bfd83f2e7d795de694996e2e81c80fb17012e29959161ca85fe799c467f56fc0

Analysis

max time kernel
150s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 22:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_5df2a7d1c1653e475b061c8fbff41d81_amadey_elex_luca-stealer_njrat_smoke-loader.exe
Size 12.2MB
Sample260628-179drags2r
SHA256 bfd83f2e7d795de694996e2e81c80fb17012e29959161ca85fe799c467f56fc0
MD5 5df2a7d1c1653e475b061c8fbff41d81
SHA1 69ed526493c772c6d20c431c88fc47a5381f83b2
SHA512 11a581ca8409331f6314e242d92af847dc20e739bad4795421ffe065a7b3e022e8864a693d39b8e181afa1cb4d362deaf49aa6e56d06f04bd0cab17d1a79bfb7
SSDEEP 196608:WGdJTdULxyt3wJqvtPV68GWHywK36mBg9xOb3OsZtOEiA2XyFkhp:BeL6uuPV68GWI36m69wb3yEiA2wO
TLSH
T12ED6F120E201E11AFC6701B5DAED958D285CBA300F1898E772887EFFDA796D13D35663
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery spyware

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5868	setup.exe
1964	Q-Dir.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe
File created	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe
File created	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-28_5df2a7d1c1653e475b061c8fbff41d81_amadey_elex_luca-stealer_njrat_smoke-loader.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000\Control Panel\Colors	Q-Dir.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000\Software\Microsoft\Internet Explorer\TypedURLs	Q-Dir.exe

Modifies registry class 29 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	Q-Dir.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Q-Dir-Admin-Test	Q-Dir.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\Q-DIR-ADMIN-TEST	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 7800310000000000d25c30551100557365727300640009000400efbe8158a93adc5c58b22e000000880600000000010000000000000000003a0000000000b4d4e20055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\MRUListEx = ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\NodeSlot = "2"	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 5000310000000000d25c8a5e100041646d696e003c0009000400efbed25c3055dc5c58b22e00000072000000000002000000000000000000000000000000019b6900410064006d0069006e00000014000000	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 = 7e00310000000000d25ce85d11004465736b746f7000680009000400efbed25c3055dc5c5cb22e0000007c0000000000020000000000000000003e00000000004fb30e014400650073006b0074006f007000000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370036003900000016000000	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Q-Dir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 19002f433a5c000000000000000000000000000000000000000000	Q-Dir.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1964	Q-Dir.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5192 wrote to memory of 5868	5192	2026-06-28_5df2a7d1c1653e475b061c8fbff41d81_amadey_elex_luca-stealer_njrat_smoke-loader.exe	89
PID 5868 wrote to memory of 1964	5868	setup.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-06-28_5df2a7d1c1653e475b061c8fbff41d81_amadey_elex_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_5df2a7d1c1653e475b061c8fbff41d81_amadey_elex_luca-stealer_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5192
- C:\Users\Admin\AppData\Local\Temp\7zS844338F8\setup.exe
  .\setup.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:5868
- - C:\Program Files\Q-Dir\Q-Dir.exe
    "C:\Program Files\Q-Dir\Q-Dir.exe"
    3⤵
    - Executes dropped EXE
    - Modifies Control Panel
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    PID:1964

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS844338F8\setup.exe
Size 1.8MB
SHA256 98b7edf8b4cf2b3da93a001b1e909d2195eebfa91742323473d9bc7e4bbdaa48
MD5 d49f1d732785e2e78f150bc53114c862
SHA1 3fb417b453ca26d0748175ea6b0c708cbb993fde
SHA512 2048c8a6cacbc44f9a481c00ee33cd78ca783a013895ed964ea79b815aae30d21f4e1bc6609181e4d4fd9c918d5722471c3b6e2694b11415e12b85d951e71bb5
SSDEEP 24576:MUK+cfYyt2FRwJpK2rVf1Y+9TGRHkXJILs2ToJpO93X0zA28dIsNoLs9Lqy:W+tRwJw2xNY+9TGREXyLscdIsNp
TLSH
T125955B52E6F14148E46FC176CEC6D723EB717D0A62318ABB4110FE152F767628E2932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Q-Dir.lnk

Path C:\Users\Admin\AppData\Local\Temp\Q-Dir_tmp_folder_2019\Q-Dir.lnk
Size 1KB
SHA256 4c368d202f7a798a97a2c2ddf31c9468a554bb66198082f7c9607862ba6ab722
MD5 f84f32715c365144473677703e48de60
SHA1 aa4f5fa2b9ea47cc53e442f6e91e9f3a3786f7a7
SHA512 318babad00b9f411aca63d316c4e3af5574e08a765e5d8a8ac79463fb222d6a4ceabaaea4528310a1ebe264025afa47b22366862bea0ea9f74f89ab6c264ea3c
TLSH
T1003121240FDF2B24F3E3C17117724A234237B844FB5C2F4D40875AA26AB191062ADF9A
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 683B
SHA256 f8378231b4c914370e68139c5f09a4e6942e90076c2cd5ba6e8df608b0c7eaf5
MD5 1568e10c40eacb363ed0127acdba5abe
SHA1 8154081ac9c0a79a2e229daa73d1decebffa93b2
SHA512 92fa632a6b977edba5b00159ee85cacdea45889046efc63a18e5a1b017b537b8a6226a653f0f5a6c9b9211ab803a153c2ab598799781f563d2109c360d358f91
TLSH
T13B01995302C41E7F0441ABA3EB32A1C868F6BE08F29AE54D59564C48CC5CD1BBD82F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 702B
SHA256 4334b47392292d7cbab4cefad801467fcd765c43679b3604b4a287d048c39584
MD5 e8c860657f0bdcc8d4f52e8e6f006546
SHA1 d7e6f94c9da7fd11a3e338b19f22d0d896c985a1
SHA512 21a2ddf79d95199232461ae29b1ae0e0d0f208a3e9aaba23f3a214b44b2d6242438f583fd62246bc7f35a0cfbc5b8b53f8e9364955bd6929b37be45d3f840636
TLSH
T1CD017B5302C41E7F0441AA63EB3151C458F6BD08F25AE54D59564C48CC5CD1BA945F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 730B
SHA256 9bdba1943323d822dfeb4e559cc59d59ecfb6c5758a92364840da164a92c14b7
MD5 03f8bf344d9e04803666f9c499662a76
SHA1 a16d87bd660b94f450bf47db01337f94f37f97d6
SHA512 1faa4d09ec374408bea52126638d3b372864c876dbab571285ce013bbb44e3a56a1702593a1ba601e3ccf28f9709a380184b72aecc9d0ecdfecff82820f5c8e7
TLSH
T11301CB5306C45E7F0441AAA3EB3291C498F6BD09F25AF94D59670C48DC4DD1BB986F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 746B
SHA256 459e2250d60d74d890459a15366646dcf2cd0c3b4dd3fbadf35d284e4fa9a7bf
MD5 fdf70092075522ee7d12414b61575e14
SHA1 b9bb736d49e0cb35cebcf53592f9c0c07cc82870
SHA512 693f967cb15e2b30400cb02367a9fa0623d64bb225b6a7dacc3cf54802c28c68b94ed022baf4b12a7de47968af5227dd8611e03b3b762b2cae932ae487c841ee
TLSH
T19A01105302C41E7F0441AA93EB3251C858F67D09F25BF94D05570C08CC4CD1BB986F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 41B
SHA256 6829bed85de354992a7762848e30685c808c1302c48aca0ebdc3c1d0da9c8466
MD5 352d744ec3d5174307256a1dc7b5b86e
SHA1 5a945d92954b4138e27524ecd871db705ef5425f
SHA512 2854a3999b0b88b52e13e4a3be935f8be6115e9f9a1649bc881a7ae35aaec4c380c58fde362bd751f4181564879221ca81eddc37108b999bee8d652e7e7fb5ee
MD5 SHA1 SHA512

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 661B
SHA256 e907db9f711b45aace7d09706c0af089236d1523157256101cb26f647d0163c2
MD5 61569e4a1bcc64b2c8d71ed23d720518
SHA1 008e6710a3cb743e5dbd0e1fc5851f46be4d93a4
SHA512 4bfeabac2bbf954e1295ebd7eddc347742cd4baaba2f772642c9e7fba3f0db5691402db268f27b7a89879572511b473e6b533eaded6b0068d27c2b14bb57333f
TLSH
T1FD01994302C41E3B0440ABA3EB31618828F6BA08F28AE54D15564C48CC4CD1B7C82F0B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5868-6-0x0000000002330000-0x0000000002331000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads