Overview

overview

8

Static

static

3

DroidCam_6.5.2.exe

windows7-x64

8

DroidCam_6.5.2.exe

windows10-2004-x64

8

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

DroidCamApp.exe

windows7-x64

1

DroidCamApp.exe

windows10-2004-x64

1

adb/AdbWinApi.dll

windows7-x64

3

adb/AdbWinApi.dll

windows10-2004-x64

3

adb/AdbWinUsbApi.dll

windows7-x64

1

adb/AdbWinUsbApi.dll

windows10-2004-x64

3

adb/adb.exe

windows7-x64

1

adb/adb.exe

windows10-2004-x64

1

lib/DroidC...32.dll

windows7-x64

1

lib/DroidC...32.dll

windows10-2004-x64

1

lib/insdrv.exe

windows7-x64

1

lib/insdrv.exe

windows10-2004-x64

1

plist.dll

windows7-x64

3

plist.dll

windows10-2004-x64

3

usbmuxd.dll

windows7-x64

1

usbmuxd.dll

windows10-2004-x64

1

vc_redist.x86.exe

windows7-x64

7

vc_redist.x86.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    170s
  • max time network
    203s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/02/2024, 16:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    DroidCam_6.5.2.exe
  • Size 15.6MB
  • Sample240224-ts2xssgd35
  • SHA256 f92ad1e92780a039397fd62d04affe97f1a65d04e7a41c9b5da6dd3fd265967e
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 5 IoCs
  • Drops file in System32 directory 43 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 33 IoCs
  • Drops file in Windows directory 12 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 13 IoCs
  • Registers COM server for autorun 1 TTPs 21 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DroidCam_6.5.2.exe
    "C:\Users\Admin\AppData\Local\Temp\DroidCam_6.5.2.exe"
    1⤵
    • Drops file in Program Files directory
    • Loads dropped DLL
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4568
    • C:\Program Files (x86)\DroidCam\vc_redist.x86.exe
      "C:\Program Files (x86)\DroidCam\vc_redist.x86.exe" /install /quiet
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1556
      • C:\Program Files (x86)\DroidCam\vc_redist.x86.exe
        "C:\Program Files (x86)\DroidCam\vc_redist.x86.exe" /install /quiet -burn.unelevated BurnPipe.{DA351114-F132-4A9E-9475-28D292F56503} {3F261A21-3662-474A-A708-0EB0C36077E0} 1556
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2820
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c install.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2356
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32 /s "DroidCamFilter32.ax"
        3⤵
        • Loads dropped DLL
        • Modifies registry class
        PID:2424
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32 /s "DroidCamFilter64.ax"
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:3988
        • C:\Windows\system32\regsvr32.exe
          /s "DroidCamFilter64.ax"
          4⤵
          • Loads dropped DLL
          • Registers COM server for autorun
          • Modifies registry class
          PID:3932
    • C:\Program Files (x86)\DroidCam\lib\insdrv.exe
      "C:\Program Files (x86)\DroidCam\lib\insdrv.exe" +v
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:1436
    • C:\Program Files (x86)\DroidCam\lib\insdrv.exe
      "C:\Program Files (x86)\DroidCam\lib\insdrv.exe" +a
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:1768
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1476
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{af44838c-a1d0-8b46-b2fe-7818a740f787}\droidcamvideo.inf" "9" "41e7d49db" "000000000000014C" "WinSta0\Default" "0000000000000164" "208" "c:\program files (x86)\droidcam\lib"
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:4176
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:c14ce8845b5e8bf3:DroidCamVideo.Device:21.4.1.0:droidcamvideo," "41e7d49db" "0000000000000178"
      2⤵
      • Drops file in Windows directory
      • Registers COM server for autorun
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:2600
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{38dc8598-d49b-9649-bb1e-2219a9f8ced6}\droidcam.inf" "9" "4e67c8bbf" "0000000000000184" "WinSta0\Default" "0000000000000178" "208" "c:\program files (x86)\droidcam\lib"
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:4116
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "2" "211" "ROOT\MEDIA\0001" "C:\Windows\INF\oem4.inf" "oem4.inf:ed86ca11f01d07d6:DroidCam_PCMEX:1.0.0.0:droidcam," "4e67c8bbf" "0000000000000184"
      2⤵
      • Drops file in Drivers directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:2008
  • C:\Program Files (x86)\DroidCam\DroidCamApp.exe
    "C:\Program Files (x86)\DroidCam\DroidCamApp.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2836
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:688
    • C:\Windows\system32\mspaint.exe
      "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\WriteStop.png" /ForceBootstrapPaint3D
      1⤵
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:116
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
      1⤵
      • Drops file in System32 directory
      PID:2748
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:2936

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          DroidCamApp.exe
          • Path C:\Program Files (x86)\DroidCam\DroidCamApp.exe
          • Size 256KB
          • SHA256 ee4d8953d8be9c9456aa3718bb3fd9e0492513710a75f4e403dbb8efbfe3cea8
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          DroidCamApp.exe
          • Path C:\Program Files (x86)\DroidCam\DroidCamApp.exe
          • Size 942KB
          • SHA256 082f5c3fd2fd80505cbd4dbdbb7c50e83c2e81f033a04ea53832dbf0a3fc4933
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          avcodec-58.dll
          • Path C:\Program Files (x86)\DroidCam\avcodec-58.dll
          • Size 1.9MB
          • SHA256 03ff2145b20ed54e35830545a830a6aefe7804c775e4ff1cfda6fe91ab6e052b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          avutil-56.dll
          • Path C:\Program Files (x86)\DroidCam\avutil-56.dll
          • Size 812KB
          • SHA256 620a6ce8a2101a9472e54ebf219aa0fb8260f99248922ca3ac057f21cc9ceb0d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          DroidCamFilter32.ax
          • Path C:\Program Files (x86)\DroidCam\lib\DroidCamFilter32.ax
          • Size 84KB
          • SHA256 ffb22ab7b98ecc98c22cf675bfab61c875127137277e1f66bc3d7269c3b42652
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          DroidCamFilter64.ax
          • Path C:\Program Files (x86)\DroidCam\lib\DroidCamFilter64.ax
          • Size 157KB
          • SHA256 c85b89c5d77a8b41b1a8213783f3ebfcc2fbed959149c5e5ed0f48204d9c4d09
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          insdrv.exe
          • Path C:\Program Files (x86)\DroidCam\lib\insdrv.exe
          • Size 13KB
          • SHA256 d18438bf03d25002e5aa161669a7cb01d0b2c83d2fa5dc2f9217c3b656eb6b9f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          install.bat
          • Path C:\Program Files (x86)\DroidCam\lib\install.bat
          • Size 254B
          • SHA256 d7b86a37b02fed2794904cb28c0fa64a1e0d2218fab608250c8531c1b9ddc439
          • MD5 SHA1 SHA512
          Submit Download

          libwinpthread-1.dll
          • Path C:\Program Files (x86)\DroidCam\libwinpthread-1.dll
          • Size 77KB
          • SHA256 66a2686d2fcdd3f3bfcf39a219519dbe597a8c5f94b4426da5d0e01f3a2d42cd
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          swscale-5.dll
          • Path C:\Program Files (x86)\DroidCam\swscale-5.dll
          • Size 636KB
          • SHA256 c345bb33691f6a483b9da275c38a67974c8648f9e65800abb3057510dc7e81b7
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          vc_redist.x86.exe
          • Path C:\Program Files (x86)\DroidCam\vc_redist.x86.exe
          • Size 13.1MB
          • SHA256 fdd1e1f0dcae2d0aa0720895eff33b927d13076e64464bb7c7e5843b7667cd14
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          vc_redist.x86.exe
          • Path C:\Program Files (x86)\DroidCam\vc_redist.x86.exe
          • Size 11.3MB
          • SHA256 f9cd3dbe1186e3425cb698d1009baf6d54af8ff537bc55a5d9d2888263d12acd
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          System.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsb3D0A.tmp\System.dll
          • Size 11KB
          • SHA256 b80a5cba69d1853ed5979b0ca0352437bf368a5cfb86cb4528edadd410e11352
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          modern-wizard.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\nsb3D0A.tmp\modern-wizard.bmp
          • Size 25KB
          • SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          nsDialogs.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsb3D0A.tmp\nsDialogs.dll
          • Size 9KB
          • SHA256 5157fe688cca27d348171bd5a8b117de348c0844ca5cb82bc68cbd7d873a3fdc
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          nsExec.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsb3D0A.tmp\nsExec.dll
          • Size 6KB
          • SHA256 370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          logo.png
          • Path C:\Users\Admin\AppData\Local\Temp\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\.ba1\logo.png
          • Size 1KB
          • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
          • MD5 SHA1 SHA512
          Submit Download

          wixstdba.dll
          • Path C:\Users\Admin\AppData\Local\Temp\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\.ba1\wixstdba.dll
          • Size 118KB
          • SHA256 a9295ad4e909f979e2b6cb2b2495c3d35c8517e689cd64a918c690e17b49078b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          c_media.PNF
          • Path C:\Windows\INF\c_media.PNF
          • Size 12KB
          • SHA256 feedfdacbcff878dd0f877736f880b045941e25cd3c4013357d4e2a293a1e7d8
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          dberr.txt
          • Path C:\Windows\System32\CatRoot2\dberr.txt
          • Size 148KB
          • SHA256 9ff8ca091054f1bea010a46e9427c0016431fb926f1c9087aea4e5a9169c881f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          DROIDC~1.SYS
          • Path \??\c:\PROGRA~2\droidcam\lib\DROIDC~1.SYS
          • Size 32KB
          • SHA256 381fbd51b799ba14e479b26c868fbe1a210e4d11285caf300873055f050c9b4f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          droidcam.sys
          • Path \??\c:\PROGRA~2\droidcam\lib\droidcam.sys
          • Size 31KB
          • SHA256 4faf45a52c2fe736b7656d306ad2a6bc1876c12fdbb20663e2f866f0d914bde3
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          droidcam.cat
          • Path \??\c:\program files (x86)\droidcam\lib\droidcam.cat
          • Size 10KB
          • SHA256 221487d538e1fda1cb54ce70ddea09f8a519e7112ef17b8bd504f483d9aa3952
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          droidcam.inf
          • Path \??\c:\program files (x86)\droidcam\lib\droidcam.inf
          • Size 2KB
          • SHA256 025334d19394c41c24211ed36635fdd9f027fc23b654a4c00fabb8ffca568171
          • MD5 SHA1 SHA512
          Submit Download

          droidcamvideo.cat
          • Path \??\c:\program files (x86)\droidcam\lib\droidcamvideo.cat
          • Size 10KB
          • SHA256 84a8687365e531d0e434464bde88ef458f1b04330b2086ab1256dc2094b33d34
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          droidcamvideo.inf
          • Path \??\c:\program files (x86)\droidcam\lib\droidcamvideo.inf
          • Size 3KB
          • SHA256 ba8ae153b8980e50320b4cbe790297aba97c1392068911cf2ec051a42dc4afa5
          • MD5 SHA1 SHA512
          Submit Download

          memory/2748-317-0x00000271CCBA0000-0x00000271CCBB0000-memory.dmp
          Download

          memory/2748-313-0x00000271CCB60000-0x00000271CCB70000-memory.dmp
          Download

          memory/2748-324-0x00000271D56D0000-0x00000271D56D1000-memory.dmp
          Download

          memory/2748-326-0x00000271D5750000-0x00000271D5751000-memory.dmp
          Download

          memory/2748-328-0x00000271D5750000-0x00000271D5751000-memory.dmp
          Download

          memory/2748-329-0x00000271D57E0000-0x00000271D57E1000-memory.dmp
          Download

          memory/2748-330-0x00000271D57E0000-0x00000271D57E1000-memory.dmp
          Download

          memory/2748-331-0x00000271D57E0000-0x00000271D57E1000-memory.dmp
          Download

          memory/2748-332-0x00000271D57E0000-0x00000271D57E1000-memory.dmp
          Download

          memory/2836-311-0x0000000073C80000-0x0000000073E4C000-memory.dmp
          Download

          memory/2836-310-0x0000000073BB0000-0x0000000073C78000-memory.dmp
          Download