b728e25ccac16b7d560328580993595f577c1c8173b85a77c27afe9ee03b8e09

Analysis

max time kernel
150s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 13:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_2312b01930374a038fd71a12d1240cde_amadey_elex_luca-stealer_njrat_smoke-loader.exe
Size 12.2MB
Sample260709-qaah2sb15s
SHA256 b728e25ccac16b7d560328580993595f577c1c8173b85a77c27afe9ee03b8e09
MD5 2312b01930374a038fd71a12d1240cde
SHA1 71fe101ad14a001a07e91fd37947192d42a0e389
SHA512 23df0df8959aa99c9cf7dd93c80e98abaa104b17e9f54011a4acb99b18bf1993576b27d6d9f0ca69fa16e76852e0fd4721d910513519eb7099903d7a0a576437
SSDEEP 196608:pKcvyxnVQJzIOpO+FyZpmLYWWRXtpsVgLozP8P5pnsPXyFkhg:INVQJzImyfV5p0wP5p2wX
TLSH
T1F7D6F130E201E019FC6701B1AAFD959D685C7A305B2888E772897EFEDE392D13D35663
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery spyware

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5532	setup.exe
6120	Q-Dir.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe
File created	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe
File created	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe
File created	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_2312b01930374a038fd71a12d1240cde_amadey_elex_luca-stealer_njrat_smoke-loader.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000\Control Panel\Colors	Q-Dir.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000\Software\Microsoft\Internet Explorer\TypedURLs	Q-Dir.exe

Modifies registry class 29 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 5000310000000000e65c5480100041646d696e003c0009000400efbee65c4177e95c64682e000000530000000000020000000000000000000000000000008fa42901410064006d0069006e00000014000000	Q-Dir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	Q-Dir.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\Q-DIR-ADMIN-TEST	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 7800310000000000e65c41771100557365727300640009000400efbe8158a93ae95c64682e000000880600000000010000000000000000003a00000000003b0b6b0055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\MRUListEx = ffffffff	Q-Dir.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Q-Dir-Admin-Test	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 19002f433a5c000000000000000000000000000000000000000000	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 = 7e00310000000000e65c2f7f11004465736b746f7000680009000400efbee65c4177e95c68682e0000005d0000000000020000000000000000003e000000000029a1d4004400650073006b0074006f007000000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370036003900000016000000	Q-Dir.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\NodeSlot = "2"	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0	Q-Dir.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6120	Q-Dir.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5640 wrote to memory of 5532	5640	2026-07-09_2312b01930374a038fd71a12d1240cde_amadey_elex_luca-stealer_njrat_smoke-loader.exe	88
PID 5532 wrote to memory of 6120	5532	setup.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-09_2312b01930374a038fd71a12d1240cde_amadey_elex_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_2312b01930374a038fd71a12d1240cde_amadey_elex_luca-stealer_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5640
- C:\Users\Admin\AppData\Local\Temp\7zS8065B319\setup.exe
  .\setup.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:5532
- - C:\Program Files\Q-Dir\Q-Dir.exe
    "C:\Program Files\Q-Dir\Q-Dir.exe"
    3⤵
    - Executes dropped EXE
    - Modifies Control Panel
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    PID:6120

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS8065B319\setup.exe
Size 1.8MB
SHA256 98b7edf8b4cf2b3da93a001b1e909d2195eebfa91742323473d9bc7e4bbdaa48
MD5 d49f1d732785e2e78f150bc53114c862
SHA1 3fb417b453ca26d0748175ea6b0c708cbb993fde
SHA512 2048c8a6cacbc44f9a481c00ee33cd78ca783a013895ed964ea79b815aae30d21f4e1bc6609181e4d4fd9c918d5722471c3b6e2694b11415e12b85d951e71bb5
SSDEEP 24576:MUK+cfYyt2FRwJpK2rVf1Y+9TGRHkXJILs2ToJpO93X0zA28dIsNoLs9Lqy:W+tRwJw2xNY+9TGREXyLscdIsNp
TLSH
T125955B52E6F14148E46FC176CEC6D723EB717D0A62318ABB4110FE152F767628E2932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Q-Dir.lnk

