8690f61ee4463bae42f378e2df308335b2bcc9b58a46a4829bef08a3d67c61b5

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 12:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Downloader.Win32.Qoologic.z.exe
Size 62KB
Sample261006-pd3tbsf19v
SHA256 8690f61ee4463bae42f378e2df308335b2bcc9b58a46a4829bef08a3d67c61b5
MD5 89ae31aaf2bac3881161e87fac903956
SHA1 066376b8922bb395d28b2d0cbc5d26df3347b85b
SHA512 4654d0fbecee05537b48f3c65d8c67b2fc5be2161e012fcac620020e9176d66eefc382e26c1b2863d63bd49b485b0f857b01e4830c9f82f91d50c77adafee530
SSDEEP 768:OIALiCGnd31S1zSntO/CCeFD1p77rcxmORjuhDxeJdaGrSyrvFu9EguaCaSq4Icz:WLiv3S1zfvHyCe3UAkl76qUh3iYP4
TLSH
T1E65301AACEAB44DFD15B363933E400051E3D637699C0979B689D013B259843BA62EDE2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

aspackv2 bootkit discovery persistence

Malware Config

Signatures

ASPack v2.12-2.42 4 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x001a00000001c433-7.dat	aspack_v212_v242
behavioral2/files/0x000400000001b85a-11.dat	aspack_v212_v242
behavioral2/files/0x000c00000001b86f-18.dat	aspack_v212_v242
behavioral2/files/0x000500000001b800-16.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3244	rmmmnu.exe

Loads dropped DLL 2 IoCs

pid	Process
1192	jaffacakes118_Trojan-Downloader.Win32.Qoologic.z.exe
3244	rmmmnu.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\KavSvc = "C:\\Windows\\system32\\rmmmnu.exe reg_run"	rmmmnu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\KavSvc = "C:\\Windows\\system32\\rmmmnu.exe reg_run"	jaffacakes118_Trojan-Downloader.Win32.Qoologic.z.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	jaffacakes118_Trojan-Downloader.Win32.Qoologic.z.exe
File opened for modification	\??\PhysicalDrive0	rmmmnu.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rmmmnu.exe	jaffacakes118_Trojan-Downloader.Win32.Qoologic.z.exe
File created	C:\Windows\SysWOW64\crrrodn.exe	jaffacakes118_Trojan-Downloader.Win32.Qoologic.z.exe
File created	C:\Windows\SysWOW64\qbbbv.dat	rmmmnu.exe
File created	C:\Windows\SysWOW64\rmmmnu.exe	rmmmnu.exe
File opened for modification	C:\Windows\SysWOW64\crrrodn.exe	rmmmnu.exe
File created	C:\Windows\SysWOW64\qbbbv.dat	jaffacakes118_Trojan-Downloader.Win32.Qoologic.z.exe
File created	C:\Windows\SysWOW64\phhhgoi.dll	jaffacakes118_Trojan-Downloader.Win32.Qoologic.z.exe
File created	C:\Windows\SysWOW64\cpppd.dll	jaffacakes118_Trojan-Downloader.Win32.Qoologic.z.exe
File opened for modification	C:\Windows\SysWOW64\phhhgoi.dll	rmmmnu.exe
File opened for modification	C:\Windows\SysWOW64\cpppd.dll	rmmmnu.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Downloader.Win32.Qoologic.z.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmmmnu.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	jaffacakes118_Trojan-Downloader.Win32.Qoologic.z.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	jaffacakes118_Trojan-Downloader.Win32.Qoologic.z.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	jaffacakes118_Trojan-Downloader.Win32.Qoologic.z.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	rmmmnu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	jaffacakes118_Trojan-Downloader.Win32.Qoologic.z.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rmmmnu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rmmmnu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rmmmnu.exe

Modifies registry class 18 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{dc391cd1-9d32-4c41-ae28-69de6229d465}\InProcServer32\ = "C:\\Windows\\SysWow64\\cpppd.dll"	jaffacakes118_Trojan-Downloader.Win32.Qoologic.z.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{dc391cd1-9d32-4c41-ae28-69de6229d465}\InProcServer32\ThreadingModel = "Apartment"	jaffacakes118_Trojan-Downloader.Win32.Qoologic.z.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{60f289f2-017a-411f-917a-2955cc0fff61}\ProgId	rmmmnu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\gtttqmnq\ = "{60f289f2-017a-411f-917a-2955cc0fff61}"	rmmmnu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{dc391cd1-9d32-4c41-ae28-69de6229d465}\InProcServer32	jaffacakes118_Trojan-Downloader.Win32.Qoologic.z.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{dc391cd1-9d32-4c41-ae28-69de6229d465}\ProgId	jaffacakes118_Trojan-Downloader.Win32.Qoologic.z.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\gtttqmnq	jaffacakes118_Trojan-Downloader.Win32.Qoologic.z.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\gtttqmnq\ = "{dc391cd1-9d32-4c41-ae28-69de6229d465}"	jaffacakes118_Trojan-Downloader.Win32.Qoologic.z.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\gtttqmnq	rmmmnu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{60f289f2-017a-411f-917a-2955cc0fff61}\ = "ruuuioei.class"	rmmmnu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{dc391cd1-9d32-4c41-ae28-69de6229d465}	jaffacakes118_Trojan-Downloader.Win32.Qoologic.z.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{dc391cd1-9d32-4c41-ae28-69de6229d465}\ProgId\ = "ruuuioei.class"	jaffacakes118_Trojan-Downloader.Win32.Qoologic.z.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{60f289f2-017a-411f-917a-2955cc0fff61}	rmmmnu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{60f289f2-017a-411f-917a-2955cc0fff61}\InProcServer32	rmmmnu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{60f289f2-017a-411f-917a-2955cc0fff61}\InProcServer32\ = "C:\\Windows\\SysWow64\\cpppd.dll"	rmmmnu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{60f289f2-017a-411f-917a-2955cc0fff61}\InProcServer32\ThreadingModel = "Apartment"	rmmmnu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{60f289f2-017a-411f-917a-2955cc0fff61}\ProgId\ = "ruuuioei.class"	rmmmnu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{dc391cd1-9d32-4c41-ae28-69de6229d465}\ = "ruuuioei.class"	jaffacakes118_Trojan-Downloader.Win32.Qoologic.z.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 3244	1192	jaffacakes118_Trojan-Downloader.Win32.Qoologic.z.exe	87

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Downloader.Win32.Qoologic.z.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Downloader.Win32.Qoologic.z.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Windows\SysWOW64\rmmmnu.exe
  unknown
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Writes to the Master Boot Record (MBR)
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies registry class
  PID:3244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cpppd.dll

Path C:\Windows\SysWOW64\cpppd.dll
Size 15KB
SHA256 cea99c9688042311765458c714dd67876b6ea2eca9821a08e1424fccc6db3fe5
MD5 8286014a80dc18b717f77ea34cc60e92
SHA1 0834501f3435fd36011ecdd0d912bb38d8fee9af
SHA512 2f3085a9cc4409ee7ec1acd540d4eff8a07c3c6d33d9592d99a01f49b1d9acb94c13458b2eecfa837c4f3271f0f889c6ffc7706c4060ca0c5da4b98eb3141a40
SSDEEP 384:vWpe6p+IE//sD/THqh/INCAxsr6+S9Pfu7n5p:Ae6aQ/LqANlxbdeV
TLSH
T1D1628EB3AE4A84F2D5C115338143750EDDBAD4BBC7FB4966A2D080DA253E719ACAC317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crrrodn.exe

Path C:\Windows\SysWOW64\crrrodn.exe
Size 7KB
SHA256 d985736dc6f636101d2bbff47d04dae6e7c402b49adeaa91ff5f5104d0756a5c
MD5 c5725d9a7983c1371a969fb1c0b7c368
SHA1 d9847a9fc3fd4934c739a4fd68e29cdccd49d2b0
SHA512 41d06bf65427532ba6decb323fa2818f20bc827c28f17391c75834f52280a7cdd2565d684db433d258d3cbdf1243a7b9427e3975c8b0b11ee01a5f97de5435e0
SSDEEP 192:ALOumFhRPu+AxcwCMrpY7S8LqPZo5LdCfuR1nuO3:ALO7FhPAxcr6+S9Pfu7n5
TLSH
T1F6E139A7EF8884FEC0C7767650CD2943D97EC97202B38597A3F5046E785A428C89C9A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

phhhgoi.dll

Path C:\Windows\SysWOW64\phhhgoi.dll
Size 26KB
SHA256 4554bd113a874d729bf7c6f8819db0061541c97e6c8339faacd15ab51b227e67
MD5 f663cca4ace152a681c976a5f1842a70
SHA1 e363d452135f4b6df469e55588e286091d449297
SHA512 1c9841e049607e78aec4019389132cf4b701bf18c374c8ffe22c81cf2449d742ca8bbc314f9530581bf587c32ff955713445ed1c10fa4a3915167893d17037c0
SSDEEP 384:tDHMI8MxeQMq5v2EtGFzZ6AmOEY+E5pOi0QoHteo+Ef/UsLbMJyPCfcNAxpr6+SE:tSeMq5dYT6rPEHOiDvEf/AyQcGxkdeV
TLSH
T1FAC29ED65C200CD7C8E11A31A67A2B4FACF5C1A8CEF38129B6D983CAED4C509911B397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmmmnu.exe

Path C:\Windows\SysWOW64\rmmmnu.exe
Size 62KB
SHA256 8690f61ee4463bae42f378e2df308335b2bcc9b58a46a4829bef08a3d67c61b5
MD5 89ae31aaf2bac3881161e87fac903956
SHA1 066376b8922bb395d28b2d0cbc5d26df3347b85b
SHA512 4654d0fbecee05537b48f3c65d8c67b2fc5be2161e012fcac620020e9176d66eefc382e26c1b2863d63bd49b485b0f857b01e4830c9f82f91d50c77adafee530
SSDEEP 768:OIALiCGnd31S1zSntO/CCeFD1p77rcxmORjuhDxeJdaGrSyrvFu9EguaCaSq4Icz:WLiv3S1zfvHyCe3UAkl76qUh3iYP4
TLSH
T1E65301AACEAB44DFD15B363933E400051E3D637699C0979B689D013B259843BA62EDE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1192-0-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/1192-10-0x0000000010000000-0x000000001000A000-memory.dmp

Download

memory/1192-14-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3244-25-0x0000000010000000-0x000000001000A000-memory.dmp

Download

memory/3244-27-0x0000000000400000-0x0000000000424000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads