File name:

DroidCam.Setup.6.5.2.exe

Full analysis: https://app.any.run/tasks/10909166-7bab-466f-9f60-9b50ca956579
Verdict: Malicious activity
Analysis date: November 30, 2023, 19:34:52
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

D952D907646A522CAF6EC5D00D114CE1

SHA1:

75AD9BACB60DED431058A50A220E22A35E3D03F7

SHA256:

F92AD1E92780A039397FD62D04AFFE97F1A65D04E7A41C9B5DA6DD3FD265967E

SSDEEP:

393216:oZsfK4YUD12zS7SEOegn4j7BgNE9O+wcDGFdClu8ZLzzpC4:gsfKPUD1kS7249O3cDGvClnlC4

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • DroidCam.Setup.6.5.2.exe (PID: 2864)
      • vc_redist.x86.exe (PID: 1128)
      • insdrv.exe (PID: 1064)
      • drvinst.exe (PID: 3776)

    • Creates a writable file in the system directory

      • drvinst.exe (PID: 3776)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • DroidCam.Setup.6.5.2.exe (PID: 2864)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • DroidCam.Setup.6.5.2.exe (PID: 2864)

    • Process drops legitimate windows executable

      • DroidCam.Setup.6.5.2.exe (PID: 2864)
      • vc_redist.x86.exe (PID: 1128)

    • Starts application with an unusual extension

      • DroidCam.Setup.6.5.2.exe (PID: 2864)

    • Application launched itself

      • vc_redist.x86.exe (PID: 1212)

    • Searches for installed software

      • vc_redist.x86.exe (PID: 1128)

    • Drops a system driver (possible attempt to evade defenses)

      • DroidCam.Setup.6.5.2.exe (PID: 2864)
      • insdrv.exe (PID: 1064)
      • drvinst.exe (PID: 3776)

    • Reads settings of System Certificates

      • rundll32.exe (PID: 3940)
      • insdrv.exe (PID: 1064)

    • Reads security settings of Internet Explorer

      • insdrv.exe (PID: 1064)

    • Checks Windows Trust Settings

      • insdrv.exe (PID: 1064)
      • drvinst.exe (PID: 3776)

    • Creates files in the driver directory

      • drvinst.exe (PID: 3776)

  • INFO

    • Reads the computer name

      • DroidCam.Setup.6.5.2.exe (PID: 2864)
      • vc_redist.x86.exe (PID: 1128)
      • vc_redist.x86.exe (PID: 1212)
      • insdrv.exe (PID: 1064)
      • drvinst.exe (PID: 3776)

    • Checks supported languages

      • DroidCam.Setup.6.5.2.exe (PID: 2864)
      • nsC7ED.tmp (PID: 1788)
      • vc_redist.x86.exe (PID: 1212)
      • vc_redist.x86.exe (PID: 1128)
      • nsCA4F.tmp (PID: 292)
      • insdrv.exe (PID: 1064)
      • drvinst.exe (PID: 3776)

    • Creates files in the program directory

      • DroidCam.Setup.6.5.2.exe (PID: 2864)

    • Create files in a temporary directory

      • DroidCam.Setup.6.5.2.exe (PID: 2864)
      • vc_redist.x86.exe (PID: 1128)
      • insdrv.exe (PID: 1064)

    • Reads the machine GUID from the registry

      • insdrv.exe (PID: 1064)
      • drvinst.exe (PID: 3776)

    • Reads security settings of Internet Explorer

      • rundll32.exe (PID: 3940)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:07:24 08:35:15+02:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 24576
InitializedDataSize: 118784
UninitializedDataSize: 1024
EntryPoint: 0x31bb
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
49
Monitored processes
9
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start droidcam.setup.6.5.2.exe nsc7ed.tmp no specs vc_redist.x86.exe no specs vc_redist.x86.exe no specs nsca4f.tmp no specs insdrv.exe no specs drvinst.exe no specs rundll32.exe no specs droidcam.setup.6.5.2.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
292"C:\Users\admin\AppData\Local\Temp\nsvE116.tmp\nsCA4F.tmp" "C:\Program Files\DroidCam\lib\insdrv.exe" +aC:\Users\admin\AppData\Local\Temp\nsvE116.tmp\nsCA4F.tmp—DroidCam.Setup.6.5.2.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nsve116.tmp\nsca4f.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
948"C:\Users\admin\AppData\Local\Temp\DroidCam.Setup.6.5.2.exe" C:\Users\admin\AppData\Local\Temp\DroidCam.Setup.6.5.2.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\droidcam.setup.6.5.2.exe
c:\windows\system32\ntdll.dll
1064"C:\Program Files\DroidCam\lib\insdrv.exe" +aC:\Program Files\DroidCam\lib\insdrv.exe—nsCA4F.tmp
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\droidcam\lib\insdrv.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1128"C:\Program Files\DroidCam\vc_redist.x86.exe" /install /quiet -burn.unelevated BurnPipe.{D008596F-E7BE-4B35-80F2-C9A95C17AC52} {E7E793CD-A870-467F-B008-E4C70F65C52E} 1212C:\Program Files\DroidCam\vc_redist.x86.exe—vc_redist.x86.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.23026
Exit code:
1638
Version:
14.0.23026.0
Modules
Images
c:\program files\droidcam\vc_redist.x86.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24542_none_5c0717c7a00ddc6d\gdiplus.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1212"C:\Program Files\DroidCam\vc_redist.x86.exe" /install /quietC:\Program Files\DroidCam\vc_redist.x86.exe—nsC7ED.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.23026
Exit code:
1638
Version:
14.0.23026.0
Modules
Images
c:\program files\droidcam\vc_redist.x86.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24542_none_5c0717c7a00ddc6d\gdiplus.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1788"C:\Users\admin\AppData\Local\Temp\nsvE116.tmp\nsC7ED.tmp" "C:\Program Files\DroidCam\vc_redist.x86.exe" /install /quietC:\Users\admin\AppData\Local\Temp\nsvE116.tmp\nsC7ED.tmp—DroidCam.Setup.6.5.2.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1638
Modules
Images
c:\users\admin\appdata\local\temp\nsve116.tmp\nsc7ed.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2864"C:\Users\admin\AppData\Local\Temp\DroidCam.Setup.6.5.2.exe" C:\Users\admin\AppData\Local\Temp\DroidCam.Setup.6.5.2.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\droidcam.setup.6.5.2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
3776DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{66f217bb-4949-4095-bfa8-927fa8607241}\droidcam.inf" "0" "6e67c8bbf" "0000054C" "WinSta0\Default" "00000578" "208" "c:\program files\droidcam\lib"C:\Windows\System32\drvinst.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
3940rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{0f9f5df3-6d6c-196b-0cc9-3f6bf41fee3d} Global\{6fe07ea6-7ebf-7fc9-b6bd-a93bab039335} C:\Windows\System32\DriverStore\Temp\{15f86cd9-3f55-2f82-ab71-d034fc847224}\droidcam.inf C:\Windows\System32\DriverStore\Temp\{15f86cd9-3f55-2f82-ab71-d034fc847224}\droidcam.catC:\Windows\System32\rundll32.exe—drvinst.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
Total events
11 358
Read events
11 322
Write events
36
Delete events
0

Modification events

(PID) Process:(1064) insdrv.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3776) drvinst.exeKey:HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\17F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3940) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
25
Suspicious files
5
Text files
36
Unknown types
0

Dropped files

PID
Process
Filename
Type
2864DroidCam.Setup.6.5.2.exeC:\Users\admin\AppData\Local\Temp\nsvE116.tmp\System.dllexecutable
MD5:C9473CB90D79A374B2BA6040CA16E45C
SHA256:B80A5CBA69D1853ED5979B0CA0352437BF368A5CFB86CB4528EDADD410E11352
2864DroidCam.Setup.6.5.2.exeC:\Users\admin\AppData\Local\Temp\nsvE116.tmp\nsExec.dllexecutable
MD5:0A6F707FA22C3F3E5D1ABB54B0894AD6
SHA256:370E47364561FA501B1300B056FB53FAE12B1639FDF5F113275BEE03546081C0
2864DroidCam.Setup.6.5.2.exeC:\Program Files\DroidCam\adb\adb.exeexecutable
MD5:3CB9F5E6FA7F2B9949F375F7F7AB2586
SHA256:634AB9882B5427A245BD139E5B7A2B5D10B24C4B50506257B5404C01882CCC02
2864DroidCam.Setup.6.5.2.exeC:\Program Files\DroidCam\plist.dllexecutable
MD5:AB595BC9A0F6F0D00B1F50A7E81AC5FB
SHA256:0A1E27CED2F8CE0314353C82F30EE8140FDE2E2725C4276390922930AAFCA773
2864DroidCam.Setup.6.5.2.exeC:\Program Files\DroidCam\adb\AdbWinUsbApi.dllexecutable
MD5:0E24119DAF1909E398FA1850B6112077
SHA256:25207C506D29C4E8DCEB61B4BD50E8669BA26012988A43FBF26A890B1E60FC97
2864DroidCam.Setup.6.5.2.exeC:\Users\admin\AppData\Local\Temp\nsvE116.tmp\nsC7ED.tmpexecutable
MD5:0A6F707FA22C3F3E5D1ABB54B0894AD6
SHA256:370E47364561FA501B1300B056FB53FAE12B1639FDF5F113275BEE03546081C0
2864DroidCam.Setup.6.5.2.exeC:\Program Files\DroidCam\Licence.txttext
MD5:6D6FDAD34E3230EC837F6661AB545129
SHA256:8558A2793108D6973D94B0D7475570D1FCECDC15F0D7EB1AA5515868AD03C64E
2864DroidCam.Setup.6.5.2.exeC:\Program Files\DroidCam\DroidCamApp.exeexecutable
MD5:F8C12FC1B20887FDB70C7F02F0D7BFB3
SHA256:082F5C3FD2FD80505CBD4DBDBB7C50E83C2E81F033A04EA53832DBF0A3FC4933
2864DroidCam.Setup.6.5.2.exeC:\Users\admin\AppData\Local\Temp\nsvE116.tmp\modern-wizard.bmpimage
MD5:CBE40FD2B1EC96DAEDC65DA172D90022
SHA256:3AD2DC318056D0A2024AF1804EA741146CFC18CC404649A44610CBF8B2056CF2
2864DroidCam.Setup.6.5.2.exeC:\Program Files\DroidCam\adb\AdbWinApi.dllexecutable
MD5:ED5A809DC0024D83CBAB4FB9933D598D
SHA256:D60103A5E99BC9888F786EE916F5D6E45493C3247972CB053833803DE7E95CF9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
5
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
DroidCam.Setup.6.5.2.exe