f81cc395828402b5a03f61dc9070747ee1d7dc9d2c031ce23f1a78e2ffe2e895

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 06:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_994ed6ae5cc111a53719be465c8fa20a_amadey_elex_luca-stealer_njrat_smoke-loader.exe
Size 12.2MB
Sample260718-hsgfbabv4q
SHA256 f81cc395828402b5a03f61dc9070747ee1d7dc9d2c031ce23f1a78e2ffe2e895
MD5 994ed6ae5cc111a53719be465c8fa20a
SHA1 dab3de909c0e8e613ff875eaab9ad8d64a960e2b
SHA512 87ab92e07a98e836a4fe03d2cc5744eb3c70a5e45d866915dddcc480111da71eed45260db8b0a4e2f600c1c98cbaebb260394454cb969daa4bd5d11212b981a3
SSDEEP 393216:1SQcsNd8QOnqV4hQnnDLW30mOJ3DgFvdvGwW:U8NdenqV4enDCkm8zE1pW
TLSH
T153D6F120E301E019FC6743B19AFD959D68587A301B1888E772887FFEDA792D17D36263
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery spyware

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2736	setup.exe
3452	Q-Dir.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe
File created	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe
File created	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_994ed6ae5cc111a53719be465c8fa20a_amadey_elex_luca-stealer_njrat_smoke-loader.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Control Panel\Colors	Q-Dir.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\TypedURLs	Q-Dir.exe

Modifies registry class 29 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Q-Dir-Admin-Test	Q-Dir.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\Q-DIR-ADMIN-TEST	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Q-Dir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 19002f433a5c000000000000000000000000000000000000000000	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 7800310000000000ea5c945a1100557365727300640009000400efbe8158a93af25c7c372e000000880600000000010000000000000000003a00000000000ec3450055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\MRUListEx = ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 5000310000000000ea5cb161100041646d696e003c0009000400efbeea5c945af25c7c372e000000540000000000020000000000000000000000000000009d685d00410064006d0069006e00000014000000	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0	Q-Dir.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\NodeSlot = "2"	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 = 7e00310000000000ea5c0a6111004465736b746f7000680009000400efbeea5c945af25c02382e0000005e0000000000020000000000000000003e000000000083c8e3004400650073006b0074006f007000000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370036003900000016000000	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = 00000000ffffffff	Q-Dir.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3452	Q-Dir.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3104 wrote to memory of 2736	3104	2026-07-18_994ed6ae5cc111a53719be465c8fa20a_amadey_elex_luca-stealer_njrat_smoke-loader.exe	89
PID 2736 wrote to memory of 3452	2736	setup.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-18_994ed6ae5cc111a53719be465c8fa20a_amadey_elex_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_994ed6ae5cc111a53719be465c8fa20a_amadey_elex_luca-stealer_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3104
- C:\Users\Admin\AppData\Local\Temp\7zS02CE5B29\setup.exe
  .\setup.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Program Files\Q-Dir\Q-Dir.exe
    "C:\Program Files\Q-Dir\Q-Dir.exe"
    3⤵
    - Executes dropped EXE
    - Modifies Control Panel
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    PID:3452

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS02CE5B29\setup.exe
Size 1.8MB
SHA256 98b7edf8b4cf2b3da93a001b1e909d2195eebfa91742323473d9bc7e4bbdaa48
MD5 d49f1d732785e2e78f150bc53114c862
SHA1 3fb417b453ca26d0748175ea6b0c708cbb993fde
SHA512 2048c8a6cacbc44f9a481c00ee33cd78ca783a013895ed964ea79b815aae30d21f4e1bc6609181e4d4fd9c918d5722471c3b6e2694b11415e12b85d951e71bb5
SSDEEP 24576:MUK+cfYyt2FRwJpK2rVf1Y+9TGRHkXJILs2ToJpO93X0zA28dIsNoLs9Lqy:W+tRwJw2xNY+9TGREXyLscdIsNp
TLSH
T125955B52E6F14148E46FC176CEC6D723EB717D0A62318ABB4110FE152F767628E2932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Q-Dir.lnk

Path C:\Users\Admin\AppData\Local\Temp\Q-Dir_tmp_folder_2019\Q-Dir.lnk
Size 1KB
SHA256 88ffdd89d000f021792992159a457b4dc84d3c46c9b18d848af1892efbaef0fd
MD5 b7431c8897f4a460cac0b88ce207a83a
SHA1 8a6d01c95d7bb1caed447bed9958718c46588d61
SHA512 3bcf8a7567c92ed2a7d08c1714f30ca895d063f209a5326178bfc723af85d7dd82b718aa20aa51f237cb85f12b9c12bc0cbb3161a6f23ee406495ed94a73bf14
TLSH
T1D131F2240F9F2B20F3E2C275177246138237B805E75C2F4D40C75AA296B051162E9FAA
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 683B
SHA256 0eb845261e6d973e6919526c38bbb44f7fe161051ff7b7d52126bd11ef36c42b
MD5 4dfb075bb5f2cf5dacac84942e388119
SHA1 d451ea6b9b261bf15003d41621782613e4bc731f
SHA512 7b8ea6c6ded36028ee5350e7ec372aa59b7d0072ac22a5a20f289683d19ba44137276704b712b54bae3a512b462ef66990acf2313ea224cf9f816f4be529d5b4
TLSH
T12701995302C45E3F4441ABA3EB3291C868F6BE08F69AE55D59564C48CC5CD1B7D81F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 702B
SHA256 e695cb047d33691eb0f49e45776263b719776c56b0de7b6dd26a0b2bc962e450
MD5 4a375a2f739a347eb209c94f3c6b91e8
SHA1 39cdb266f75ed18259442277fd39b6e502474f6b
SHA512 672445a19c4af117fd782ec80804902b87f9f08aea4d860a4b2db2318482e138c0aafb10845019195e2ee43d643607ffa8862f96ee7d4d48f3311cc160458346
TLSH
T12701C65302C41E7F0440AAA3EB3291C868F6BE08F29AE90D59660C48CC0CC1BB981F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 730B
SHA256 0ea1cb7305ad3c43a22143ad2917a58ee8985cfa56fb400023f88c10f980578e
MD5 e033939118bb87217fb80b9403daa6cd
SHA1 c7d16180725e4c6a3bc37010c0c5fde62c0a9704
SHA512 b97189af28c40b6f4d0f484b00c8c68147469211189adb140d781114e0cfbff4ee7afdd0e00f0467114e67ea63d5e2c8f18942bc4774d117aeeffb12a514863f
TLSH
T1B4011B1302C05E7F0441AAA3EB3291C498F2BE08F24AF50D59670C08CC0CD1BB981F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 746B
SHA256 76ad1588d208c550ee98975bbaeabe0a67c5a7ea7375c8bbb0dce8d87e9b21a6
MD5 20ca35a013a22de3275589ce37b0dbe4
SHA1 03757bf756126d9fb368438d7640bc85febe6701
SHA512 727cbc0c29370c6fcf740aed0815fd1e20c0eed81a318aed2f379a59bce7d5d08fdebabb5a649dedc0e377d02b74768c73689803bb8076743c5636f897725df0
TLSH
T1DD01105302C45E7F0441AA93EB3251C858F67D08F65BF91D55570C08CC4CD1B7985F07
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 41B
SHA256 825abce3fd5d1f7d47a0924a8a65a06fe1c7d3c175c81684c934effd781e8887
MD5 66c7b58a475523079f781ba437bc92d9
SHA1 46aba60edc74458343849f7d5abb1c4c90c37a43
SHA512 fc512eb0ac97eb141f0d26b84fd261587320d18412c0d049684d68f8829a8bcd136f77d1c67d527e40f24d247ecc89a26dc1615afeb7bcaf28024ca3facda7ca
MD5 SHA1 SHA512

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 661B
SHA256 79e842c0fb4d7d325bb77eaa6ec30ac3ee06351e833d0c39040f153bbbc39afb
MD5 ac41eef6fed2b7ff142cb72f374d2c16
SHA1 92e30d3463b80f37c3635db3dad7505ced8d0d89
SHA512 22cdc6dc4ecca20ad3175cadc3898120b05ee1cf30344bde873893f36f81f223c083bdcec58d1ecb83d57e7158404bbd0c7ec2d78e3f49b0a1ddad90bc21ee07
TLSH
T1CE01995302C45E3B4440ABA3EB31518828F6BA08F68AE50D55564C48CC0CC1B7C81F0B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2736-6-0x0000000002400000-0x0000000002401000-memory.dmp

Download

memory/2736-21-0x0000000000960000-0x0000000000B2A000-memory.dmp

Download

memory/3452-248-0x0000000000970000-0x0000000000B3A000-memory.dmp

Download

memory/3452-255-0x0000000000970000-0x0000000000B3A000-memory.dmp

Download

memory/3452-246-0x0000000000970000-0x0000000000B3A000-memory.dmp

Download

memory/3452-249-0x0000000000970000-0x0000000000B3A000-memory.dmp

Download

memory/3452-250-0x0000000000970000-0x0000000000B3A000-memory.dmp

Download

memory/3452-253-0x0000000000970000-0x0000000000B3A000-memory.dmp

Download

memory/3452-254-0x0000000000970000-0x0000000000B3A000-memory.dmp

Download

memory/3452-247-0x0000000000970000-0x0000000000B3A000-memory.dmp

Download

memory/3452-256-0x0000000000970000-0x0000000000B3A000-memory.dmp

Download

memory/3452-257-0x0000000000970000-0x0000000000B3A000-memory.dmp

Download

memory/3452-258-0x0000000000970000-0x0000000000B3A000-memory.dmp

Download

memory/3452-259-0x0000000000970000-0x0000000000B3A000-memory.dmp

Download

memory/3452-260-0x0000000000970000-0x0000000000B3A000-memory.dmp

Download

memory/3452-261-0x0000000000970000-0x0000000000B3A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads