4c32a0937509410c09c2100b5b5c0111a156ff03afd412434655a444056442c2

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/07/2026, 15:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_ef5925fb93195df6d561ad557ed8697d_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Size 8.4MB
Sample260712-s8j69aev4s
SHA256 4c32a0937509410c09c2100b5b5c0111a156ff03afd412434655a444056442c2
MD5 ef5925fb93195df6d561ad557ed8697d
SHA1 cbd2575811a9945dfc09838412068bbc5133ec02
SHA512 46f7a1f0e57e3635260083614ad6da141a1dc085ac02780bf1211ce195e50f5c33a60a18fa28441c59aed333fd58c1a242eceb8e54c29f79aa25832c9184715f
SSDEEP 196608:WLU4Kr3lqj+e9l0IlAbtYiacfhE7yy9EXV+p3TxeyPkk+XyFkhx:Ud9S4AbacZjyi+pFWrwW
TLSH
T1AC9622C0F221F558E3540171982976A4492A1A303755E9EBBF8F3AD159782E3EEB4F33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	setup.exe

Executes dropped EXE 2 IoCs

pid	Process
1836	setup.exe
4972	Q-Dir.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe
File created	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe
File created	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe
File created	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-12_ef5925fb93195df6d561ad557ed8697d_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4184 wrote to memory of 1836	4184	2026-07-12_ef5925fb93195df6d561ad557ed8697d_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe	85
PID 1836 wrote to memory of 4972	1836	setup.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-12_ef5925fb93195df6d561ad557ed8697d_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_ef5925fb93195df6d561ad557ed8697d_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Users\Admin\AppData\Local\Temp\7zS85056958\setup.exe
  .\setup.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:1836
- - C:\Program Files\Q-Dir\Q-Dir.exe
    "C:\Program Files\Q-Dir\Q-Dir.exe"
    3⤵
    - Executes dropped EXE
    PID:4972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS85056958\setup.exe
Size 1.8MB
SHA256 98b7edf8b4cf2b3da93a001b1e909d2195eebfa91742323473d9bc7e4bbdaa48
MD5 d49f1d732785e2e78f150bc53114c862
SHA1 3fb417b453ca26d0748175ea6b0c708cbb993fde
SHA512 2048c8a6cacbc44f9a481c00ee33cd78ca783a013895ed964ea79b815aae30d21f4e1bc6609181e4d4fd9c918d5722471c3b6e2694b11415e12b85d951e71bb5
SSDEEP 24576:MUK+cfYyt2FRwJpK2rVf1Y+9TGRHkXJILs2ToJpO93X0zA28dIsNoLs9Lqy:W+tRwJw2xNY+9TGREXyLscdIsNp
TLSH
T125955B52E6F14148E46FC176CEC6D723EB717D0A62318ABB4110FE152F767628E2932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Q-Dir.lnk

Path C:\Users\Admin\AppData\Local\Temp\Q-Dir_tmp_folder_2019\Q-Dir.lnk
Size 1KB
SHA256 dadb0524dbd6a2909db8967a6947a581f008e33d162214c39943b2d052a78d71
MD5 0071950ed2262832eabb6c7ddb1697fe
SHA1 e284c3b72de5bd1c9c205303c633f61e8893d8c8
SHA512 5400942fc2af05a496f53180ed2168e9f4c1a888733b548fb48caf008d54fff38bc0217405810bd0d06012fb94e4c22b10526c4f5fb245566a294e3c868c88d8
TLSH
T16A3126140FDF2B35F3E2C17117B14713823BB840FB982F0A408757A255B051066ACFAA
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 41B
SHA256 b3e8ee24921caa066f9deccd731068ab947609cff2f233943bfb3ceddcff7f94
MD5 b01d6345f80d07f9a30f9b1f36820820
SHA1 39e383bab6ac1fd26f1784d18a91cb7481b82c0b
SHA512 1064fbd8865f5d917bda71250fa515086087066dde1449796783e5c959bd39f89ed9504842b5c359ca2a9fbb640b3aadbb55c05219b650b09b2ee6ec15c6a1a1
MD5 SHA1 SHA512

Submit Download

memory/1836-5-0x00000000021F0000-0x00000000021F1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads