Overview
overview
5Static
static
3incoSAT.exe
windows10-2004-x64
5incoSAT.exe
windows11-ltsc_2024-x64
4$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...on.dll
windows10-2004-x64
3$PLUGINSDI...on.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ON.dll
windows10-2004-x64
3$PLUGINSDI...ON.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...7z.dll
windows10-2004-x64
3$PLUGINSDI...7z.dll
windows11-ltsc_2024-x64
3TeamViewer.exe
windows10-2004-x64
5TeamViewer.exe
windows11-ltsc_2024-x64
3TeamViewer...op.exe
windows10-2004-x64
3TeamViewer...op.exe
windows11-ltsc_2024-x64
3TeamViewer_Note.exe
windows10-2004-x64
3TeamViewer_Note.exe
windows11-ltsc_2024-x64
3TeamViewer...ar.dll
windows10-2004-x64
1TeamViewer...ar.dll
windows11-ltsc_2024-x64
1TeamViewer...bg.dll
windows10-2004-x64
1TeamViewer...bg.dll
windows11-ltsc_2024-x64
1TeamViewer...cs.dll
windows10-2004-x64
1TeamViewer...cs.dll
windows11-ltsc_2024-x64
1TeamViewer...da.dll
windows10-2004-x64
1TeamViewer...da.dll
windows11-ltsc_2024-x64
1TeamViewer...de.dll
windows10-2004-x64
1TeamViewer...de.dll
windows11-ltsc_2024-x64
1TeamViewer...el.dll
windows10-2004-x64
1TeamViewer...el.dll
windows11-ltsc_2024-x64
1Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 18:26
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
incoSAT.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
incoSAT.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/CustomerTools.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/CustomerTools.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/TvGetVersion.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/TvGetVersion.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsJSON.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsJSON.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
TeamViewer.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral16
Sample
TeamViewer.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral17
Sample
TeamViewer_Desktop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral18
Sample
TeamViewer_Desktop.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral19
Sample
TeamViewer_Note.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral20
Sample
TeamViewer_Note.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
TeamViewer_Resource_ar.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
TeamViewer_Resource_ar.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
TeamViewer_Resource_bg.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
TeamViewer_Resource_bg.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
TeamViewer_Resource_cs.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
TeamViewer_Resource_cs.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
TeamViewer_Resource_da.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
TeamViewer_Resource_da.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
TeamViewer_Resource_de.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
TeamViewer_Resource_de.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
TeamViewer_Resource_el.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
TeamViewer_Resource_el.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target incoSAT.exe
- Size 29.4MB
- Sample260930-w3dztsybph
- SHA256 7c8eaabfd0090fae790b97cfc8659d1084f6214ddbf9e814fdcb90af313dd447
- MD5 ed76e753ffbdbc3ac4bf4232fba1ac1f
- SHA1 caf4267ef1d6b402c5eba05727d3656850330909
- SHA512 54530e3f00ebe03f3e84aecb39e7598cfff9b6df5ec5929a1af1187278435fa1cedc2575867b9fdad25b6a73bd9f5255498b08177efe23cea33b9fe1bbde1f70
- SSDEEP 786432:RG7G5y+Zbpuu/DhP51wSk5ETrfOpplUuyRfY4J:RHzh5140rmpplGJ
- TLSH T13D6733361C459C97E407BCB7FCB85907D23F9E5836501A234E6035B89F39BC27A2929B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
pid Process 5104 TeamViewer.exe 1420 tv_w32.exe 5876 tv_x64.exe - Loads dropped DLL 11 IoCs
pid Process 1988 incoSAT.exe 1988 incoSAT.exe 1988 incoSAT.exe 1988 incoSAT.exe 1988 incoSAT.exe 1988 incoSAT.exe 1988 incoSAT.exe 1988 incoSAT.exe 5104 TeamViewer.exe 1420 tv_w32.exe 5876 tv_x64.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname TeamViewer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain TeamViewer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TeamViewer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tv_w32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incoSAT.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs tv_x64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs tv_w32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs tv_w32.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2714045687-1127350534-2056456672-1000\{725AD578-C385-4570-B713-AD98789E4B42} TeamViewer.exe - Modifies system certificate store 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E TeamViewer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd TeamViewer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254832000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd TeamViewer.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5104 TeamViewer.exe 5104 TeamViewer.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5104 TeamViewer.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 5104 TeamViewer.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5104 TeamViewer.exe 5104 TeamViewer.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1988 wrote to memory of 5104 1988 incoSAT.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\incoSAT.exe"C:\Users\Admin\AppData\Local\Temp\incoSAT.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\TeamViewer\TeamViewer.exe"C:\Users\Admin\AppData\Local\Temp\TeamViewer\TeamViewer.exe" --configuration 9x6kr4s2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\TeamViewer\tv_w32.exe"C:\Users\Admin\AppData\Local\Temp\TeamViewer\tv_w32.exe" --action hooks --log3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1420
-
-
C:\Users\Admin\AppData\Local\Temp\TeamViewer\tv_x64.exe"C:\Users\Admin\AppData\Local\Temp\TeamViewer\tv_x64.exe" --action hooks --log3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
PID:5876
-
-
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\TV_w32.dll
- Size 483KB
- SHA256 0e782951f593389828f5bf4bf03534cca5560c3dfb3e6b5c13c2f67a5c78123f
- MD5 ffc91653043c2d884869e0139f67d2c0
- SHA1 7cd0b104a3c614b8c83dd83484dd75d4ea45d14f
- SHA512 ec1f60b23bff81c720d9407b29cae189e43b4fa9d53141a4c3433c1e8c7f73e816ad4e0ac53ea1033fe96a0cfd0887068a47e4b61165fc109441ce4d4340d5f8
- SSDEEP 6144:qK0WsVPg3w6XA0PPhgtwpEcgVttxkE3dn2oVJKlgzippUV3zWmNa4T:qK0WsVPCFXJPhgtwCcGdn2IfiD+s4T
- TLSH T162B4A001B5C18472C97E34301675E7BE8A7DA9300B24A9CF53C845B7AFA4AC2DB75A1F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\TV_w32.exe
- Size 338KB
- SHA256 4ca7583926604c540ffbb04876a4fc15c31d908c23235e1b368cd4809a8beeb2
- MD5 d8462f9c25896a451360912f425c36ed
- SHA1 122d1372d2fa7f01eb7398418a64fc8cc275b331
- SHA512 d5a1fd85ed391188edde2e3fdb084ec2951e6fe83ddad2dada93b89d3870859b414abb35fceb367ef8ebc4509fa8831fdabef3a66c3981108b3a080a4173ca43
- SSDEEP 6144:0mj8j3q1E34GSbgOdFzDQ0iOHmPcmggvOVpiX4M6h31o77697frO3:n4jhI0QFzDQrOHmP7gJM5nXOO
- TLSH T152748D01B7C1C032D46202B23B7BDBB5C67DB9240FB155D763D95BAEDA302C1AA35B26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\TV_x64.dll
- Size 613KB
- SHA256 fcbcec3ab4e7fdf6dee3414ac942b933ed8a7f1c14de21892c8160a36edb4aef
- MD5 204f9c464c5853a0a0b51e73d3254593
- SHA1 c9933152d57ba1b1accd981d5d94abcf4813d12f
- SHA512 5e571a76a98c48cbdc92c42ac5503247f08441dae7adaafc08fa6a2e4096737c1b354bfda7c065af604bb1b8dba78fa0c131f7789e8839eefa56e5b77e3a311d
- SSDEEP 6144:BM9D/YS+MT9qzy5HzqPeilIhwz0GGEXMu5BplgTcYIUaWhU12m+rT:BM9DQ4T9P5+PeaIhOGE8WLr0N
- TLSH T186D48E1673E501F5E0B7D13ACA564A65FAB2B8140730A7CB03E4A2672F237E1573E726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\TV_x64.exe
- Size 399KB
- SHA256 77a5ea7696091260a05981c72172c9d36112b87a3f79e907793e8b5757b68f39
- MD5 e41b90c996c4a0fd39783e5a62a37c10
- SHA1 52f4fba3e1af9b97cf83b18c7974dd63802b79e8
- SHA512 40459f329687ec0f0ff3ba7b861563031a3ab7c6402ef565bd99e24c8540808c7f1950c3a6940f18f9b95109c6bc0fd703802a9d7a13d494b6f4fbfbd8cb772d
- SSDEEP 6144:amSctJX9C4mt27NVLJNqXv9NG3KPSvCVjCv0Y4NcpAGwkhU:xJteOrWG3KPUlhU
- TLSH T1FD945B16E7A904F8E0B7D238C9A74902E7767C5E037197DF1394426A2F636E09E3DB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\TeamViewer_Resource_de.dll
- Size 440KB
- SHA256 6f39b31791980818302c5d6cdf20d26502ff25af83646f683ac1cc1aa8a9f4aa
- MD5 39ff194c3c03738838f6f7a8f99286cf
- SHA1 fa8aea658c4835e283f4d04d1a65c9ad617780bd
- SHA512 ced7df2eb92ba795b50174eeb1ef9625415339dd6e39045dd2bfcd35187a1b01b15f5fedf141e69c97d1b40130c111276be5c124baa0d591863cdf29af2504aa
- SSDEEP 3072:plazVPM1HDB74Zp0Fk0L0C0lpiVCuuY15XyzTFPT8y1OWZ1Kofx9quxM8lsKjSCn:plaTD/RDWtN3PUHrT
- TLSH T161A4EB6153E98618F2F37F34AEB862946EB2BCE6FD79E54D1710509C1871A80D9B0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\TeamViewer_Resource_en.dll
- Size 383KB
- SHA256 4e28559c94a6ea594c3ac1d28fcc976e432e3c8a6274a47e90e182ef55f2ccdc
- MD5 fda7146daec4f01dd8faa0d1d6e68746
- SHA1 03907701005c335082f5400b55e6d1a15d2d6189
- SHA512 66facd789cb115a9d73ddba78088ca580a5f2aef74fe492e8e0bea1f4947d7997c9802d3ffee6642f4645344b1fffaebb0c71045bf1022e0213c11127f471627
- SSDEEP 3072:+Iy68C3PBVS0TI7Sz73j4WH5yosu7nMrSpks5boE32JPuK1iE8/:+8pZHsEnYQP5t38u
- TLSH T14E84965163FD4608F6FB7F74AEB926604E7ABC96AD38C29C1250405E59B1E90DCB0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\TeamViewer_StaticRes.dll
- Size 9.1MB
- SHA256 431bc025697c23a2f4247001424457577b60720887d0072fa43d29d2f21319ee
- MD5 2490535799ee27458067857d8376469d
- SHA1 4bf460ecd940b8d6e23e19107511451afb5db0f3
- SHA512 673a83b79cce9aad8917cfbf6dfbb271de9da2918a12d00edb69cee6f39d6c57c515c45861b069096b6bf843f2277a23230862ee10a497b9021abceead5e8841
- SSDEEP 196608:RShbMjYPqMyisl6+0w4s2SY/VoAwhk+W5kfE:RSlszl67SYDwc5kM
- TLSH T151A602E3EBA0EC31C5195A3215E714F1ED334DD3B6529A0A76CEB82B5F31B844C96287
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\tvinfo.ini
- Size 37B
- SHA256 2895268b2b51e181a80dd0e9e114980f5034f6966452b47f3a39d1af43597ca8
- MD5 c4ea5bf1f30771fd8afacb7afe223852
- SHA1 782e1e8edf3d31be8a63873b1cc9b27ab0127a05
- SHA512 c155d7ee58cb25f0bebd77fb635bb9f5254164278838d435e627b4e57e6e5b16c4e96241657a2a5dc4cf5cbbb5c027e3d694315935facc1e5cf263e44a78daab
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\{a476d8a9-2fd8-48ea-85f6-76abe3909078}\TeamViewer.json
- Size 852B
- SHA256 15f8915317b3420c56b582fc57b975a180efdcc02d6cc44341ab26f8be76cdf5
- MD5 51d3757817eac6adeb710ba0444b58d7
- SHA1 49961be8c60130730bfcb3d9861ea68428deb6a4
- SHA512 98f402b4f2e808df19576431bfd50ae934d9f366b1e39241ea85201cf0504cab058a57137ee7773165331331c26a5fb876e91b0745383ca1731e059d8e8d44a2
