0ac40d2c4aaeb31f8580a458e9ad21aeece3dadc3830dfac581db1927dcbff14

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Downloader.Win32.Qoologic.c.exe
Size 30KB
Sample261006-pdkmraf18y
SHA256 0ac40d2c4aaeb31f8580a458e9ad21aeece3dadc3830dfac581db1927dcbff14
MD5 cff892b5b63bb48704f5191ceed780d5
SHA1 66a7cb3e0822d1392175eb7357f7a323e5f57913
SHA512 a7b9af4654a2e8ae2d05a3f73cb9f59654170b4333fa0bf36aa3693aad694b6259cfa4f808cdd6fe1e200395261baa7e139ab9432ffdf425edd6267ece00b4bb
SSDEEP 768:q/8aHPojIYysM/lqv5ops/C3pRv1j3fxIdeV:qPgjov/lWOECXdLy
TLSH
T19AE2F1D3CDB64CFBCACB10B750EA2502626DB65153B7D52346BB56843C9043AEE1BB0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2780	jaffacakes118_Trojan-Downloader.Win32.Qoologic.c.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Narrator = "C:\\Windows\\system32\\yuybby.exe"	jaffacakes118_Trojan-Downloader.Win32.Qoologic.c.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\pmpaap.exe	jaffacakes118_Trojan-Downloader.Win32.Qoologic.c.exe
File created	C:\Windows\SysWOW64\gzgqqg.dll	jaffacakes118_Trojan-Downloader.Win32.Qoologic.c.exe
File created	C:\Windows\SysWOW64\qyqkkq.dat	jaffacakes118_Trojan-Downloader.Win32.Qoologic.c.exe
File created	C:\Windows\SysWOW64\qsquuq.dll	jaffacakes118_Trojan-Downloader.Win32.Qoologic.c.exe
File created	C:\Windows\SysWOW64\yuybby.exe	jaffacakes118_Trojan-Downloader.Win32.Qoologic.c.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Downloader.Win32.Qoologic.c.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{65995c93-c13b-4e80-9d7f-c0b040e0a483}	jaffacakes118_Trojan-Downloader.Win32.Qoologic.c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{65995c93-c13b-4e80-9d7f-c0b040e0a483}\ = "rjrrrr.class"	jaffacakes118_Trojan-Downloader.Win32.Qoologic.c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{65995c93-c13b-4e80-9d7f-c0b040e0a483}\ProgId\ = "rjrrrr.class"	jaffacakes118_Trojan-Downloader.Win32.Qoologic.c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\gkgxxg	jaffacakes118_Trojan-Downloader.Win32.Qoologic.c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\gkgxxg\ = "{65995c93-c13b-4e80-9d7f-c0b040e0a483}"	jaffacakes118_Trojan-Downloader.Win32.Qoologic.c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{65995c93-c13b-4e80-9d7f-c0b040e0a483}\InProcServer32	jaffacakes118_Trojan-Downloader.Win32.Qoologic.c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{65995c93-c13b-4e80-9d7f-c0b040e0a483}\InProcServer32\ = "C:\\Windows\\SysWow64\\gzgqqg.dll"	jaffacakes118_Trojan-Downloader.Win32.Qoologic.c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{65995c93-c13b-4e80-9d7f-c0b040e0a483}\InProcServer32\ThreadingModel = "Apartment"	jaffacakes118_Trojan-Downloader.Win32.Qoologic.c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{65995c93-c13b-4e80-9d7f-c0b040e0a483}\ProgId	jaffacakes118_Trojan-Downloader.Win32.Qoologic.c.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Downloader.Win32.Qoologic.c.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Downloader.Win32.Qoologic.c.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gzgqqg.dll

Path C:\Windows\SysWOW64\gzgqqg.dll
Size 5KB
SHA256 ef996b64868bfb2ced5835974846a1150be87a9508732c3a4e007af4cfe88f4e
MD5 a7a2359d9bb5c739a5a53aaaec5783d1
SHA1 755d6733814d9af34093226ec4e2489e5bb513bc
SHA512 eb46562f7f89b4db92e6420c332d305882706a30970350272a02b3d5570200ddface4c239da3ea2fee9fdf2e7d69f4f52b416284cd9974613be4a3223d84035e
SSDEEP 96:pUTfwtSDbkBh/sWH9OScLxLawJdu/AxrVAS:GTfPDesimVbu/AxpAS
TLSH
T14AC1B63BD3EA09F6C10F12B42DA5041E2B7AD83E47B64071DD570ADF20E08A6E621712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2780-0-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/2780-11-0x0000000000400000-0x0000000000415000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads