fe
        • MD5 SHA1 SHA512 TLSH

        start_unicode.ini

        • Path C:\Users\Admin\AppData\Local\Temp\nsv69FD.tmp\start_unicode.ini
        • Size 2KB
        • SHA256 0d2c3a195a2224b64e57305b8a2301eb925a477b7f09479de41ef2e7cfc7ad58
        • MD5 SHA1 SHA512 TLSH

        start_unicode.ini

        • Path C:\Users\Admin\AppData\Local\Temp\nsv69FD.tmp\start_unicode.ini
        • Size 2KB
        • SHA256 02d4df250e6fd30d0ae720e97aae7bf6b55abe64d53b05b8fc92d8ae5f069e0f
        • MD5 SHA1 SHA512 TLSH

        start_unicode.ini

        • Path C:\Users\Admin\AppData\Local\Temp\nsv69FD.tmp\start_unicode.ini
        • Size 2KB
        • SHA256 0982faab9ba32f08f7ec58f77818fd36927efc721619a8d835aed06c4c343f0b
        • MD5 SHA1 SHA512 TLSH

        start_unicode.ini

        • Path C:\Users\Admin\AppData\Local\Temp\nsv69FD.tmp\start_unicode.ini
        • Size 2KB
        • SHA256 94bde605292510f8ae6df19083130770ae8c754906007ea93150cab63962190b
        • MD5 SHA1 SHA512 TLSH

        start_unicode.ini

        • Path C:\Users\Admin\AppData\Local\Temp\nsv69FD.tmp\start_unicode.ini
        • Size 2KB
        • SHA256 4d841a5a394484fa7ee986b56ad1e58fffb4a57fa11add97c5c1223d2491c6c9
        • MD5 SHA1 SHA512 TLSH

        memory/4512-254-0x0000000007600000-0x000000000760E000-memory.dmp