4c32a0937509410c09c2100b5b5c0111a156ff03afd412434655a444056442c2

Analysis

max time kernel
148s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 15:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_ef5925fb93195df6d561ad557ed8697d_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Size 8.4MB
Sample260712-s8j69aev4s
SHA256 4c32a0937509410c09c2100b5b5c0111a156ff03afd412434655a444056442c2
MD5 ef5925fb93195df6d561ad557ed8697d
SHA1 cbd2575811a9945dfc09838412068bbc5133ec02
SHA512 46f7a1f0e57e3635260083614ad6da141a1dc085ac02780bf1211ce195e50f5c33a60a18fa28441c59aed333fd58c1a242eceb8e54c29f79aa25832c9184715f
SSDEEP 196608:WLU4Kr3lqj+e9l0IlAbtYiacfhE7yy9EXV+p3TxeyPkk+XyFkhx:Ud9S4AbacZjyi+pFWrwW
TLSH
T1AC9622C0F221F558E3540171982976A4492A1A303755E9EBBF8F3AD159782E3EEB4F33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery spyware

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4100	setup.exe
4224	Q-Dir.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe
File created	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe
File created	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-12_ef5925fb93195df6d561ad557ed8697d_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Control Panel\Colors	Q-Dir.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\TypedURLs	Q-Dir.exe

Modifies registry class 29 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\NodeSlot = "2"	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Q-Dir.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Q-Dir-Admin-Test	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 7800310000000000ea5c945a1100557365727300640009000400efbe8158a93aec5cf87d2e000000880600000000010000000000000000003a00000000000ec3450055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Q-Dir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 = 7e00310000000000ea5c786311004465736b746f7000680009000400efbeea5c945aec5c067e2e0000005e0000000000020000000000000000003e0000000000b39788004400650073006b0074006f007000000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370036003900000016000000	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 19002f433a5c000000000000000000000000000000000000000000	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\Q-DIR-ADMIN-TEST	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\MRUListEx = ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 5000310000000000ea5c2464100041646d696e003c0009000400efbeea5c945aec5cf87d2e0000005400000000000200000000000000000000000000000025974400410064006d0069006e00000014000000	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0	Q-Dir.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4224	Q-Dir.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4252 wrote to memory of 4100	4252	2026-07-12_ef5925fb93195df6d561ad557ed8697d_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe	87
PID 4100 wrote to memory of 4224	4100	setup.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-12_ef5925fb93195df6d561ad557ed8697d_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_ef5925fb93195df6d561ad557ed8697d_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Users\Admin\AppData\Local\Temp\7zSC90BBDD8\setup.exe
  .\setup.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:4100
- - C:\Program Files\Q-Dir\Q-Dir.exe
    "C:\Program Files\Q-Dir\Q-Dir.exe"
    3⤵
    - Executes dropped EXE
    - Modifies Control Panel
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    PID:4224

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC90BBDD8\setup.exe
Size 1.8MB
SHA256 98b7edf8b4cf2b3da93a001b1e909d2195eebfa91742323473d9bc7e4bbdaa48
MD5 d49f1d732785e2e78f150bc53114c862
SHA1 3fb417b453ca26d0748175ea6b0c708cbb993fde
SHA512 2048c8a6cacbc44f9a481c00ee33cd78ca783a013895ed964ea79b815aae30d21f4e1bc6609181e4d4fd9c918d5722471c3b6e2694b11415e12b85d951e71bb5
SSDEEP 24576:MUK+cfYyt2FRwJpK2rVf1Y+9TGRHkXJILs2ToJpO93X0zA28dIsNoLs9Lqy:W+tRwJw2xNY+9TGREXyLscdIsNp
TLSH
T125955B52E6F14148E46FC176CEC6D723EB717D0A62318ABB4110FE152F767628E2932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Q-Dir.lnk

Path C:\Users\Admin\AppData\Local\Temp\Q-Dir_tmp_folder_2019\Q-Dir.lnk
Size 1KB
SHA256 88ffdd89d000f021792992159a457b4dc84d3c46c9b18d848af1892efbaef0fd
MD5 b7431c8897f4a460cac0b88ce207a83a
SHA1 8a6d01c95d7bb1caed447bed9958718c46588d61
SHA512 3bcf8a7567c92ed2a7d08c1714f30ca895d063f209a5326178bfc723af85d7dd82b718aa20aa51f237cb85f12b9c12bc0cbb3161a6f23ee406495ed94a73bf14
TLSH
T1D131F2240F9F2B20F3E2C275177246138237B805E75C2F4D40C75AA296B051162E9FAA
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 683B
SHA256 57d392289807ee85f829bac3bb36e8fd229a389a0dff73c288c340a901f8fbc5
MD5 3d471de1b691611430633fd2c36ed534
SHA1 871d3fa1e89a870c31445227ff7a302c33f3e454
SHA512 c90d8c6a2e984af1a535c807a6d89e3ab89c790db55e810e17c464145c6d6d4fc15e317034fd508d4f2cd8ffa8e61dcbd65b8d0f04b1821bedda766e90ee310e
TLSH
T1E201995306C41E3F0440ABA3EB3291C868F7BE08F29AE55D59564C48CC5CD1B7D85F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 702B
SHA256 dba5ffff4d8857c75153c376194cf33289b746e98f33205d0d6c9e9996d35b92
MD5 2df496d8afb1971b48083f80a186fd41
SHA1 33122705989ee70f043e9ea20bc70631db5844f6
SHA512 682b356f9f4ed2350b0903408249a1fab3a4cb163172676f22b1fd3eb4bfc3e94ac424681bea59f61dc33aec41cc87b06230f75d442def9dd97189f089d6ebfc
TLSH
T16D01765306C41E7F0440AAA3EB3291C868F7BE08F29AE95D59664C48CC5CD1BA985F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 730B
SHA256 64591b447b1b92c57585fcae294e329cdb0fb84b5643dbc7136bec86786044d6
MD5 fe88f9db8ed3e89ee8b5f6835b10f3d3
SHA1 810874317688863806f04e7a0ddb2f2c5d2bae8d
SHA512 7634d91793dd86206eaed0fde53174a699846948fa381fd7d5acdf5bdaf04707871937537e08f845e815a0e2d3bd9b4b37243f64a140bed5346dbcea269d3340
TLSH
T12101CB5306C55E7F0441AA93EB3291C498F7BD09F25AF50D59670C08DC0DD1BB985F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 746B
SHA256 1002bf686cbcec5e8506c28666c281d6595997a956f85af6a53036701c265bbc
MD5 33d341c08459f09a1f7818bb826117b4
SHA1 c079ddb09f6e393fd2e3e49233ca0fe502d6c270
SHA512 6f2a8de132b94f370bf472026d2c7153747b9f6bf2658bd8d1ce7e0eb5f0ed5097337658aaa85cbf708a7cbe565a6e9e587ecb94c6c95351868e6fa6f37b3a67
TLSH
T19201DC5306C41E7B0440AA93EB32918858F77D09F25AF90D05560C08CC4CD1B6985F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 41B
SHA256 d767e174e6045f8a17734e845c6027c64191b61cf70f08047a418a571abc2efd
MD5 517b43be20bba7ffa63d4905c3367019
SHA1 4a8ae494194e139ed13c39142672e51ca4ded029
SHA512 f1b0489d117f39f84ac455c0d8bc5af094c4ea87fafff6c8a1775672ab2eee72a355c593b9611263dfdd7faf8a3133d517252fa2dc068e3c23385c7cc8a63ce0
MD5 SHA1 SHA512

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 661B
SHA256 4fcd4a188cb9fd5341e9660e8c573562fe47cbd576c9461575959be552f8a0ae
MD5 3cbec1bc5733a1117e77b4aa4c2764d4
SHA1 b2338b1d770af9b08a4b5a134ae685e2249422cd
SHA512 bb98a411eb01a39aabb3284b19d8d04630dea2ec8527eaae077e62a4edf48703d0bb2dee6662e476efc1efe8b3988015963f468f5bd7a0a156b0122404602107
TLSH
T1CC01DD5306C41E3F0440ABA3EB31918828F7BE08F28BE50D15564C48CC0CD1B7C81F0B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4100-6-0x0000000000D80000-0x0000000000D81000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads