2c0ca85484eac1cb714e4145a9530a777541424ada47364674f35eb36966e1cf

Analysis

max time kernel
150s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 17:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_390a578e48ab728ba50102a134866ff8_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Size 8.4MB
Sample260712-vytn2set2r
SHA256 2c0ca85484eac1cb714e4145a9530a777541424ada47364674f35eb36966e1cf
MD5 390a578e48ab728ba50102a134866ff8
SHA1 b1e1738ce1b0babc36028a897c85ca4c1d06aef0
SHA512 4940f62c2b5dd016d9dc249256838e2f33f3730d6954baa5a5d649b9174290edc98a38409c0aff68a35586571faf2e7fc3c623602cd1fa33b3c7ae03f1bb3762
SSDEEP 196608:N8SelUwhx0rh7XJON1o4BJlniquWLEqR8gNFjMRE1AStXyFkhT:GlUW0dTJONrBLitWLE3mjFRwc
TLSH
T13B9612D4B225F558E7650130883836A4696A1D343745E9EBBF8F35C298386E2EDB0F73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery spyware

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2532	setup.exe
5908	Q-Dir.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe
File created	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe
File created	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe
File created	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-12_390a578e48ab728ba50102a134866ff8_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Control Panel\Colors	Q-Dir.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\TypedURLs	Q-Dir.exe

Modifies registry class 29 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Q-Dir.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\Q-DIR-ADMIN-TEST	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\MRUListEx = ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 = 7e00310000000000e95c357e11004465736b746f7000680009000400efbee95c2c72ec5c108b2e0000007c0000000000020000000000000000003e0000000000e9f0e8004400650073006b0074006f007000000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370036003900000016000000	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	Q-Dir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	Q-Dir.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Q-Dir-Admin-Test	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 19002f433a5c000000000000000000000000000000000000000000	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 7800310000000000e95c2c721100557365727300640009000400efbe8158a93aec5c0c8b2e000000880600000000010000000000000000003a0000000000d3c9990055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	Q-Dir.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\NodeSlot = "2"	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 5000310000000000e95ce17e100041646d696e003c0009000400efbee95c2c72ec5c0c8b2e00000072000000000002000000000000000000000000000000edfa4500410064006d0069006e00000014000000	Q-Dir.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5908	Q-Dir.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 2532	2312	2026-07-12_390a578e48ab728ba50102a134866ff8_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe	88
PID 2532 wrote to memory of 5908	2532	setup.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-12_390a578e48ab728ba50102a134866ff8_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_390a578e48ab728ba50102a134866ff8_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Users\Admin\AppData\Local\Temp\7zS809366D9\setup.exe
  .\setup.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Program Files\Q-Dir\Q-Dir.exe
    "C:\Program Files\Q-Dir\Q-Dir.exe"
    3⤵
    - Executes dropped EXE
    - Modifies Control Panel
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    PID:5908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4124

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS809366D9\setup.exe
Size 1.8MB
SHA256 98b7edf8b4cf2b3da93a001b1e909d2195eebfa91742323473d9bc7e4bbdaa48
MD5 d49f1d732785e2e78f150bc53114c862
SHA1 3fb417b453ca26d0748175ea6b0c708cbb993fde
SHA512 2048c8a6cacbc44f9a481c00ee33cd78ca783a013895ed964ea79b815aae30d21f4e1bc6609181e4d4fd9c918d5722471c3b6e2694b11415e12b85d951e71bb5
SSDEEP 24576:MUK+cfYyt2FRwJpK2rVf1Y+9TGRHkXJILs2ToJpO93X0zA28dIsNoLs9Lqy:W+tRwJw2xNY+9TGREXyLscdIsNp
TLSH
T125955B52E6F14148E46FC176CEC6D723EB717D0A62318ABB4110FE152F767628E2932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Q-Dir.lnk

Path C:\Users\Admin\AppData\Local\Temp\Q-Dir_tmp_folder_2019\Q-Dir.lnk
Size 1KB
SHA256 805b7ef1237b7c701e0ff2c41e4dc031fccc7319194882e6913d4ec8586dac17
MD5 43bbedc79dcaec8c6eb7eb52c1a21234
SHA1 dd6ed3239f9f3be0b2be63374fa1a317ab8217a5
SHA512 62aa9dd35aee0fb229fcbc2a8ea47ad5878935ce0542f7a3903ec2b91f2e5b0ee7cbda7b2d65f360becc0cf2b1a4beeabbb340bf019202e4cb47852815a1dfcb
TLSH
T18C31D6240F9F2B64F3E3C271177546134237B844F7682F4E40875AA25AF092052E9F5F
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 702B
SHA256 27e96f701cb0226e43c8ebb8eb942b7722b21ed571f0a26270093315c54ea16a
MD5 ddf01df7401d71a41aba21c448c1f7a8
SHA1 146b88c4eb7705e0073d5909f4e431db81e8b79f
SHA512 c3e91b6bf5c79d6c4e866538c7308151bb6077f090c6f8c6996f2f3e6386783208e47d4e9d29bd409e33d15421b30f5761f32fa8ed0fa1d6b23d1ff4949810cb
TLSH
T1AE017B5312C41E7F0441AA93EB3191C458F6BD08F25AE54D59665C48CC4CD1BA945F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 730B
SHA256 dd75fc53ac3685cfe1e3e0cdf712b3fba8584eb0e64feaa8b5b95af89fe31822
MD5 a0f40e9c2f00240815b6fddd8fae9817
SHA1 02b098e2e80340f495f52e76fad8ec21c286019a
SHA512 5dc4e00d1e823e096e0313806af9b64667689e48a54877a9eee75ca9593a7cf23af32f3efdf5b071bef86850fa870662a671506905b0a7bfe900790b006ac3c2
TLSH
T1DE01CB5316C45E7F0441AA93EB3291C498F6BD08F25AF54D5A670C08DC0DD1BB985F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 746B
SHA256 6908562eab985d56c7e70d28c1cf4dcc7b841ecbe9281bd7afd7fa45ce3c87c0
MD5 77bc38b21e3f74e40f934be01afbdcd7
SHA1 86f1ef4e4e3cc7a9c1857ef26bdac022fefc54e7
SHA512 f0e5193e030cf99540aaf1db9fb281b8fd3c5091316467f35d850ef1bf0d3afb74a6ce1f255c62e516ebe3a55919ebaeb9e683e407871bc5327c5e17427148b2
TLSH
T13101105302C41E7F0441AA93EB3291C858F6BD08F25BF94D06670C08CC4CD1B7985F07
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 41B
SHA256 4235e8c73ae1281432e980805602e4ee94eff89dc86d4d7b6a4b1e1385da673f
MD5 b099ae4012b0d5ecc0df2bff233d1c56
SHA1 e1a1bbbb6b5d4d1c9c5ef2d218efd1c5777e437e
SHA512 b604da0b9d020795e9fba1424e6d3fd744045ec19636bce931de69ccdad483370301f22b579d3eb86b75fce42f5d400873acbc871582d23f2c584b4d6e4004f6
MD5 SHA1 SHA512

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 661B
SHA256 fe43d7cd3ecf42c8f223d701b63fd88bee5692c36729af4c65a08420d7d7358d
MD5 e913096ab53a7c6ac779b4208c57fd32
SHA1 f35a882846baf4de73d0831eaf2345c3a4bf098d
SHA512 fc02b5207af3301bedaa4bc8aaf3c53896c4f5cb871b9b8dc31ad0cddffdea82e43a9fb926e25b72912d9e461e569c9a63a9fb820ae48a8f88916136cd7bdd50
TLSH
T115017D5716C45E3F5480ABA3EB31918868F6BE08F69BE54E55664C48CC4CD1B7D81F0B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2532-6-0x0000000002330000-0x0000000002331000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads