4c0fd22a669d2c959aabfbad6ed947c4e306be01800b019aaa98cadd0b8c16eb

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 17:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_2fb79cb1f48dcf8749777fdb2d78454a_amadey_elex_luca-stealer_njrat_smoke-loader.exe
Size 12.2MB
Sample260701-vt958sa16m
SHA256 4c0fd22a669d2c959aabfbad6ed947c4e306be01800b019aaa98cadd0b8c16eb
MD5 2fb79cb1f48dcf8749777fdb2d78454a
SHA1 be1c2fa0c5985fea7d3ea6e7d41bd5c0f1bf2873
SHA512 c91278b59c843a28e6e70d2df65b882427532b311457fe3ea7f7425f879c8dd7cdbb26d18e008dacfe2d33d9290648c21905095df4ed41cf7886ef0d46beac1a
SSDEEP 196608:j3GR84C84dLsZNoJxxSFc4CwR7sYPRr8tcIpbNJQttIGCyRvCiHXyFkhQ:DGR84xNoQIwRgWr8KI9NJV/iK8wX
TLSH
T102D6F120E201E41AFC6701B59AED958D69987A300F1888D772C87EFDDA792D27D3D633
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery spyware

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4824	setup.exe
2520	Q-Dir.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe
File created	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe
File created	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe
File created	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-01_2fb79cb1f48dcf8749777fdb2d78454a_amadey_elex_luca-stealer_njrat_smoke-loader.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000\Control Panel\Colors	Q-Dir.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000\Software\Microsoft\Internet Explorer\TypedURLs	Q-Dir.exe

Modifies registry class 29 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Q-Dir.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\Q-DIR-ADMIN-TEST	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 5000310000000000dd5cda59100041646d696e003c0009000400efbedd5c0550e15c488a2e0000007300000000000200000000000000000000000000000077bf0c00410064006d0069006e00000014000000	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\MRUListEx = ffffffff	Q-Dir.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Q-Dir-Admin-Test	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	Q-Dir.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\NodeSlot = "2"	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Q-Dir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 7800310000000000dd5c05501100557365727300640009000400efbe8158a93ae15c488a2e000000880600000000010000000000000000003a00000000004eb63b0055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 19002f433a5c000000000000000000000000000000000000000000	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 = 7e00310000000000dd5c185911004465736b746f7000680009000400efbedd5c0550e15c4d8a2e0000007d0000000000020000000000000000003e000000000089e76c004400650073006b0074006f007000000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370036003900000016000000	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0	Q-Dir.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2520	Q-Dir.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 4824	1504	2026-07-01_2fb79cb1f48dcf8749777fdb2d78454a_amadey_elex_luca-stealer_njrat_smoke-loader.exe	88
PID 4824 wrote to memory of 2520	4824	setup.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-01_2fb79cb1f48dcf8749777fdb2d78454a_amadey_elex_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_2fb79cb1f48dcf8749777fdb2d78454a_amadey_elex_luca-stealer_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Users\Admin\AppData\Local\Temp\7zS0E502E78\setup.exe
  .\setup.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Program Files\Q-Dir\Q-Dir.exe
    "C:\Program Files\Q-Dir\Q-Dir.exe"
    3⤵
    - Executes dropped EXE
    - Modifies Control Panel
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    PID:2520

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS0E502E78\setup.exe
Size 1.8MB
SHA256 98b7edf8b4cf2b3da93a001b1e909d2195eebfa91742323473d9bc7e4bbdaa48
MD5 d49f1d732785e2e78f150bc53114c862
SHA1 3fb417b453ca26d0748175ea6b0c708cbb993fde
SHA512 2048c8a6cacbc44f9a481c00ee33cd78ca783a013895ed964ea79b815aae30d21f4e1bc6609181e4d4fd9c918d5722471c3b6e2694b11415e12b85d951e71bb5
SSDEEP 24576:MUK+cfYyt2FRwJpK2rVf1Y+9TGRHkXJILs2ToJpO93X0zA28dIsNoLs9Lqy:W+tRwJw2xNY+9TGREXyLscdIsNp
TLSH
T125955B52E6F14148E46FC176CEC6D723EB717D0A62318ABB4110FE152F767628E2932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Q-Dir.lnk

Path C:\Users\Admin\AppData\Local\Temp\Q-Dir_tmp_folder_2019\Q-Dir.lnk
Size 1KB
SHA256 de5d686723faeb8f243057f8a6408d06e0e9d218c5d9ab55fc4ba062b30c282b
MD5 8ad178517eca5b5d28cbaae506fe753a
SHA1 b0128b24c105288723b54a254683d5a288be1ac4
SHA512 4ad179461696a4df39960015b8a8d312b806cd5ffd8f7ae6800eb774ca71dfdfdada30bff3e3b22147f9b88bd47db95603884372ff6aeaee25b99611c96dcede
TLSH
T11E31F2280FDF2B20F3A2C275177146134237F801E75C2F4D40875AA255B091062A9F6B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 683B
SHA256 474fc471da456b6ad03f38da43e67127d99cea4138ba853314090a8109609c3f
MD5 d405d17b261ab639edbc27c20d58717c
SHA1 e2d79f66f1bf833394040388116a4dee2a810d9b
SHA512 8e9aac7df14d8f41348205e67ebda580f6bdbfc90a248929420b2e2287a14342b19ba2c88803410b0516e162870f97020a11d2c79cbf70fb0fbe95b61a166a64
TLSH
T18501995302C45E7F0440ABA3EB3291C868F6BE08F29AF54D59564C48CC5CD1B7D85F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 702B
SHA256 ef1482b7b46094a7edc545a5f28c0cf38adfc068a3767d23d35cf533fe8fffa4
MD5 bdc7c1b217a73b5abfbda26516db2318
SHA1 4b9e1d35cd3b7da48ff5cc422fa7b9cfaea7eefb
SHA512 9c55e5969df6be4f23d5db58a7fd85aa7c927af55e6ac546cb13829ea528f42e5de16b2666d372c246835d08d549f17b2503ceaae64a13ef5b165dbabe2cebf8
TLSH
T190017B5302C45E7F0440AA53EB3151C558F6BD08F25AF54D59565C48CC5DD1BA945F0A
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 730B
SHA256 a941efbf3e92394e60b50e01f57d9f917e28762e519f8dd383495b75c9366ba0
MD5 2a1e1da2435f90f9f4108fcf37e17ff1
SHA1 5c8a23f411d08243ecedc122e9cca010773725ca
SHA512 42323b9c4bd63c485cb58cfe2e744fa335d3f593f166a9d5556cbabd1d4f682d1483bc7d983d3d48af05359638c53a4294fbde9e96b02bf6a4d2f6bad9567da9
TLSH
T15401CB5306C45E7F0441AA93EB3291C498F6BD08F25AF50D5A670C48DC0DD1BB985F0A
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 746B
SHA256 683242ba8f24d78387b1db839ea582da2b4d275359dccb0b4b34abe07f3bb52e
MD5 c6cf2d807eb36b96f3b6a4a5c1a53da3
SHA1 9ec3115fd5a5b9ba2fe4e89662b66abcdb9a78bd
SHA512 8f8f01fcdf2b9cc03b3c46909809a6160f154188351219d74305878edc04f2a80595308708ea0683c19fa6b0358b95de7ef3a01c27a2deea34ed331e517ded39
TLSH
T14801105302C45E7F0440AA93EB3251C858F67D08F25BF90D0A570C08CC4DD1B7985F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 41B
SHA256 f477cab20ee92407215959a6d6b748938cde434ea0f4fbf4ac5b90bc4fd2b0a6
MD5 b42ae6c1d06d702bbe7bc907f6df1211
SHA1 368007e85dd43e9df65549dd23768e526e6c3d1e
SHA512 a9868fad0104b91ec3df880f511591f79324e584725034031c7b66fb6343876fdb89eb04f1bc94984c79697c12a0173921a0581d6667ba5680e8c14a4a092dbc
MD5 SHA1 SHA512

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 60B
SHA256 2ad4937aa82565cdf21ce586b9012eb43a3015d55704b00500c2272b5faf0f94
MD5 497cec0378ff3f4e74db0f4870cec441
SHA1 e3a922bc9c45a13882cced14b87da28db833887d
SHA512 3ad3bb3a26b495f4a67815a6394ab9c951770ad35c039c9030ee9877aee2eacb21d764b11e447b4d7fbadf873ab821619138b9dd56a250eafae737550c7e9d75
TLSH
T1A2A00266B46E43CE003AD120A6105A8E0AD46588121A7B505EA63054AD799650E4D51D
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 661B
SHA256 bd265d569860450095ba3348d3eebc16291e308d83f1a802514ad64617321023
MD5 842224641f794e3b216e5d8aed5718a5
SHA1 8de8b215d76734983dc978d7bb7be4b09468b0e2
SHA512 41f46686d6e96bb61cc07e28c09324de5102d7330f0a5d45fb89bff5d342ce75495925c39bcd000d3760edca5f0a0b0a217e65a1d3d1a7feeacc183fac7b6dda
TLSH
T16701994302C45E3B0440ABA3EB31518828F6BE08F28AE50D19564C48CC0CC1B7C81F0B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4824-6-0x0000000002330000-0x0000000002331000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads