03293d76fddd4b3e4ffb674849242db9815a9872977aac51822403a2d77b791b

Analysis

max time kernel
150s
max time network
86s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 15:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_d85416f811e2b0188c1c4eeeea1c4eec_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Size 8.4MB
Sample260712-teev4sew9w
SHA256 03293d76fddd4b3e4ffb674849242db9815a9872977aac51822403a2d77b791b
MD5 d85416f811e2b0188c1c4eeeea1c4eec
SHA1 593652c28f9acc347f8459529082ceae9da77c66
SHA512 eba4d9026e0cf44b198473bb5d4cafcb9675e979b481211f7c03496126ffeab212059819f83dbb27d79b7cede19e66220bdb9071e65cbf551aa2eabab336affa
SSDEEP 196608:xIMCYrcYnzG7l4/LjGrJkEjwi6u/k9md/T+0vhXyFkhp:xn7/Lw2E0u8k/T+0pwW
TLSH
T1AE9622D0F625F628E3650030582936A459666A303714D9EBFE8F36D649386D3EEB1F33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery spyware

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4868	setup.exe
5852	Q-Dir.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe
File created	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe
File created	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe
File created	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-12_d85416f811e2b0188c1c4eeeea1c4eec_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Control Panel\Colors	Q-Dir.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\TypedURLs	Q-Dir.exe

Modifies registry class 29 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\NodeSlot = "2"	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 5000310000000000ea5ccd61100041646d696e003c0009000400efbeea5cfa58ec5c427f2e00000054000000000002000000000000000000000000000000abeb9500410064006d0069006e00000014000000	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Q-Dir-Admin-Test	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 7800310000000000ea5cfa581100557365727300640009000400efbe8158a93aec5c427f2e000000880600000000010000000000000000003a00000000003ca4760055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 = 7e00310000000000ea5c206111004465736b746f7000680009000400efbeea5cfa58ec5c477f2e0000005e0000000000020000000000000000003e0000000000503fc1004400650073006b0074006f007000000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370036003900000016000000	Q-Dir.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\Q-DIR-ADMIN-TEST	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\MRUListEx = ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 19002f433a5c000000000000000000000000000000000000000000	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	Q-Dir.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5852	Q-Dir.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 4868	832	2026-07-12_d85416f811e2b0188c1c4eeeea1c4eec_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe	87
PID 4868 wrote to memory of 5852	4868	setup.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-12_d85416f811e2b0188c1c4eeeea1c4eec_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_d85416f811e2b0188c1c4eeeea1c4eec_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:832
- C:\Users\Admin\AppData\Local\Temp\7zS043DFCC8\setup.exe
  .\setup.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Program Files\Q-Dir\Q-Dir.exe
    "C:\Program Files\Q-Dir\Q-Dir.exe"
    3⤵
    - Executes dropped EXE
    - Modifies Control Panel
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    PID:5852

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS043DFCC8\setup.exe
Size 1.8MB
SHA256 98b7edf8b4cf2b3da93a001b1e909d2195eebfa91742323473d9bc7e4bbdaa48
MD5 d49f1d732785e2e78f150bc53114c862
SHA1 3fb417b453ca26d0748175ea6b0c708cbb993fde
SHA512 2048c8a6cacbc44f9a481c00ee33cd78ca783a013895ed964ea79b815aae30d21f4e1bc6609181e4d4fd9c918d5722471c3b6e2694b11415e12b85d951e71bb5
SSDEEP 24576:MUK+cfYyt2FRwJpK2rVf1Y+9TGRHkXJILs2ToJpO93X0zA28dIsNoLs9Lqy:W+tRwJw2xNY+9TGREXyLscdIsNp
TLSH
T125955B52E6F14148E46FC176CEC6D723EB717D0A62318ABB4110FE152F767628E2932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Q-Dir.lnk

