Overview

overview

8

Static

static

3

DroidCam.S....3.exe

windows10-2004-x64

8

DroidCam.S....3.exe

windows11-21h2-x64

8

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows11-21h2-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows11-21h2-x64

3

DroidCamApp.exe

windows10-2004-x64

3

DroidCamApp.exe

windows11-21h2-x64

3

adb/AdbWinApi.dll

windows10-2004-x64

3

adb/AdbWinApi.dll

windows11-21h2-x64

3

adb/AdbWinUsbApi.dll

windows10-2004-x64

3

adb/AdbWinUsbApi.dll

windows11-21h2-x64

3

adb/adb.exe

windows10-2004-x64

3

adb/adb.exe

windows11-21h2-x64

3

lib/DroidC...32.dll

windows10-2004-x64

3

lib/DroidC...32.dll

windows11-21h2-x64

3

lib/insdrv.exe

windows10-2004-x64

3

lib/insdrv.exe

windows11-21h2-x64

3

plist.dll

windows10-2004-x64

3

plist.dll

windows11-21h2-x64

3

usbmuxd.dll

windows10-2004-x64

3

usbmuxd.dll

windows11-21h2-x64

3

vc_redist.x86.exe

windows10-2004-x64

4

vc_redist.x86.exe

windows11-21h2-x64

4

Analysis

  • user interaction
    yes
  • max time kernel
    112s
  • max time network
    97s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    30/05/2026, 01:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    DroidCam.Setup.6.5.3.exe
  • Size 16.1MB
  • Sample260530-bvbvaacx7v
  • SHA256 9b5eb0b62cc60e63fe61a1f724d15d9e6bdc8493ec0dbe7610ecd5f9bb57783c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistenceprivilege_escalation

Malware Config

Signatures

  • Drops file in Drivers directory 5 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 9 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 32 IoCs
  • Drops file in Program Files directory 33 IoCs
  • Drops file in Windows directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DroidCam.Setup.6.5.3.exe
    "C:\Users\Admin\AppData\Local\Temp\DroidCam.Setup.6.5.3.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1952
    • C:\Program Files (x86)\DroidCam\vc_redist.x86.exe
      "C:\Program Files (x86)\DroidCam\vc_redist.x86.exe" /install /quiet
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4600
      • C:\Program Files (x86)\DroidCam\vc_redist.x86.exe
        "C:\Program Files (x86)\DroidCam\vc_redist.x86.exe" /install /quiet -burn.unelevated BurnPipe.{029EF5E0-37A3-411F-8ACB-8398199BDFF5} {0F626EE9-822C-4014-902E-4D0D3F8F86CC} 4600
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4896
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c install.bat
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2820
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32 /s "DroidCamFilter32.ax"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:3248
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32 /s "DroidCamFilter64.ax"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3208
        • C:\Windows\system32\regsvr32.exe
          /s "DroidCamFilter64.ax"
          4⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:2452
    • C:\Program Files (x86)\DroidCam\lib\insdrv.exe
      "C:\Program Files (x86)\DroidCam\lib\insdrv.exe" +v
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:3396
    • C:\Program Files (x86)\DroidCam\lib\insdrv.exe
      "C:\Program Files (x86)\DroidCam\lib\insdrv.exe" +a
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:2872
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2564
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{5db7bf6b-f5a4-554a-aa2f-4cd11bb52bab}\droidcamvideo.inf" "9" "41e7d49db" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "c:\program files (x86)\droidcam\lib"
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:1616
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:e57357445b5e8bf3:DroidCamVideo.Device:19.13.36.876:droidcamvideo," "41e7d49db" "0000000000000148"
      2⤵
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:3796
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{857dcdc5-256b-2e4e-aa32-fb2c3a7709e7}\droidcam.inf" "9" "4e67c8bbf" "0000000000000170" "WinSta0\Default" "0000000000000178" "208" "c:\program files (x86)\droidcam\lib"
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:1236
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "2" "211" "ROOT\MEDIA\0001" "C:\Windows\INF\oem4.inf" "oem4.inf:ed86ca11f01d07d6:DroidCam_PCMEX:1.0.0.0:droidcam," "4e67c8bbf" "0000000000000170"
      2⤵
      • Drops file in Drivers directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:4584

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        DroidCamApp.exe
        • Path C:\Program Files (x86)\DroidCam\DroidCamApp.exe
        • Size 1.0MB
        • SHA256 ca9db57a8458f476ecd78eb242ff72d5f17c87f3047bc6fe4802f2e92577533a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DroidCamFilter32.ax
        • Path C:\Program Files (x86)\DroidCam\lib\DroidCamFilter32.ax
        • Size 84KB
        • SHA256 ffb22ab7b98ecc98c22cf675bfab61c875127137277e1f66bc3d7269c3b42652
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DroidCamFilter64.ax
        • Path C:\Program Files (x86)\DroidCam\lib\DroidCamFilter64.ax
        • Size 157KB
        • SHA256 c85b89c5d77a8b41b1a8213783f3ebfcc2fbed959149c5e5ed0f48204d9c4d09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        insdrv.exe
        • Path C:\Program Files (x86)\DroidCam\lib\insdrv.exe
        • Size 13KB
        • SHA256 d18438bf03d25002e5aa161669a7cb01d0b2c83d2fa5dc2f9217c3b656eb6b9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        install.bat
        • Path C:\Program Files (x86)\DroidCam\lib\install.bat
        • Size 254B
        • SHA256 d7b86a37b02fed2794904cb28c0fa64a1e0d2218fab608250c8531c1b9ddc439
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        vc_redist.x86.exe
        • Path C:\Program Files (x86)\DroidCam\vc_redist.x86.exe
        • Size 13.1MB
        • SHA256 fdd1e1f0dcae2d0aa0720895eff33b927d13076e64464bb7c7e5843b7667cd14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsx2566.tmp\System.dll
        • Size 11KB
        • SHA256 b80a5cba69d1853ed5979b0ca0352437bf368a5cfb86cb4528edadd410e11352
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        modern-wizard.bmp
        • Path C:\Users\Admin\AppData\Local\Temp\nsx2566.tmp\modern-wizard.bmp
        • Size 25KB
        • SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nsDialogs.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsx2566.tmp\nsDialogs.dll
        • Size 9KB
        • SHA256 5157fe688cca27d348171bd5a8b117de348c0844ca5cb82bc68cbd7d873a3fdc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nsExec.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsx2566.tmp\nsExec.dll
        • Size 6KB
        • SHA256 370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        logo.png
        • Path C:\Users\Admin\AppData\Local\Temp\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\.ba1\logo.png
        • Size 1KB
        • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        wixstdba.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\.ba1\wixstdba.dll
        • Size 118KB
        • SHA256 a9295ad4e909f979e2b6cb2b2495c3d35c8517e689cd64a918c690e17b49078b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        c_media.PNF
        • Path C:\Windows\INF\c_media.PNF
        • Size 12KB
        • SHA256 feedfdacbcff878dd0f877736f880b045941e25cd3c4013357d4e2a293a1e7d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dberr.txt
        • Path C:\Windows\System32\CatRoot2\dberr.txt
        • Size 37KB
        • SHA256 fb2742fe163b72141143c1ec8a9174c511182aac55067fe35904d0e54954a2ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DROIDC~1.SYS
        • Path \??\c:\PROGRA~2\droidcam\lib\DROIDC~1.SYS
        • Size 34KB
        • SHA256 54c9b29b003bf950c7f2cff6224cadb29cc8afe83a087b158fdf7c5ec9391149
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        droidcam.sys
        • Path \??\c:\PROGRA~2\droidcam\lib\droidcam.sys
        • Size 31KB
        • SHA256 4faf45a52c2fe736b7656d306ad2a6bc1876c12fdbb20663e2f866f0d914bde3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        droidcam.cat
        • Path \??\c:\program files (x86)\droidcam\lib\droidcam.cat
        • Size 10KB
        • SHA256 221487d538e1fda1cb54ce70ddea09f8a519e7112ef17b8bd504f483d9aa3952
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        droidcam.inf
        • Path \??\c:\program files (x86)\droidcam\lib\droidcam.inf
        • Size 2KB
        • SHA256 025334d19394c41c24211ed36635fdd9f027fc23b654a4c00fabb8ffca568171
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        droidcamvideo.cat
        • Path \??\c:\program files (x86)\droidcam\lib\droidcamvideo.cat
        • Size 11KB
        • SHA256 992666d2b6f2678b082189ec9d485e07bc34793542e7176d8598bf3560996e52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        droidcamvideo.inf
        • Path \??\c:\program files (x86)\droidcam\lib\droidcamvideo.inf
        • Size 1KB
        • SHA256 6b44794d184720566ce0db3ea72593fee38e6b34c584554a87e6914e7e99250d
        • MD5 SHA1 SHA512 TLSH
        Submit Download