- TLSH T1FD014169E1F05C77C2FAD22830B4A383B6B41F6B21A44D27F5F506CC1F6A65164827FA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\{a476d8a9-2fd8-48ea-85f6-76abe3909078}\TeamViewer.sig
- Size 216B
- SHA256 3c14d426a6d5ea3285dc8f1a7e3c1ff9182d295de5d121d7772d294e9bc68751
- MD5 a0c8e8bf88d9960eb1af861fa0ce768a
- SHA1 eb3c6928a9cce12136e7d892abf3228d748ebc09
- SHA512 64b188c07839f414a17d86c196947c5aa48b984281177cdcdc33502774e49339236c0bc86bf789237d1e8e770ebe1343b5a4e6cf284c47a4dd68ed8a48f39101
- TLSH T17ED022399925F8C5024C3C10880A3C060C8DE303D6A29D4DEEAA096630209D7FF188B8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\TeamViewer\{a476d8a9-2fd8-48ea-85f6-76abe3909078}\logo.png
- Size 20KB
- SHA256 f37d70b184ea90299ec1769d4adfcb12e9b0dcfa8fc72d6591523c6a5fd5e766
- MD5 2b837151e8144df07a0a1a63877a4b91
- SHA1 cf66f9994fd4a6f917a980f5611131a8fb97df49
- SHA512 aff75cc4e6cf7eef74dea300b64efda0722cd9ef565eb99ce6c961ccc732193933a33e8056561634944843bd0fc281efc7296bb885140553d1d9a9a32bbf84d7
- SSDEEP 384:jBclf7WLCOWK2C0GzVYDy1BGj/cA6kRUMRA6LOWcbANEQoh8JeWSSPGezJNheG:lcJWLzWzKY6Gj/cDkRUOO/bAWQohoeWb
- TLSH T12FA2CF6E143160D3BCB1E390A72FAFB494D85993F3D1814EF2D682B8E4D6C12A5523ED
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsj121.tmp\CustomerTools.dll
- Size 1001KB
- SHA256 3053b06883b8bd56d9a961f44cd67ca7b34ff85eb59ca1c116af0c6ba4c387e6
- MD5 dfce06caf5f4d2421a42d8725d729cfb
- SHA1 8f59c983cb60bbc49f2b44cfe672de08c0491dc8
- SHA512 0600e588c2fb95592acd627ca97942fad3075d9169a79ff3ca8096fd743286b52694f57323dce0f4af2babbc5fff7ba43321f6c90a56d2b58c4e6b0f3b99d196
- SSDEEP 12288:E34fnIsCz0pL5gtBhJHmtkSJ8cfRrqi3ApzINsjCTEjz7k/q:XfL00+3JGqlxCsKEjzR
- TLSH T17C259E217509C035E9AE11B16C3DAB9E819D5D2B0B7044CBE7D86E6EB9340E37B32B53
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsj121.tmp\System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsj121.tmp\TvGetVersion.dll
- Size 696KB
- SHA256 e35396c7d7e32a8fe771895ed9ea16bd85c8544410bf4dc70a42ccd2884cfd83
- MD5 41c3a6594060581d3bf1a16ed4ae6a72
- SHA1 62bdf8c2a3fa5f70e8b25e83c946debf80c8fd47
- SHA512 3fee7ea74b4173b2815d631c8e69f5a21f2a170a46ce60424f9b9fb03cf7a35eab6933210497f851816a1a85eb3fdb682781ccb5e2607b7ade6dbc7a098368bd
- SSDEEP 12288:1vN6jZ0SoGsZwrbV22NJPNKwhtFXWKRc/VL5dAXfyud15bMVq03D:1vN6aSoGsZwXV22NNNKwhfmH5abEP
- TLSH T182E49E017AD0C036E6BB25721974EB754AFEB831193097DF5398963E6F30681E72A327
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsj121.tmp\nsJSON.dll
- Size 30KB
- SHA256 018cba12efaab3ec61cfa2c54772f0e070452d57f2fc71026826fd7e3f59bd39
- MD5 bcb13343ab422d2c7ce98e324bd02c8b
- SHA1 b6e633426c0d9f3d1f2ef0cf4a27218974da1f7f
- SHA512 dfa02415b6c2003eae5b19f49726536d023bf72dc1e4f123906c1e2fe6200473db8e674e94947f6e07f8cda9e0bbe28cab968225968ee832b8e4bfc5997240b7
- SSDEEP 768:V3wCtynHJAIl0CU4K7yAB8tpVdDQJNILw7/YiW+LZPxWEJY:ttypAY0WqVB8tpVdDQJNI07/7LPxA
- TLSH T182D26A66897048B1F97788B4B1E03E232A7DFD0258A0D5E713EB86055A603437B7E73B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsj121.tmp\nsis7z.dll
- Size 187KB
- SHA256 5d71aaeefbc81732017e9040c8087e6686a16dd54e6d9bcd5ba7a47af68cc925
- MD5 7fe20cee9277556f4ef137e61d29d9f5
- SHA1 d53c37dbf548914ed20c8ebb21186a95beef1ee3
- SHA512 a90250214c6c5048b098e031fca5a8097854a8667330551d7694740e3bc83f7d77791d314e3ac75617ef1834b75c41e3e3d3c74da9794a207894c13fb2d4bef7
- SSDEEP 3072:OBFxfbJUIW9WGExPYD5JFBJOYWjm8KCmRv1fPIVF2tbRpj/uxe:qxzJSAGEdYD5JcYl78FsLP
- TLSH T12E14AD2337E0C175E21F0732DE56EBA162BAB6404E61C4873B9D4F5C4F726889E2D71A
- MD5 SHA1 SHA512 SSDEEP TLSH