Overview

overview

8

Static

static

3

DroidCam.S....3.exe

windows10-2004-x64

8

DroidCam.S....3.exe

windows11-21h2-x64

8

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows11-21h2-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows11-21h2-x64

3

DroidCamApp.exe

windows10-2004-x64

3

DroidCamApp.exe

windows11-21h2-x64

3

adb/AdbWinApi.dll

windows10-2004-x64

3

adb/AdbWinApi.dll

windows11-21h2-x64

3

adb/AdbWinUsbApi.dll

windows10-2004-x64

3

adb/AdbWinUsbApi.dll

windows11-21h2-x64

3

adb/adb.exe

windows10-2004-x64

3

adb/adb.exe

windows11-21h2-x64

3

lib/DroidC...32.dll

windows10-2004-x64

3

lib/DroidC...32.dll

windows11-21h2-x64

3

lib/insdrv.exe

windows10-2004-x64

3

lib/insdrv.exe

windows11-21h2-x64

3

plist.dll

windows10-2004-x64

3

plist.dll

windows11-21h2-x64

3

usbmuxd.dll

windows10-2004-x64

3

usbmuxd.dll

windows11-21h2-x64

3

vc_redist.x86.exe

windows10-2004-x64

4

vc_redist.x86.exe

windows11-21h2-x64

4

Analysis

  • max time kernel
    149s
  • max time network
    96s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    30/05/2026, 01:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    DroidCam.Setup.6.5.3.exe
  • Size 16.1MB
  • Sample260530-bvbvaacx7v
  • SHA256 9b5eb0b62cc60e63fe61a1f724d15d9e6bdc8493ec0dbe7610ecd5f9bb57783c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistenceprivilege_escalation

Malware Config

Signatures

  • Drops file in Drivers directory 5 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 9 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 32 IoCs
  • Drops file in Program Files directory 33 IoCs
  • Drops file in Windows directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 52 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DroidCam.Setup.6.5.3.exe
    "C:\Users\Admin\AppData\Local\Temp\DroidCam.Setup.6.5.3.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1556
    • C:\Program Files (x86)\DroidCam\vc_redist.x86.exe
      "C:\Program Files (x86)\DroidCam\vc_redist.x86.exe" /install /quiet
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4052
      • C:\Program Files (x86)\DroidCam\vc_redist.x86.exe
        "C:\Program Files (x86)\DroidCam\vc_redist.x86.exe" /install /quiet -burn.unelevated BurnPipe.{C3697BF6-B364-4738-8228-FEB57016CC5F} {90E3A9A2-4822-4AFE-AE0D-42EB16735F82} 4052
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4668
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c install.bat
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2180
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32 /s "DroidCamFilter32.ax"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:3328
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32 /s "DroidCamFilter64.ax"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4916
        • C:\Windows\system32\regsvr32.exe
          /s "DroidCamFilter64.ax"
          4⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:3532
    • C:\Program Files (x86)\DroidCam\lib\insdrv.exe
      "C:\Program Files (x86)\DroidCam\lib\insdrv.exe" +v
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:5504
    • C:\Program Files (x86)\DroidCam\lib\insdrv.exe
      "C:\Program Files (x86)\DroidCam\lib\insdrv.exe" +a
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:1356
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2936
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{f2f14769-a771-c140-9233-b28eeeda908d}\droidcamvideo.inf" "9" "41e7d49db" "0000000000000150" "WinSta0\Default" "0000000000000160" "208" "c:\program files (x86)\droidcam\lib"
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:5604
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:e57357445b5e8bf3:DroidCamVideo.Device:19.13.36.876:droidcamvideo," "41e7d49db" "0000000000000150" "c417"
      2⤵
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:5844
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{58d55ab9-c8d1-c74a-b35c-82d82d24beaf}\droidcam.inf" "9" "4e67c8bbf" "000000000000016C" "WinSta0\Default" "000000000000017C" "208" "c:\program files (x86)\droidcam\lib"
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:3204
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "2" "211" "ROOT\MEDIA\0001" "C:\Windows\INF\oem4.inf" "oem4.inf:ed86ca11f01d07d6:DroidCam_PCMEX:1.0.0.0:droidcam," "4e67c8bbf" "000000000000016C" "c417"
      2⤵
      • Drops file in Drivers directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:2868
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k CameraMonitor
    1⤵
      PID:2272

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          DroidCamApp.exe
          • Path C:\Program Files (x86)\DroidCam\DroidCamApp.exe
          • Size 1.0MB
          • SHA256 ca9db57a8458f476ecd78eb242ff72d5f17c87f3047bc6fe4802f2e92577533a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DroidCamFilter32.ax
          • Path C:\Program Files (x86)\DroidCam\lib\DroidCamFilter32.ax
          • Size 84KB
          • SHA256 ffb22ab7b98ecc98c22cf675bfab61c875127137277e1f66bc3d7269c3b42652
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DroidCamFilter64.ax
          • Path C:\Program Files (x86)\DroidCam\lib\DroidCamFilter64.ax
          • Size 157KB
          • SHA256 c85b89c5d77a8b41b1a8213783f3ebfcc2fbed959149c5e5ed0f48204d9c4d09
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          insdrv.exe
          • Path C:\Program Files (x86)\DroidCam\lib\insdrv.exe
          • Size 13KB
          • SHA256 d18438bf03d25002e5aa161669a7cb01d0b2c83d2fa5dc2f9217c3b656eb6b9f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          install.bat
          • Path C:\Program Files (x86)\DroidCam\lib\install.bat
          • Size 254B
          • SHA256 d7b86a37b02fed2794904cb28c0fa64a1e0d2218fab608250c8531c1b9ddc439
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          vc_redist.x86.exe
          • Path C:\Program Files (x86)\DroidCam\vc_redist.x86.exe
          • Size 13.1MB
          • SHA256 fdd1e1f0dcae2d0aa0720895eff33b927d13076e64464bb7c7e5843b7667cd14
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsa1F1D.tmp\System.dll
          • Size 11KB
          • SHA256 b80a5cba69d1853ed5979b0ca0352437bf368a5cfb86cb4528edadd410e11352
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          modern-wizard.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\nsa1F1D.tmp\modern-wizard.bmp
          • Size 25KB
          • SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nsDialogs.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsa1F1D.tmp\nsDialogs.dll
          • Size 9KB
          • SHA256 5157fe688cca27d348171bd5a8b117de348c0844ca5cb82bc68cbd7d873a3fdc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nsExec.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsa1F1D.tmp\nsExec.dll
          • Size 6KB
          • SHA256 370e47364561fa501b1300b056fb53fae12b1639fdf5f113275bee03546081c0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          logo.png
          • Path C:\Users\Admin\AppData\Local\Temp\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\.ba1\logo.png
          • Size 1KB
          • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          wixstdba.dll
          • Path C:\Users\Admin\AppData\Local\Temp\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\.ba1\wixstdba.dll
          • Size 118KB
          • SHA256 a9295ad4e909f979e2b6cb2b2495c3d35c8517e689cd64a918c690e17b49078b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          c_media.PNF
          • Path C:\Windows\INF\c_media.PNF
          • Size 12KB
          • SHA256 56e92c16886c56f1e684a749dad5951d8750ba2d4c794ac08b9871f926d8d30e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dberr.txt
          • Path C:\Windows\System32\CatRoot2\dberr.txt
          • Size 104KB
          • SHA256 c4877fc4f69511fa4015a962124fb91963c16748fd3b37c6274eb14dae167903
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DROIDC~1.SYS
          • Path \??\c:\PROGRA~2\droidcam\lib\DROIDC~1.SYS
          • Size 34KB
          • SHA256 54c9b29b003bf950c7f2cff6224cadb29cc8afe83a087b158fdf7c5ec9391149
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          droidcam.sys
          • Path \??\c:\PROGRA~2\droidcam\lib\droidcam.sys
          • Size 31KB
          • SHA256 4faf45a52c2fe736b7656d306ad2a6bc1876c12fdbb20663e2f866f0d914bde3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          droidcam.cat
          • Path \??\c:\program files (x86)\droidcam\lib\droidcam.cat
          • Size 10KB
          • SHA256 221487d538e1fda1cb54ce70ddea09f8a519e7112ef17b8bd504f483d9aa3952
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          droidcam.inf
          • Path \??\c:\program files (x86)\droidcam\lib\droidcam.inf
          • Size 2KB
          • SHA256 025334d19394c41c24211ed36635fdd9f027fc23b654a4c00fabb8ffca568171
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          droidcamvideo.cat
          • Path \??\c:\program files (x86)\droidcam\lib\droidcamvideo.cat
          • Size 11KB
          • SHA256 992666d2b6f2678b082189ec9d485e07bc34793542e7176d8598bf3560996e52
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          droidcamvideo.inf
          • Path \??\c:\program files (x86)\droidcam\lib\droidcamvideo.inf
          • Size 1KB
          • SHA256 6b44794d184720566ce0db3ea72593fee38e6b34c584554a87e6914e7e99250d
          • MD5 SHA1 SHA512 TLSH
          Submit Download