Analysis
- max time kernel
899s - max time network
464s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/08/2026, 12:38
Behavioral task
behavioral1
Sample
ScoobyLoader.exe
Resource
win10v2004-20260513-en
2 signatures
900 seconds
Behavioral task
behavioral2
Sample
ScoobyLoader.exe
Resource
win11ltsc2024-20260709-en
2 signatures
900 seconds
Behavioral task
behavioral3
Sample
out.exe
Resource
win10v2004-20260513-en
0 signatures
900 seconds
Behavioral task
behavioral4
Sample
out.exe
Resource
win11ltsc2024-20260709-en
0 signatures
900 seconds
General
- Target ScoobyLoader.exe
- Size 8.3MB
- Sample260822-pt8phsfa69
- SHA256 2a7d8c7d983d2d2084fd180c6d951dfb6e8c0d6a14f19f1aa63cdc25c3d12e5e
- MD5 a982f58296ead9ba5161c747d1318cc1
- SHA1 5938394c80e9e8346bd3eb91670e1f32dd9abbd3
- SHA512 cb747529a7f87db11a6554096d30c06a8e99dd96ecf13f83df84ea4a1de96452d168ae5c7d3ec96df80c8656f23c7d9a3d57634e98fb1d96ee0b3913fc3cc234
- SSDEEP 196608:0F/RbbowQ/Bxmp/jAv/kVhYpt3jnRvKHovQNUzKjB00EvqDU29Ofha:0FR5Kxmp/jopt3jRv1QmELBDUh
- TLSH T1989633CA009671A2E09BB570914BFCA1CA8A73B3AECC79644E13C2D71E795C2E753753
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2132-0-0x00007FF6821D0000-0x00007FF683190000-memory.dmp upx behavioral2/memory/2132-78-0x00007FF6821D0000-0x00007FF683190000-memory.dmp upx behavioral2/memory/2132-79-0x00007FF6821D0000-0x00007FF683190000-memory.dmp upx behavioral2/memory/2132-83-0x00007FF6821D0000-0x00007FF683190000-memory.dmp upx - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2132 ScoobyLoader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ScoobyLoader.exe"C:\Users\Admin\AppData\Local\Temp\ScoobyLoader.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:2132
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4488
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵PID:4000