d75e6ca0ca5a8062dda2564a81126b726d1db96cf6f8fd10d58fd96a0f75c4cd

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/07/2026, 03:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_4be4445235fd8361285eb2d24fd7add5_amadey_elex_luca-stealer_njrat_smoke-loader.exe
Size 12.1MB
Sample260718-ej7pcsfw8p
SHA256 d75e6ca0ca5a8062dda2564a81126b726d1db96cf6f8fd10d58fd96a0f75c4cd
MD5 4be4445235fd8361285eb2d24fd7add5
SHA1 67b3c170fab9c4fc7a5d641907632a6a3b959460
SHA512 93847bdbead5da182778a91ea5ad33b7a1487398d48d38a822544f6de662a1e03290e0b7f7a889061a9399a299e606bd67f290e0bc8dd8ed26b798d493f8a557
SSDEEP 196608:p4J6+jJOW8gCr5eNofOBy75dLOPwCymSE7ejAUTiXyFkhW:OAv7gCr5eQk0O1lej9iwl
TLSH
T116D6F120F215F019F8B605B199FD9699605CBB300B1844DBB2887EFEEB79AD17D31263
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	setup.exe

Executes dropped EXE 2 IoCs

pid	Process
2076	setup.exe
3528	Q-Dir.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe
File created	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe
File created	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe
File created	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_4be4445235fd8361285eb2d24fd7add5_amadey_elex_luca-stealer_njrat_smoke-loader.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 2076	2428	2026-07-17_4be4445235fd8361285eb2d24fd7add5_amadey_elex_luca-stealer_njrat_smoke-loader.exe	86
PID 2076 wrote to memory of 3528	2076	setup.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-17_4be4445235fd8361285eb2d24fd7add5_amadey_elex_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_4be4445235fd8361285eb2d24fd7add5_amadey_elex_luca-stealer_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Users\Admin\AppData\Local\Temp\7zSC791C658\setup.exe
  .\setup.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:2076
- - C:\Program Files\Q-Dir\Q-Dir.exe
    "C:\Program Files\Q-Dir\Q-Dir.exe"
    3⤵
    - Executes dropped EXE
    PID:3528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC791C658\setup.exe
Size 1.8MB
SHA256 98b7edf8b4cf2b3da93a001b1e909d2195eebfa91742323473d9bc7e4bbdaa48
MD5 d49f1d732785e2e78f150bc53114c862
SHA1 3fb417b453ca26d0748175ea6b0c708cbb993fde
SHA512 2048c8a6cacbc44f9a481c00ee33cd78ca783a013895ed964ea79b815aae30d21f4e1bc6609181e4d4fd9c918d5722471c3b6e2694b11415e12b85d951e71bb5
SSDEEP 24576:MUK+cfYyt2FRwJpK2rVf1Y+9TGRHkXJILs2ToJpO93X0zA28dIsNoLs9Lqy:W+tRwJw2xNY+9TGREXyLscdIsNp
TLSH
T125955B52E6F14148E46FC176CEC6D723EB717D0A62318ABB4110FE152F767628E2932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Q-Dir.lnk

Path C:\Users\Admin\AppData\Local\Temp\Q-Dir_tmp_folder_2019\Q-Dir.lnk
Size 1KB
SHA256 deb5af42d5ef5d863e53dba3d6b3b94467fcd3f6d703506c7639749c68a4fc64
MD5 9c2a4b1ae015df33237ca51e544b2fd9
SHA1 45c4c2f45182f3d73cd85e250a8f06852fcd7eee
SHA512 75c4a7c3000b79551f90a54fd44786b4e84148fc8efe2669b4f61b66cff83d990f33c4871aafcbc1b759d18ba65b913ec8e4f455fa900f777b2051221c48f7b7
TLSH
T16E31D6240FDF2B74F3E2C171577146134637B800FB582F49409756A256B551162ADF9B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 41B
SHA256 546dc8abfe1cb45aef715e7d31d6b91b5e46057a5e730d9343c967a82581af88
MD5 7be4f1de5edac70b354971d3372e2d20
SHA1 0bfa623ea77e4b7b25d4a960cce9005b97f5068d
SHA512 66ecba341429cd3c730e33e62b4725ad3ecbecafa917c89d784cddbb00f34fe1b1c80de21a0eb65f9bb4fceaadb2cb1e390ea3eb6fac6ed0e4f130256e46371b
MD5 SHA1 SHA512

Submit Download

memory/2076-5-0x0000000002360000-0x0000000002361000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads