Resubmissions

19/08/2026, 21:46

260819-1mnasaw1as5

19/08/2026, 18:45

260819-xd41ds1bla5

Analysis

  • user interaction
    yes
  • max time kernel
    105s
  • max time network
    108s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    19/08/2026, 18:45

General

  • Target
    ScoobyLoader.exe
  • Size 7.8MB
  • Sample260819-xd41ds1bla
  • SHA256 8b0fe8fd8e785ed9dd22b5361f285a4cd8beeec33e3bbe407912ac297e374497
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
upx

Malware Config

Signatures

  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ScoobyLoader.exe
    "C:\Users\Admin\AppData\Local\Temp\ScoobyLoader.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:5032
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4272
    • C:\Users\Admin\AppData\Local\Temp\ScoobyLoader.exe
      "C:\Users\Admin\AppData\Local\Temp\ScoobyLoader.exe"
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:4876
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /7
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2308
    • C:\Windows\system32\werfault.exe
      werfault.exe /h /shared Global\fe8de4fabb0c4f74bcbaefd2aa6a547d /t 4828 /p 5032
      1⤵
        PID:1584

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            README.txt

            • Path C:\scooby\launcher\language\README.txt
            • Size 3KB
            • SHA256 27fa91278c096a7fababc0fe47f4943803e3d8ebfbbf980b67222d50de7859df
            • MD5 SHA1 SHA512 TLSH

            ar.json

            • Path C:\scooby\launcher\language\ar.json
            • Size 30KB
            • SHA256 95af706f01280a0417e30757ef0a7d833621cb3f28aa6be141cb91ddadcb4351
            • MD5 SHA1 SHA512 SSDEEP TLSH

            de.json

            • Path C:\scooby\launcher\language\de.json
            • Size 28KB
            • SHA256 b15a97b6f37fa3d1d82c79c118418e22477bedcdf7b3dfd07a2685f326277cb0
            • MD5 SHA1 SHA512 SSDEEP TLSH

            en.json

            • Path C:\scooby\launcher\language\en.json
            • Size 28KB
            • SHA256 8108f5c196d881d1395ee7d412f4e10fdb1bb9b6d91e7d0630d02d26ebbed8bf
            • MD5 SHA1 SHA512 SSDEEP TLSH

            es.json

            • Path C:\scooby\launcher\language\es.json
            • Size 28KB
            • SHA256 3d382b8380226dce2ce36df68cc6dadb3aea3329154c7f931ae18e84ebf51666
            • MD5 SHA1 SHA512 SSDEEP TLSH

            fr.json

            • Path C:\scooby\launcher\language\fr.json
            • Size 29KB
            • SHA256 bf591d67ab8d9bb1fbb4b9e7062bd8e18c0e925d1069582ba952cedd5fe6618e
            • MD5 SHA1 SHA512 SSDEEP TLSH

            he.json

            • Path C:\scooby\launcher\language\he.json
            • Size 29KB
            • SHA256 b8148c4545f486d9a202b523803327011af765a6ee29855a69d96fa6b1b27e85
            • MD5 SHA1 SHA512 SSDEEP TLSH

            id.json

            • Path C:\scooby\launcher\language\id.json
            • Size 28KB
            • SHA256 50f49e66c0fca2f4a1f3d072d4b9204f3b43818db4b888cadd0eeac9facece33
            • MD5 SHA1 SHA512 SSDEEP TLSH

            it.json

            • Path C:\scooby\launcher\language\it.json
            • Size 28KB
            • SHA256 8494ea92d61df320d6b243dfacecc5c7ea2713c0ac60ef1da53e020b5bfe6dcf
            • MD5 SHA1 SHA512 SSDEEP TLSH

            ja.json

            • Path C:\scooby\launcher\language\ja.json
            • Size 30KB
            • SHA256 6e8523f95380ccabecd3cb6633d3450cd16d3e6f567a3191c8df713e94bdc1c1
            • MD5 SHA1 SHA512 SSDEEP TLSH

            ka.json

            • Path C:\scooby\launcher\language\ka.json
            • Size 35KB
            • SHA256 0d50b030c563c6db169df29e609f97a5f80c2189163c0eb978f73733382af8b2
            • MD5 SHA1 SHA512 SSDEEP TLSH

            ko.json

            • Path C:\scooby\launcher\language\ko.json
            • Size 29KB
            • SHA256 680b12450c8c56d3359b9d070ec93c8b46f640f9c46be6e7d3287c7e6548fd15
            • MD5 SHA1 SHA512 SSDEEP TLSH

            language-template.json

            • Path C:\scooby\launcher\language\language-template.json
            • Size 28KB
            • SHA256 e0a47583f6538f46d719906ce915f179fbff63de8aae7ce00ae6179fa570bb4b
            • MD5 SHA1 SHA512 SSDEEP TLSH

            nl.json

            • Path C:\scooby\launcher\language\nl.json
            • Size 28KB
            • SHA256 8183378d0bbe1ae5765f6068999da025657b3489b114373f99c3bad18e897408
            • MD5 SHA1 SHA512 SSDEEP TLSH

            pl.json

            • Path C:\scooby\launcher\language\pl.json
            • Size 28KB
            • SHA256 84399b933cfcdb2457bd44dca2905921a03948d9f198cb344a023268defdaba0
            • MD5 SHA1 SHA512 SSDEEP TLSH

            pt.json

            • Path C:\scooby\launcher\language\pt.json
            • Size 28KB
            • SHA256 b9ad99c720889cc3940d604707b87dfbb0738e6954bb0839295764f11192ba1c
            • MD5 SHA1 SHA512 SSDEEP TLSH

            ru.json

            • Path C:\scooby\launcher\language\ru.json
            • Size 31KB
            • SHA256 c0ad6338aaa89710ba0aac870bae6f702ffb502a293478a5c0ec85ac2d74640a
            • MD5 SHA1 SHA512 SSDEEP TLSH

            th.json

            • Path C:\scooby\launcher\language\th.json
            • Size 34KB
            • SHA256 804d36b2f3ebf570b87042cb0d43b4b3fa9ee2aa1acb4a7dbadeb1e8c5a5d87d
            • MD5 SHA1 SHA512 SSDEEP TLSH

            vi.json

            • Path C:\scooby\launcher\language\vi.json
            • Size 29KB
            • SHA256 30b57ed74f59fdfa15eec147063d05b2e35ee4868a824733d9e009fe58986fe9
            • MD5 SHA1 SHA512 SSDEEP TLSH

            zh-CN.json

            • Path C:\scooby\launcher\language\zh-CN.json
            • Size 28KB
            • SHA256 c9973541832284534e7e61387af921f835997b7e160372ba6dd268c404193cda
            • MD5 SHA1 SHA512 SSDEEP TLSH

            memory/2308-108-0x0000021C7E960000-0x0000021C7E961000-memory.dmp

            memory/2308-118-0x0000021C7E960000-0x0000021C7E961000-memory.dmp

            memory/2308-116-0x0000021C7E960000-0x0000021C7E961000-memory.dmp

            memory/2308-117-0x0000021C7E960000-0x0000021C7E961000-memory.dmp

            memory/2308-119-0x0000021C7E960000-0x0000021C7E961000-memory.dmp

            memory/2308-115-0x0000021C7E960000-0x0000021C7E961000-memory.dmp

            memory/2308-110-0x0000021C7E960000-0x0000021C7E961000-memory.dmp

            memory/2308-120-0x0000021C7E960000-0x0000021C7E961000-memory.dmp

            memory/2308-109-0x0000021C7E960000-0x0000021C7E961000-memory.dmp

            memory/2308-114-0x0000021C7E960000-0x0000021C7E961000-memory.dmp

            memory/4876-105-0x00007FF623760000-0x00007FF624686000-memory.dmp

            memory/4876-81-0x00007FF623760000-0x00007FF624686000-memory.dmp

            memory/5032-54-0x00007FF623760000-0x00007FF624686000-memory.dmp

            memory/5032-107-0x00007FF623760000-0x00007FF624686000-memory.dmp

            memory/5032-78-0x00007FF623760000-0x00007FF624686000-memory.dmp

            memory/5032-77-0x000002818C7C0000-0x000002818C7C1000-memory.dmp

            memory/5032-121-0x00007FF623760000-0x00007FF624686000-memory.dmp

            memory/5032-122-0x00007FF623760000-0x00007FF624686000-memory.dmp

            memory/5032-124-0x00007FF623760000-0x00007FF624686000-memory.dmp