26e6c0931517c370b0847c75642fcdaadc1ac0e54f216819c279d41e937533a1

Analysis

max time kernel
150s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Downloader.Win32.Qoologic.ad.exe
Size 206KB
Sample261006-pc65csxz4m
SHA256 26e6c0931517c370b0847c75642fcdaadc1ac0e54f216819c279d41e937533a1
MD5 41056bbef609e66d27b293f9ac1717b3
SHA1 3f4f080514d11483f936c6ee4b5d0202880a8ee2
SHA512 8e1abea84ccf7e14121ac1b804314dfd11e4213c91e48b5b41bb951ed9812d9226f4e74e9df0c3af807aee04c78e96c49a4bf01a16073a3c91cbea0f4176d373
SSDEEP 6144:B+rnv69/8NDflRV9Wj+yUcA9RJ0XxvtSu:YryhkfSj+yUtw/
TLSH
T19824E157BD80C8BBCCC68A7002E49E16EB77C13155F0C117DAB4499EBCA7A64693E387
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware aspackv2 bootkit discovery persistence spyware stealer

Malware Config

Signatures

ASPack v2.12-2.42 5 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c4df-3.dat	aspack_v212_v242
behavioral2/files/0x000d00000001c4e3-23.dat	aspack_v212_v242
behavioral2/files/0x000d00000001c4eb-24.dat	aspack_v212_v242
behavioral2/files/0x000d00000001c4e9-37.dat	aspack_v212_v242
behavioral2/files/0x000d00000001c4ea-39.dat	aspack_v212_v242

Executes dropped EXE 2 IoCs

pid	Process
5584	f240703171.exe
6036	ksg4sx.exe

Loads dropped DLL 3 IoCs

pid	Process
5584	f240703171.exe
1968	regsvr32.exe
6036	ksg4sx.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winsync = "C:\\Windows\\system32\\ksg4sx.exe reg_run"	f240703171.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winsync = "C:\\Windows\\system32\\ksg4sx.exe reg_run"	ksg4sx.exe

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	jaffacakes118_Trojan-Downloader.Win32.Qoologic.ad.exe

Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	jaffacakes118_Trojan-Downloader.Win32.Qoologic.ad.exe
File opened for modification	\??\PhysicalDrive0	f240703171.exe
File opened for modification	\??\PhysicalDrive0	ksg4sx.exe

Drops file in System32 directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ksg4sx.exe	ksg4sx.exe
File created	C:\Windows\SysWOW64\qkabk.dat	ksg4sx.exe
File opened for modification	C:\Windows\SysWOW64\dsjksfs.dll	ksg4sx.exe
File created	C:\Windows\SysWOW64\ksg4sx.exe	f240703171.exe
File created	C:\Windows\SysWOW64\dsjksfs.dll	f240703171.exe
File created	C:\Windows\SysWOW64\conres.cpl	jaffacakes118_Trojan-Downloader.Win32.Qoologic.ad.exe
File opened for modification	C:\Windows\SysWOW64\cmnrmxa.exe	ksg4sx.exe
File opened for modification	C:\Windows\SysWOW64\danoa.dll	ksg4sx.exe
File created	C:\Windows\SysWOW64\datadx.dll	jaffacakes118_Trojan-Downloader.Win32.Qoologic.ad.exe
File created	C:\Windows\SysWOW64\qkabk.dat	f240703171.exe
File opened for modification	C:\Windows\SysWOW64\ksg4sx.exe	f240703171.exe
File created	C:\Windows\SysWOW64\cmnrmxa.exe	f240703171.exe
File created	C:\Windows\SysWOW64\danoa.dll	f240703171.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\einyi.dll	f240703171.exe
File opened for modification	C:\Windows\einyi.dll	f240703171.exe
File created	C:\Windows\tmpf395s.tmp	jaffacakes118_Trojan-Downloader.Win32.Qoologic.ad.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2836	1968	WerFault.exe	91

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ksg4sx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Downloader.Win32.Qoologic.ad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f240703171.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	f240703171.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	f240703171.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ksg4sx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ksg4sx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	ksg4sx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	jaffacakes118_Trojan-Downloader.Win32.Qoologic.ad.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	jaffacakes118_Trojan-Downloader.Win32.Qoologic.ad.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	f240703171.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	ksg4sx.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	jaffacakes118_Trojan-Downloader.Win32.Qoologic.ad.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	jaffacakes118_Trojan-Downloader.Win32.Qoologic.ad.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	f240703171.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar	jaffacakes118_Trojan-Downloader.Win32.Qoologic.ad.exe

Modifies registry class 22 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3fa12cf9-5280-49c8-8a6c-c24e9bf0f9af}\InProcServer32\ = "C:\\Windows\\SysWow64\\danoa.dll"	ksg4sx.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3fa12cf9-5280-49c8-8a6c-c24e9bf0f9af}\InProcServer32\ThreadingModel = "Apartment"	ksg4sx.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\gxntxsyq	ksg4sx.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	jaffacakes118_Trojan-Downloader.Win32.Qoologic.ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{b8f8958d-ffef-4dc6-a68e-62807151b90f}	f240703171.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{b8f8958d-ffef-4dc6-a68e-62807151b90f}\ = "rreurfxi.class"	f240703171.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{b8f8958d-ffef-4dc6-a68e-62807151b90f}\InProcServer32\ThreadingModel = "Apartment"	f240703171.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\gxntxsyq	f240703171.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3fa12cf9-5280-49c8-8a6c-c24e9bf0f9af}\ = "rreurfxi.class"	ksg4sx.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3fa12cf9-5280-49c8-8a6c-c24e9bf0f9af}\ProgId\ = "rreurfxi.class"	ksg4sx.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	jaffacakes118_Trojan-Downloader.Win32.Qoologic.ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3fa12cf9-5280-49c8-8a6c-c24e9bf0f9af}	ksg4sx.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\gxntxsyq\ = "{b8f8958d-ffef-4dc6-a68e-62807151b90f}"	f240703171.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\InprocServer32	jaffacakes118_Trojan-Downloader.Win32.Qoologic.ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{b8f8958d-ffef-4dc6-a68e-62807151b90f}\ProgId	f240703171.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{b8f8958d-ffef-4dc6-a68e-62807151b90f}\ProgId\ = "rreurfxi.class"	f240703171.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3fa12cf9-5280-49c8-8a6c-c24e9bf0f9af}\ProgId	ksg4sx.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\gxntxsyq\ = "{3fa12cf9-5280-49c8-8a6c-c24e9bf0f9af}"	ksg4sx.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\InprocServer32	jaffacakes118_Trojan-Downloader.Win32.Qoologic.ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{b8f8958d-ffef-4dc6-a68e-62807151b90f}\InProcServer32	f240703171.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{b8f8958d-ffef-4dc6-a68e-62807151b90f}\InProcServer32\ = "C:\\Windows\\SysWow64\\danoa.dll"	f240703171.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3fa12cf9-5280-49c8-8a6c-c24e9bf0f9af}\InProcServer32	ksg4sx.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2844	jaffacakes118_Trojan-Downloader.Win32.Qoologic.ad.exe
2844	jaffacakes118_Trojan-Downloader.Win32.Qoologic.ad.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 5584	2844	jaffacakes118_Trojan-Downloader.Win32.Qoologic.ad.exe	90
PID 2844 wrote to memory of 1968	2844	jaffacakes118_Trojan-Downloader.Win32.Qoologic.ad.exe	91
PID 5584 wrote to memory of 6036	5584	f240703171.exe	92

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Downloader.Win32.Qoologic.ad.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Downloader.Win32.Qoologic.ad.exe"
1⤵
- Installs/modifies Browser Helper Object
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Users\Admin\AppData\Local\Temp\f240703171.exe
  "C:\Users\Admin\AppData\Local\Temp\f240703171.exe" first_run
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Writes to the Master Boot Record (MBR)
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5584
- - C:\Windows\SysWOW64\ksg4sx.exe
    first_run
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Writes to the Master Boot Record (MBR)
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Modifies registry class
    PID:6036
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s C:\Windows\system32\datadx.dll
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1968
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 552
    3⤵
    - Program crash
    PID:2836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1968 -ip 1968
1⤵
PID:3348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

f240703171.exe

Path C:\Users\Admin\AppData\Local\Temp\f240703171.exe
Size 90KB
SHA256 c46248c4b480a1149501249aa8c0576d7f8afc0f68b538d04e3214ba36f206bc
MD5 f2539883a503c51d8d2fd922ebf99bec
SHA1 f1511e1514be9def6fefd6c5ef1e556d146d46e2
SHA512 e0e72b64009c0e4e843b192defb7bfa63ecad1f3aef6a26d7f7c606c2aa437fbd08f2cc3fa03a90cf95f0b2936e5d7b87f5afbc73c47ae8426a20dfaac302d85
SSDEEP 1536:D6VbzLskFXbmooNuaw9BgwVzsfUImk1sKgSRV9cA8dewaFvKt8L5:D69zLvXbANUZ4f9BpRV9Wew+yt8L
TLSH
T1449302AEB9AE0DBED9C6523217915E1686338030347AC85B51B659F4BCBF4163CB318A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cmnrmxa.exe

Path C:\Windows\SysWOW64\cmnrmxa.exe
Size 18KB
SHA256 e9573eaaefb2e64db25f7b403204bd78276f91dad66460e336536f3384662a12
MD5 d4829e8f778b1218f562bb806ad060bb
SHA1 52d2b6167bb736bda13e59c541bd7087b6d86dba
SHA512 7d869b03c6c2359263fa8bea85a5ac93d2d7920f9ff3a466443f93092f8beb9c844e774bafe1f15818beb81870d0e4811c42ae24d9197d4072a82630f20af6c0
SSDEEP 384:DV4mboZG9XmSqNdsNb2ReUBRxsGwAxor6+S9Pfu7n5:DV4I2SSsNbKeU5Tx/deV
TLSH
T16882C164BE6948FFC4CE217A20520606C63D8DA545FF56D3A3A28D8E3CAE41CCC455F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

danoa.dll

Path C:\Windows\SysWOW64\danoa.dll
Size 10KB
SHA256 e54e659cbf3fa3f77e4d810866d9b675339ffc63db690e7c5e9cdd90a59d536d
MD5 faf278f88e545532e9058fe3d3b86061
SHA1 e2ef17887aa899e03dc981e1c5383f2c3ff29d0c
SHA512 a3b82b68ec3ea38c79be44c2be4d344a8dc8d9c67adc1de3700eadc83413e8fbe8c7e18ae6538d81c00fb8733925b9a97532a1bd4db353a8dd62667ee637b9c0
SSDEEP 192:9aA3Es+S61nJcJKi9vAUck9hP0IAx4wCMrpY7S8LqPZo5LdCfuR1nuO3T:TOS6pJcJKi9NAx4r6+S9Pfu7n5T
TLSH
T1F4225C67EE784DF6C0CF213205892C6BDB7AC92B857281B353F544DF388A03DE568652
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

datadx.dll

Path C:\Windows\SysWOW64\datadx.dll
Size 29KB
SHA256 d63ee624ac8eeef35b52351484be1d2601fb76ce0f39fed73fa4ae251c9df065
MD5 501320696427d32bcf4aceef30634b32
SHA1 40b6e06833b6584628fc4540719e657bb667e6b5
SHA512 4bf875be314ed41901445816976852b7ffe18bbef3111238c835fc252edb038890826f6001cbdc2d1df5654ab8ab793197792aec6a4a9bc0e9db0df807444493
SSDEEP 768:ywCymFLEeei5O/WfPcIZstQJle9jm/Gx3deVc:ywReXX5OOcQle9vp
TLSH
T112D2BE67BC4040FAC9C62B7586B84C5675BB816B4BF181648CCC852FFE0B9A8D53F792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dsjksfs.dll

Path C:\Windows\SysWOW64\dsjksfs.dll
Size 45KB
SHA256 acae3d43156635bd16b2e5ee194bd0666300a7f781e37e8e3af63f1bf2c2f774
MD5 88535bbfa373066f26e52fd70dc570a3
SHA1 5468b538d12f5efe135535a60d31e76259c9bffd
SHA512 4a1487a19a83838f3c798e8b2893c3c18940c761d70d6a7ebe5477f9268bdfba2ddc43da1eb328b2d527dba8c56265564661439b4e8b3daba959c3384f4595cb
SSDEEP 768:bJnziezzqK8rabxhC78nUcQRY9kitBQdO5lgRecfi5iRIxmNBr5JSth693HlvrxW:NzPzqTs278TQIQd4lgxrIajlt
TLSH
T12023BF83FCC545FBE0EA16309C6659685B33D6548EF28F628EDC475DAE4F3468839382
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

einyi.dll

Path C:\Windows\einyi.dll
Size 33B
SHA256 1f7bc188570973a9bd37b9e5599885fccb4741c112ccf667f26f22a2994a8f61
MD5 efa2511b6afefdc93cb2c326b689fbe1
SHA1 2561afaad1b9a4628a350f21f5b1e93831610d66
SHA512 1ee6ab27905e5770e110f18d147c0da6ff1b7b1a348456aaa92ed080d8241444a2e033293031bd4f0d101925ce6751f8090104bea907fedd00a421c19e39af4e
MD5 SHA1 SHA512

Submit Download

memory/1968-33-0x0000000010000000-0x0000000010011000-memory.dmp

Download

memory/5584-9-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/5584-27-0x0000000010000000-0x0000000010008000-memory.dmp

Download

memory/5584-34-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/6036-47-0x0000000000400000-0x000000000042D000-memory.dmp

Download