Path C:\Users\Admin\AppData\Local\Temp\Q-Dir_tmp_folder_2019\Q-Dir.lnk
Size 1KB
SHA256 5086ccc7ffd3b9a916ee551baf2f476334bc5005f01664010050e0bba8d55c1a
MD5 d476f29187123868f910db263e09ee5d
SHA1 2b695033d0c67049030fac1c5b8a528a0af5a235
SHA512 6d9a557743395fa668630c4b3c412e03b61eb1268ef4cd9ca1a9100a362a6e2bc5aa4ec1bcff722b1ed56a37edb4ff73ecd053713f76ef7ab7aa528c7eab4383
TLSH
T1973121240F9F2B24F3E2C275177246238237B815F7582F59408B56A259B192062EDF9A
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 683B
SHA256 6a85746b0ebe1c33a1e70b348809526f2fec85497e7e1b659c92ab7091765937
MD5 a10dd6dbfa21fa10f3845b216a1ed6ff
SHA1 426f4b803f94b1abded68c55bbef8d9fd1881119
SHA512 2c0fcde5c6e3d55b30a6f63328bf847f318920c27defdc4f9654e4dae607609778ddb055894ad070674cd5f5c10c986edb8c87aa7c1fb98de4669569b3dda608
TLSH
T15B01995312C41E7F0441ABA3EB3291C868F6BE08F29AE64E59564C48CC4CD1BBD81F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 702B
SHA256 5a83e2028a18350c6e58585d2af7285b2cf1e429d07c8cf85e8db37b38ee2e0c
MD5 893cb4fa915ee3518f91b80b731382df
SHA1 b1ff30cd97d55bc441c7774f871243661e23ba62
SHA512 b4f1c5c6d99f5e40a993c9b2f08560bfb082a7f90be4f8ba54f975e93d20799afb11c941e4e52b1ae32546857842caa347d832ddb3522fac46a3500c1fa94b1a
TLSH
T17D017B5312C41E7F0441AA53EB3151C458F6BD08F25AE54D59564C48CC4CD1BA945F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 730B
SHA256 af9eb641946344272b1f6612b8c7a5009c69bbfe2b7c2138f12e5fcaea9aa001
MD5 ac8223fab53b6f46eaf4661aafbfda06
SHA1 58c59240a7520ae977d43cba9e18f601e95672f2
SHA512 0a1095ac13013ceaa9698718aa47b47cedbf45ec120a1dd7a8398ccf2bc385087117e74b46a49420e83eb84ae48e66a725e1dbbbe22b0c282de73e460cb5393f
TLSH
T1F201CB5316C55E7F0441AA93EB3291C498F6BD09F25AF50E59670C48DC0DD1BB985F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 746B
SHA256 b20cc93abfd14caf07be2ff36fa4a4a87741c0eb30580bfa68ccf44dc2410fb7
MD5 f6af88a83cd220a4909915200b18b287
SHA1 b83b7e31181b7673d10800e226513b24125a5f7f
SHA512 5b80d4831ead51b0b49e1ed21125e3a37fca06d3ce4531638093ee6026e456873e7ca4e4064a9b22c2aafe08c40e1a906e40fb708c4746fe292f3e777972036f
TLSH
T12F01105302C41E7F0441AA93EB3251C858F67D09F25BF90E05570C08CC4CD1BB985F07
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 41B
SHA256 c607f7fed8f1f9c408ac8119d67d9ed40b0b23053be4d95ac0511c80f418d19c
MD5 6dc4d444a6c05579f85a9881d355d1d0
SHA1 5710ab830848bb5c4277c92214bc093c3c88af80
SHA512 bc24582899e186ce1e4468685f5fc19a5b99bb353f30449a3f3fc5a18daf48ffbc549d63f3edd11d460568b2746af7c9b420a2a350dad06a3f48dd2843962a87
MD5 SHA1 SHA512

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 661B
SHA256 3458af93498309363a6582f2d844ba37e41ca1ca88a32fd714b83a96ac384f56
MD5 93c19c4b5efef3ce521d0fe0e765ab63
SHA1 8dff7c2f24c985b6f581091072e1ecea2a647138
SHA512 241fae39cfd49cc7c6067deaa71b4d60f24a4bbe49db50215c4aba81bdeee145585b3f80732e0ee713fce936867a328c3ecfffc64c5d7d5948fda62872cbe22b
TLSH
T12201DD5312C41E3F0440AFA3EB31518828F6BE08F28BE60E15564C48CC0CD1B7D81F0B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4868-6-0x00000000021A0000-0x00000000021A1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads