9ade32e499187bf27752d84d0c03eb02239e4ba554ab3d28db74576e201bbd2f

Analysis

max time kernel
150s
max time network
121s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 18:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-26_002a1195e83e1ba81c51e77326f9c2aa_amadey_elex_luca-stealer_njrat_smoke-loader.exe
Size 12.2MB
Sample260629-xcdf2scw8v
SHA256 9ade32e499187bf27752d84d0c03eb02239e4ba554ab3d28db74576e201bbd2f
MD5 002a1195e83e1ba81c51e77326f9c2aa
SHA1 dc78fc668ee7c54b45b50e5488f292fadbe83de1
SHA512 9d524af352281f3fd50d2b7d16fef4047f90aa4de57be0ef71a72af831085e3e08fb96718f5d828c848423a4fe445be969f1fcf5546eb2434ba90ab5fc523ff8
SSDEEP 196608:EEUEUUn9B1/DlsCUooSt7QQOinwJBH5PvShuOskrrVVkjwXTS78LXyFkhk:oUXEwtQQWBHJQuOnkjQToywf
TLSH
T18BD6F120E205E019FC7B05B15AED958D68587A301F2894FB72887EFDEE796D23C35263
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery spyware

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5908	setup.exe
3796	Q-Dir.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe
File created	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe
File created	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe
File created	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-26_002a1195e83e1ba81c51e77326f9c2aa_amadey_elex_luca-stealer_njrat_smoke-loader.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-759331733-200834466-1207319849-1000\Control Panel\Colors	Q-Dir.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-759331733-200834466-1207319849-1000\Software\Microsoft\Internet Explorer\TypedURLs	Q-Dir.exe

Modifies registry class 29 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-759331733-200834466-1207319849-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-759331733-200834466-1207319849-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\MRUListEx = ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-759331733-200834466-1207319849-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-759331733-200834466-1207319849-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-759331733-200834466-1207319849-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-759331733-200834466-1207319849-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-759331733-200834466-1207319849-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-759331733-200834466-1207319849-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-759331733-200834466-1207319849-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 19002f433a5c000000000000000000000000000000000000000000	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-759331733-200834466-1207319849-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-759331733-200834466-1207319849-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-759331733-200834466-1207319849-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\Q-DIR-ADMIN-TEST	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-759331733-200834466-1207319849-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-759331733-200834466-1207319849-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-759331733-200834466-1207319849-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	Q-Dir.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Q-Dir-Admin-Test	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-759331733-200834466-1207319849-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 7800310000000000dd5c06501100557365727300640009000400efbe8158a93add5c49952e000000880600000000010000000000000000003a00000000002110850055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-759331733-200834466-1207319849-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-759331733-200834466-1207319849-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 5000310000000000dd5cec55100041646d696e003c0009000400efbedd5c0650dd5c49952e000000550000000000020000000000000000000000000000007846f900410064006d0069006e00000014000000	Q-Dir.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-759331733-200834466-1207319849-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\NodeSlot = "2"	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-759331733-200834466-1207319849-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-759331733-200834466-1207319849-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-759331733-200834466-1207319849-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 = 7e00310000000000dd5c495511004465736b746f7000680009000400efbedd5c0650dd5c4d952e000000600000000000020000000000000000003e0000000000f5b410004400650073006b0074006f007000000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370036003900000016000000	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-759331733-200834466-1207319849-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-759331733-200834466-1207319849-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-759331733-200834466-1207319849-1000_Classes\Local Settings	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-759331733-200834466-1207319849-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-759331733-200834466-1207319849-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	Q-Dir.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3796	Q-Dir.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5876 wrote to memory of 5908	5876	2026-06-26_002a1195e83e1ba81c51e77326f9c2aa_amadey_elex_luca-stealer_njrat_smoke-loader.exe	88
PID 5908 wrote to memory of 3796	5908	setup.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-06-26_002a1195e83e1ba81c51e77326f9c2aa_amadey_elex_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-26_002a1195e83e1ba81c51e77326f9c2aa_amadey_elex_luca-stealer_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5876
- C:\Users\Admin\AppData\Local\Temp\7zS4F6DC3D8\setup.exe
  .\setup.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:5908
- - C:\Program Files\Q-Dir\Q-Dir.exe
    "C:\Program Files\Q-Dir\Q-Dir.exe"
    3⤵
    - Executes dropped EXE
    - Modifies Control Panel
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    PID:3796

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS4F6DC3D8\setup.exe
Size 1.8MB
SHA256 98b7edf8b4cf2b3da93a001b1e909d2195eebfa91742323473d9bc7e4bbdaa48
MD5 d49f1d732785e2e78f150bc53114c862
SHA1 3fb417b453ca26d0748175ea6b0c708cbb993fde
SHA512 2048c8a6cacbc44f9a481c00ee33cd78ca783a013895ed964ea79b815aae30d21f4e1bc6609181e4d4fd9c918d5722471c3b6e2694b11415e12b85d951e71bb5
SSDEEP 24576:MUK+cfYyt2FRwJpK2rVf1Y+9TGRHkXJILs2ToJpO93X0zA28dIsNoLs9Lqy:W+tRwJw2xNY+9TGREXyLscdIsNp
TLSH
T125955B52E6F14148E46FC176CEC6D723EB717D0A62318ABB4110FE152F767628E2932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Q-Dir.lnk

Path C:\Users\Admin\AppData\Local\Temp\Q-Dir_tmp_folder_2019\Q-Dir.lnk
Size 1KB
SHA256 b154136ecd731d0776e6dfe51d7ae1eed62a7cfb23d19c1df5201aa5a7c4a458
MD5 3bfc78832a9b727ff30ec05bba122683
SHA1 37ac417b7f6a6efa718b2d8f81756970bd2a68b4
SHA512 a43886a824f7d883ee572e1425e4d2215c2e232a8a94ebc9e79c10820e3eb03a55ec416a5f0ea003963a0769ff4d8b0767c02feb88102bd7371e7d140404a231
TLSH
T1653126200F9F2B24F3E2C17127B247134237B801F7582F4D408756E265B051052E9F9B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 683B
SHA256 6a685c6ad4c317d06ae02a8610f325a4ef6672fba7f0f82dea12439b4aac5454
MD5 010a9cc18388ea40c01ec8d2f2a5167c
SHA1 a81674082c1773172a8cce7ada050049aceb558e
SHA512 1b7425e843d3acd49d2a4417c3c538a1e501b0bee9f2cbfdec9233c67f4c48bcb1920d3c7301e8ba6e9fe87a09581494f3ee4c2ee3c79f5d2883150cd5892fe8
TLSH
T12C01995306C46E3F0840ABA3EB3291C868F6BE08F69AE54D59564C48CC4CD1B7D81F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 702B
SHA256 c1a45f37800a3571f99c357d0fe94eccce19c54a1289b6e7795991b778e6fe5e
MD5 52e6e319f14c6fa5312d862c4afcf68a
SHA1 97162536ea214a45bf70bf978d2c82dc87d1af9f
SHA512 cb89fa91fa0c52171d9338cbff5ac44eebf72b3a2a80d2c256118daa1464c9b7feaed9cede35d67eb96c277a40251f3e338d58f719b3da39530006ebcaed1676
TLSH
T1D7017B5306C45E7F0440AA93EB3151C458F6BD08F65AE54D59565C48CC4CD1BA985F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 730B
SHA256 97a897c50635b07985cdfe0190fc5a649c12a34df5c4a6b2cd63b39546104947
MD5 42816866602cd16621621486c57f0fb2
SHA1 fdaa04cb1c7ff617f7790b283460e26ba337096f
SHA512 db6e4ff609f0c48bf1d4d0c2b834e8b29536d7f2e9caddac6959fbee36367477c6d066b0721d306be596d99c37d1050f607bbaee66d6284626cabcad6de6fa50
TLSH
T1C501CB5306C46E7F0841AA93EB3291C498F6BD09F65AF50D5A670C08DC0DD1BB985F0A
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 746B
SHA256 308effbaa4acd013637954f91ff475a504a88bd4cdadbc8c2e1da9b20014b601
MD5 7c75d287510e1a1feff3d6e660ff6cf3
SHA1 d2e0429d36dd417dedfc814ba1ba4f9a5c039448
SHA512 7675304a52b9a19dc95751cb377b66b29a636e688fc2e542398b782e77f622ca75d5ed4151274df38e7a1c4d7546fb4aad36fc8c271b883f8a8e6f646fbecedd
TLSH
T11501105306C45E7F0440AA93EB3251C898F67D09F65BF90D0A570C08DC4CD1B7985F07
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 41B
SHA256 93249adf7b7ceadf1fe16c22bb2985ba70d97289452dac16fde1a813b1ed0754
MD5 9940c4cb5e3ede51f60d79b6f0f18984
SHA1 fc33de89c70de195a9951e6d8661d80b1907ef4c
SHA512 992d3cc99c9419c9c67ba53f9a1dda8078fb62538416a28adc73b74bea7e6680117fd68c9b57999499c627fca4917d6b7e3687cee1ddc3c37dd111c7671ad09b
MD5 SHA1 SHA512

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 661B
SHA256 75f2ea23a43c2d83dd44613f183273ea18704c4db90f2e8cbe18515ecae9c197
MD5 a32ca5c4913d7789527bb8b67ba6bb6f
SHA1 d9d0bc8b66a38612bc6161c4ca44903e55bdb6df
SHA512 2f6474b58c544c4a191e148c01fa7a2a9462f14dea5245d2eeb1be572695c5db0ab408ebc9182cc26e269795c8caba83da0e235077330061aad2b43d1bad5f33
TLSH
T1C2017D5716C46E3F4844BBA3EB31518868F6BE08F69BE54D59564C48CC4CD1B7D81F0B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5908-6-0x0000000002320000-0x0000000002321000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads