Overview
overview
3Static
static
3AVProVideo.dll
windows7-x64
1AVProVideo.dll
windows10-2004-x64
1ClientAPI.dll
windows7-x64
3ClientAPI.dll
windows10-2004-x64
3FastDllC.dll
windows7-x64
1FastDllC.dll
windows10-2004-x64
1GLES_CM.dll
windows7-x64
1GLES_CM.dll
windows10-2004-x64
1InstallUtils.dll
windows7-x64
3InstallUtils.dll
windows10-2004-x64
3KeyLib.dll
windows7-x64
3KeyLib.dll
windows10-2004-x64
3NISEC_Reg.exe
windows7-x64
1NISEC_Reg.exe
windows10-2004-x64
1Prndriver.dll
windows7-x64
1Prndriver.dll
windows10-2004-x64
1System.dll
windows7-x64
3System.dll
windows10-2004-x64
3TWAIN.dll
windows7-x64
1TWAIN.dll
windows10-2004-x64
1ZfUninstall.dll
windows7-x64
1ZfUninstall.dll
windows10-2004-x64
3_CD91326D3...24.dll
windows7-x64
1_CD91326D3...24.dll
windows10-2004-x64
1_DC6FF09E2...49.exe
windows7-x64
1_DC6FF09E2...49.exe
windows10-2004-x64
1ldcam.exe
windows7-x64
1ldcam.exe
windows10-2004-x64
1setup.exe
windows7-x64
1setup.exe
windows10-2004-x64
1sharp-win32-ia32.dll
windows7-x64
1sharp-win32-ia32.dll
windows10-2004-x64
1Analysis
-
max time kernel
134s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 03:24
Static task
static1
Behavioral task
behavioral1
Sample
AVProVideo.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral2
Sample
AVProVideo.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
ClientAPI.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral4
Sample
ClientAPI.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
FastDllC.dll
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral6
Sample
FastDllC.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
GLES_CM.dll
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral8
Sample
GLES_CM.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
InstallUtils.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral10
Sample
InstallUtils.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
KeyLib.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral12
Sample
KeyLib.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
NISEC_Reg.exe
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral14
Sample
NISEC_Reg.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Prndriver.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral16
Sample
Prndriver.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
System.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral18
Sample
System.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
TWAIN.dll
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral20
Sample
TWAIN.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
ZfUninstall.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral22
Sample
ZfUninstall.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
_CD91326D388BE567C448CC259CA3C124.dll
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral24
Sample
_CD91326D388BE567C448CC259CA3C124.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
_DC6FF09E203CC5D0099C0F5FF2B3DA49.exe
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral26
Sample
_DC6FF09E203CC5D0099C0F5FF2B3DA49.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
ldcam.exe
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral28
Sample
ldcam.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
setup.exe
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral30
Sample
setup.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
sharp-win32-ia32.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral32
Sample
sharp-win32-ia32.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
General
-
Target
ldcam.exe
-
Size
62KB
-
MD5
832e414be4efb8b8eca4f23944189f7c
-
SHA1
67d3ccce9c41803750fec87598753bf220d75d16
-
SHA256
177d1ae0021a40f29f037b0245228a3b952508d04a3b0205b287e5fa7da9bf2e
-
SHA512
a17bc90785ec8266adedf695750d1423e6b198451353c70f8a4f8182db5534c0647e34f9bb5b44bbd4121c2dbadb2ab60e185e7e00d1071b490f87f735f0c954
-
SSDEEP
1536:7YlEdOKLttYKlRRgxj8MyqLxZvLg4+I2XHN7TPxV9sK7h9zPx/:7iEdOOttYKlRRg93yCgrI23NfxzsKbbR
Malware Config
Signatures
-
Modifies registry class 18 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.jpeg ldcam.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.jpe ldcam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.gif\Source Filter = "{7DF62B50-6843-11D2-9EEB-006008039E37}" ldcam.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.tga ldcam.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.bmp ldcam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.dib\Source Filter = "{7DF62B50-6843-11D2-9EEB-006008039E37}" ldcam.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.jpg ldcam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.jpg\Source Filter = "{7DF62B50-6843-11D2-9EEB-006008039E37}" ldcam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.jpeg\Source Filter = "{7DF62B50-6843-11D2-9EEB-006008039E37}" ldcam.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.jfif ldcam.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.gif ldcam.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions ldcam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.jfif\Source Filter = "{7DF62B50-6843-11D2-9EEB-006008039E37}" ldcam.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CC58E281-8AA1-11D1-B3F1-00AA003761C5} ldcam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.bmp\Source Filter = "{7DF62B50-6843-11D2-9EEB-006008039E37}" ldcam.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.dib ldcam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.jpe\Source Filter = "{7DF62B50-6843-11D2-9EEB-006008039E37}" ldcam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.tga\Source Filter = "{7DF62B50-6843-11D2-9EEB-006008039E37}" ldcam.exe