Ransomware Attempts Used TeamViewer to Access Two Endpoints
Summary
Huntress analysts traced ransomware attempts on two endpoints to TeamViewer access. A batch file launched a DLL-based payload; security software blocked further attempts on one endpoint, and activity remained limited to the affected machines.
Key points
- Huntress analysts investigated two endpoints where only a limited number of ransomware canary files were encrypted.
- TeamViewer incoming-connection logs showed access to both endpoints from a source endpoint with the same name.
- A desktop batch file launched rundll32.exe with LB3_Rundll32_pass.dll on both endpoints.
- On one endpoint, security software quarantined the DLL and later attempts to launch LB3.exe; no further activity was observed during that session.
- The investigation found no evidence of reconnaissance beyond the affected endpoints or lateral movement to other infrastructure.
Article Details
- Attack Vectors
- Initial access to both endpoints occurred through TeamViewer remote-control sessions.
- Ransomware deployment began with a DOS batch file, PP.bat, run from the user's desktop; it launched rundll32.exe to execute LB3_Rundll32_pass.dll.
- On endpoint B, security software quarantined the DLL and later attempts to launch LB3.exe; it also quarantined a file named ZZZZZZZ before any apparent execution.
- Defensive Notes
- Maintain an inventory of endpoints and installed applications.
- Installed security software inhibited activity on endpoint B by quarantining files involved in the attempted ransomware deployment.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 60ab8cec19fb2d1ab588d02a412e0fe7713ad89b8e9c6707c63526c7768fd362 | SHA-256 hash of LB3_Rundll32_pass.dll, identified as the DLL used in the ransomware deployment attempt. |
MITRE ATT&CK
T1059.003 · Windows Command ShellA DOS batch file ran from the user's desktop to launch the ransomware DLL through rundll32.exe.T1133 · External Remote ServicesThe article maps initial access to TeamViewer remote-control sessions as external remote service access.T1486 · Data Encrypted for ImpactThe ransomware encrypted canary files on the affected endpoints.