Path C:\Users\Admin\AppData\Local\Temp\Q-Dir_tmp_folder_2019\Q-Dir.lnk
Size 1KB
SHA256 5433083c6a05daa7b607224d64221bd042463e6845f23f792ff9b1d2b5395259
MD5 1ba2018a9f575d27486f41c97fce566d
SHA1 0d4a272e35755bf1db0a8ba50ec9df1322499151
SHA512 458a73f1607f709340e096e3bc26a3d1b447a84ed4c23c3080c72282d1070eae97064bf38318a47d28881dab409f75611f6f80a60447372ab43a4b05fa6913c6
TLSH
T17E31F2240F9F2B24F3A3C27117B186134237B800F6582F0D40875AA266B451066A9FAA
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 683B
SHA256 e812ab80c14a1b0c3e4430b3ccd5acee6a42676547d6432f66ebc6cfeca80eca
MD5 e0f2a7d5eecef420aa75dc466d99e1c2
SHA1 9dcf74e793fb48152a37f6be28b7628b880bfe44
SHA512 186b97e5c94312b33a47b4a346939fa2e4a98001287b54b77ad86d03599c63b807ef989965b06be5fad4fcc1b65294437a58db6a74dca95940f0eaf5e6a4afbe
TLSH
T11001995316C41E3F0440ABA3EB3291C868F6BE08F29AE55D59564C48CC4CD1B7D85F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 702B
SHA256 e6a7b242eb079c99f2f8a49e3923be65b87e00fee657c27302a47f6b36140e37
MD5 719e6488e66379113e31c3033d6b0473
SHA1 835a6c17ffa25672fc49340d08aea63b273d84fb
SHA512 e6c2dbb1ba2ff813aa27f63a2853fd0b9c58b771d1e95c6387367623aa29cbf2254177706a99a4181ce0dfe4922bbe76b0e1e87099b6db69b576b086f3b3d095
TLSH
T1F301765316C41E7F0440AAA3EB3291C868F6BE08F29AE95D59664C48CC4CD1BB985F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 730B
SHA256 ce6e69aff66b847a6a99f975d049b69c87c9b4576ed734bc86b15255b7058ffc
MD5 bd8fb75b59ed64d59fb8a1c5c1d6496b
SHA1 27470acb1c42f3421507fac56c6a4058d7480fe6
SHA512 a6e5edee04e12e3686cb27e69031af0a2d62189412919be32db561f6141190cadb8df1783a1eb9982fa6572b08386283aa36fe5d6ed4231c03a30cc99635e55b
TLSH
T10801CB5316C45E7F0441AA93EB3291C498F6BD08F25AF51D59670C08DC4DD1BB985F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 746B
SHA256 ba4cfa76684322e9fd453515bbf04efd08478a4b1e79c0972da6d75c5fd4fb81
MD5 c70a8feaac7eb997a35fcdb1e0810cee
SHA1 8e241ebf89740afbab65b3de25cdb6f70067ca3b
SHA512 0b8153031671668b61722dc47c68c7dc34848ae603c505c9e1efc448a249623813cebb78affec63861c07c94d993966b9e081aba9e9bd143743c1ceffaf87951
TLSH
T13401105306C41E7F0440AA93EB3251C858F67D08F25BF91D05570C08CC4CD1B7985F07
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 41B
SHA256 23fdb4bf2f8fbecbd66e1f0bbc7eabbd63894ccf1c2ee4b9fa85f15e0f43d760
MD5 f32cbf2b36e84be45e429d911c9a7b63
SHA1 4673d4c7e4c39c4bdacddebb0e4fbe5fddaa3a80
SHA512 4726c03d94f54faa8135a5e9738adb24288d1fcee2b871881f38ae032ae1aade39b0947215f6225f4e2a3cf4bfb3bb74ccc9865ad02fae0f9fbb7f17f46e10d9
MD5 SHA1 SHA512

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 661B
SHA256 d804cd88d3309575cf9a57a125509e27f9de3a6900dfba0da5b6e5f822409fce
MD5 2d34e31ba93c0231fd67999211927119
SHA1 5a643d1109f9e48d2da66e2418de9af48d638235
SHA512 65aa7b0ce943bb4b65cf58c35c51ea935e42768c4c1159589c1926742b97a7457c2e290c6f5b73d9ed1779d3c801cd72b36798998d78731f571f988f8ab13f68
TLSH
T19801994316C41E3F0440ABA3EB31518828F6BA08F28AE50D19564C48CC4CD1B7C81F0B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5532-6-0x0000000002320000-0x0000000002321000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads