b5e68be0a985deb0f1e7b9cad984425933dc0e915ceae912143a6592b2920f76

Analysis

max time kernel
164s
max time network
162s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 22:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_5d80e5514755e4697b42f57cba28c653_amadey_elex_luca-stealer_njrat_smoke-loader.exe
Size 12.2MB
Sample260628-18p2hafs91
SHA256 b5e68be0a985deb0f1e7b9cad984425933dc0e915ceae912143a6592b2920f76
MD5 5d80e5514755e4697b42f57cba28c653
SHA1 bf1d6250346bf658f849adb489a593ae17104ad2
SHA512 5e10c70400bd0e825f65d0974d22debffd8a3573fafa2222bf6106641680cfff054a723bb0f0f5db042890287e82578833220d7b17afaf63fe2c683eaf784278
SSDEEP 196608:2QMOv8uTHJXq9nNB3CaLDVG9DNo3MROxswcKuwa33l1+VbLQ12405fMdOr4XyFkW:rNX6nLbM91ROJBa311oPW0JM3wb
TLSH
T182D6F130E201E01AFC6701B1A9FD959D685CBA304B2888E772887EFDDE796D17D35263
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery spyware

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5404	setup.exe
464	Q-Dir.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe
File created	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe
File created	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-28_5d80e5514755e4697b42f57cba28c653_amadey_elex_luca-stealer_njrat_smoke-loader.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Control Panel\Colors	Q-Dir.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Internet Explorer\TypedURLs	Q-Dir.exe

Modifies registry class 29 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 19002f433a5c000000000000000000000000000000000000000000	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\NodeSlot = "2"	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 7800310000000000d15c637d1100557365727300640009000400efbe8158a93adc5c76b22e000000880600000000010000000000000000003a0000000000816bbc0055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Q-Dir.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\Q-DIR-ADMIN-TEST	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 = 7e00310000000000d15cb58411004465736b746f7000680009000400efbed15c637ddc5c86b22e0000007c0000000000020000000000000000003e00000000008bb56c004400650073006b0074006f007000000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370036003900000016000000	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Q-Dir.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Q-Dir-Admin-Test	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	Q-Dir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 5000310000000000d15c5a85100041646d696e003c0009000400efbed15c637ddc5c76b22e00000072000000000002000000000000000000000000000000affb0300410064006d0069006e00000014000000	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\MRUListEx = ffffffff	Q-Dir.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
464	Q-Dir.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 5404	1156	2026-06-28_5d80e5514755e4697b42f57cba28c653_amadey_elex_luca-stealer_njrat_smoke-loader.exe	90
PID 5404 wrote to memory of 464	5404	setup.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-06-28_5d80e5514755e4697b42f57cba28c653_amadey_elex_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_5d80e5514755e4697b42f57cba28c653_amadey_elex_luca-stealer_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Users\Admin\AppData\Local\Temp\7zS4843CD19\setup.exe
  .\setup.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:5404
- - C:\Program Files\Q-Dir\Q-Dir.exe
    "C:\Program Files\Q-Dir\Q-Dir.exe"
    3⤵
    - Executes dropped EXE
    - Modifies Control Panel
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    PID:464

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS4843CD19\setup.exe
Size 1.8MB
SHA256 98b7edf8b4cf2b3da93a001b1e909d2195eebfa91742323473d9bc7e4bbdaa48
MD5 d49f1d732785e2e78f150bc53114c862
SHA1 3fb417b453ca26d0748175ea6b0c708cbb993fde
SHA512 2048c8a6cacbc44f9a481c00ee33cd78ca783a013895ed964ea79b815aae30d21f4e1bc6609181e4d4fd9c918d5722471c3b6e2694b11415e12b85d951e71bb5
SSDEEP 24576:MUK+cfYyt2FRwJpK2rVf1Y+9TGRHkXJILs2ToJpO93X0zA28dIsNoLs9Lqy:W+tRwJw2xNY+9TGREXyLscdIsNp
TLSH
T125955B52E6F14148E46FC176CEC6D723EB717D0A62318ABB4110FE152F767628E2932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Q-Dir.lnk

Path C:\Users\Admin\AppData\Local\Temp\Q-Dir_tmp_folder_2019\Q-Dir.lnk
Size 1KB
SHA256 a76c6b252a6a384696fee9207ad8dd8ba9c070769ae67502d005dfcf05a828de
MD5 0ca9a921b077b3f852a7c424b61ca9e1
SHA1 886bc63cf23a6e9929edfff4e5458056da79e663
SHA512 ddf40d75551cd9dac8251d416b966db6ed8e46d86315e9a71b8518613263de8b2f4ddec8a457860c82418722a5fccb9ce315d7d0bef1ab7c8e36cbfc643a9b5b
TLSH
T13D3126180F9F2B24F3E2C27417B146134237B805F75C2F49408757A255B051062ADF56
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 683B
SHA256 850e137d6b168ac96c71250f65838ccabcea35813d3d23c483f49faf9a080cad
MD5 0e3467c28c81e98d8049204c842dd013
SHA1 69a52683f3c0180a2b8218797893b9076088cf8f
SHA512 1677ab1ff925f1e9a794f89e599a4fd0d0243c8ff41156e5105d4256246bf9957791e341350166526247c0cf37339d085fa476e648a6d8ba8dafeec9def7233f
TLSH
T1CA01995712C45E3F0480ABA3EB3291C86CF6BE08F29AE94D59664C48CC4CD1BBD81F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 702B
SHA256 76eab017dd760ea9dc8c6ceae444a012fb9b216d46358e5822064ac8a498f3d0
MD5 d853ea0ce9056110cc43cb68bbe97bf9
SHA1 cf760a9f650babd3c1f789efb0d03fe05b3628f4
SHA512 72f290c75f5384d9e98af1802c3799fd19b596c040bf93ce307e11cf810d67729ca0498960e607460227f4855c3cf732be400448d771ba3ad192db4a8f60bc49
TLSH
T18E017B5712C45E7F0440AA93EB3151C458F6BD08F25AE94D59664C48CC4DD1BAA45F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 730B
SHA256 7f18f516271cfc9f8132a8bd9187956cb8313f4dae572f15993d6593fc8ddbb2
MD5 2c6f4931be8f56d0745634ae069db8fc
SHA1 3d1ba0a4719dc60d413aea4efa48d8b74406df70
SHA512 9ecb8ab3f696f3fa3277595a927b10cdfdcef359dd34f3892f2a3b58a5905b9119666f4524f24240379f92d8a12796be009e87cad28f2271fa6731334eb4a870
TLSH
T1FF01CB5316C45E7F0441AA93EB3291C498F6BD08F65AF50D5A670C08DC0DD1BBA85F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 746B
SHA256 a3241ca7bba604f807ab8d6d9d33ad4b6eec42a7f11b8715ea4c74125f75aae9
MD5 03f234a3e2e3931746488b2d16e02a35
SHA1 ff5f9001db687d2c4d0c5d4dd53a988f6dbfb9b8
SHA512 a3846b8636ea93e4062740e624ff5d9d0ed23e4a89e4f1b123ca3d82d35e997b00fffaebe41632a9c568caf3a9141b51016781478f0e771136fb33a0ae6e44ae
TLSH
T10D01105302C45E7F0440AA93EB3251C858F67D08F65BF90D06670C08CC4DD1BBA85F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 41B
SHA256 7a301476bd699b2db09e3ca68b1d5c0559178fcedd3872c07754e5889d5e4e9f
MD5 f87ba4d176c86ebf9e3c67deabbafb56
SHA1 6a8c7c1b5eb4d0acd5a19460cfde655a419820cc
SHA512 57d1928d520a3edf76f511d75962b587cbaf770ae68707957091220fb933cec5741fd9fb5bf8e48842e218f25d734d0f6442e0242b0c60f6f79082104c116d8c
MD5 SHA1 SHA512

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 661B
SHA256 10ae32865e3532e58d89c04f8e79dfb0386f70506f23450aee973fa84aabf74b
MD5 a5d4db2cebf840f731bbf96144b62cc2
SHA1 808effb5164a28cd2bc313eb650122b9b0355d1d
SHA512 7f35fd4091668da5edcd332a5ca6e5c8b57887cb1d1589ec5379f307d1de946c6f11a8ef623c51de8dfcd33afb4c668e165253bb5644d2df3d1692bef482ac52
TLSH
T18E017D5716C45E3F4480ABA3EB3151886CF6BE08F69BE54D55664C48CC4CD1B7D81F0B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5404-6-0x0000000002320000-0x0000000002321000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads