925f3e6ad7bfbf52f13aa1a7fdacf58674de8bfa31c8069f3326aee8cba18f26

Analysis

max time kernel
150s
max time network
89s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 12:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_960e3b508716750f47ca25508f18a147_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Size 8.4MB
Sample260728-p4dbcsxarf
SHA256 925f3e6ad7bfbf52f13aa1a7fdacf58674de8bfa31c8069f3326aee8cba18f26
MD5 960e3b508716750f47ca25508f18a147
SHA1 a167b9e6aeddfad112b3ea58981f1609c4bf4fab
SHA512 49914472811834c1a094542afc62a7a647906eba0a653bb9477fd7586351959111fce9cd5f4632e77edd19de1ab2ea3f247a218db34d755f81fa535332b288f8
SSDEEP 196608:iZXybOcpAEhyO6Xd6Q1R+37nPnFKdKcpOz3ZFrbcZnUGKzxXyFkhW:YX4OC3MO6N605dK2ObIexwZ
TLSH
T1D69612D0B225F519E7A5017088247664192A1E303745E9EBFF8E3AD149782E3BEB5F33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery spyware

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4416	setup.exe
3488	Q-Dir.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe
File created	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe
File created	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_960e3b508716750f47ca25508f18a147_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Control Panel\Colors	Q-Dir.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\TypedURLs	Q-Dir.exe

Modifies registry class 29 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 19002f433a5c000000000000000000000000000000000000000000	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Q-Dir.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\Q-DIR-ADMIN-TEST	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	Q-Dir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	Q-Dir.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Q-Dir-Admin-Test	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\MRUListEx = ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 7800310000000000e95c31721100557365727300640009000400efbe8158a93afc5c97662e000000880600000000010000000000000000003a00000000007142520055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 5000310000000000e95c5d7b100041646d696e003c0009000400efbee95c3172fc5c97662e000000540000000000020000000000000000000000000000006c0f7200410064006d0069006e00000014000000	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 = 7e00310000000000e95cb37a11004465736b746f7000680009000400efbee95c3172fc5c9c662e0000005e0000000000020000000000000000003e0000000000590e5b004400650073006b0074006f007000000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370036003900000016000000	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Q-Dir.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\NodeSlot = "2"	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Q-Dir.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3488	Q-Dir.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5896 wrote to memory of 4416	5896	2026-07-28_960e3b508716750f47ca25508f18a147_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe	90
PID 4416 wrote to memory of 3488	4416	setup.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-07-28_960e3b508716750f47ca25508f18a147_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_960e3b508716750f47ca25508f18a147_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5896
- C:\Users\Admin\AppData\Local\Temp\7zS807C6219\setup.exe
  .\setup.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:4416
- - C:\Program Files\Q-Dir\Q-Dir.exe
    "C:\Program Files\Q-Dir\Q-Dir.exe"
    3⤵
    - Executes dropped EXE
    - Modifies Control Panel
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    PID:3488

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS807C6219\setup.exe
Size 1.8MB
SHA256 98b7edf8b4cf2b3da93a001b1e909d2195eebfa91742323473d9bc7e4bbdaa48
MD5 d49f1d732785e2e78f150bc53114c862
SHA1 3fb417b453ca26d0748175ea6b0c708cbb993fde
SHA512 2048c8a6cacbc44f9a481c00ee33cd78ca783a013895ed964ea79b815aae30d21f4e1bc6609181e4d4fd9c918d5722471c3b6e2694b11415e12b85d951e71bb5
SSDEEP 24576:MUK+cfYyt2FRwJpK2rVf1Y+9TGRHkXJILs2ToJpO93X0zA28dIsNoLs9Lqy:W+tRwJw2xNY+9TGREXyLscdIsNp
TLSH
T125955B52E6F14148E46FC176CEC6D723EB717D0A62318ABB4110FE152F767628E2932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Q-Dir.lnk

Path C:\Users\Admin\AppData\Local\Temp\Q-Dir_tmp_folder_2019\Q-Dir.lnk
Size 1KB
SHA256 2d626c5487be87b16c2d222ec00ef2d5ce0f2c2b27873b3fd4f0c04004a88e4d
MD5 3dbad7efc71175c2718135f30ee1f8b2
SHA1 2058da79554d4d20655df187edbd1d08bcdd17f5
SHA512 69640259989eeeb358c9738e1394c14dd12e2553029951dc89583032ebcdca8f004265fd4e9c870dc76bedce6ce17c757c4ae9aadb0f5f3ed74cee0966a7b8ca
TLSH
T17A3121240F9F2B24F3E2C271177247234237B801F7A82F0E40875AA269B152066ECF9B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 683B
SHA256 b3ee36b5928bd1b410fff8cfbe7f84d4b9e0217940e598745e4ec97368801a46
MD5 36734f9077534759de07a35f97080811
SHA1 aefcdd49bd4c0ce5ca216499728b410e60357382
SHA512 9fb1b1c449c652b366c22202e18bd253aed1368dc5aa8e80ddf5a8af851ecc7b71cc65d527a1cb68a1cdbb3ff7788bf440fc3ef3a79da0ffc467cb9f0b22eb29
TLSH
T13901995306C41E7F0480ABA3EB3291C868F6BE08F69AE54D59564C48CC4CD1B7D82F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 702B
SHA256 5bdbb72fd8dc7875b007ea91008911d29c50e7a39964be574abaaa97c21cdb69
MD5 37da9822f4961fef582f8fde72f3bece
SHA1 8351c537dc5cfa93fe8a0511f2145f9edbe213c2
SHA512 bef05495835dad5fb8a2563493059ccf38fa02b38aba10b8394dda93371bd75cf69aa30c03e620035b8142cdced970c7a5e3827f944518c3a101cd60883fa47c
TLSH
T18C017B5306C41E7F0440AA93EB3151C458F6BD48F65AE54D59565C48CC4CD1BBD85F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 730B
SHA256 ea96c3c442bb20830552148b02fab8806efa827336f2480b2ded5a83485efaf1
MD5 949ff0ea7fbf48fa1982eacc22e5b2b2
SHA1 04a45dc39fe3762034c664f2485510ffc58c841d
SHA512 16f735f84ae4ae68639494ebdeddda0e8f2ad4b6b28fc4b6ece0e4506c20a56c11fc5a65eab78204d4ebf34fd6421af983e6be1783bc5168939e62a5a055cbaf
TLSH
T15901CB5306C45E7F0441AA93EB3291C498F6BD48F65AF50D59670C08DC0DD1BBD86F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 746B
SHA256 546443f40f16380b2c95f2da0ccc03da7668b15f63a44dd1d026c8b1c98dadb8
MD5 9dcbbdf5df955815fa1bcd59ff5fc81f
SHA1 8445e57a440088475c6f76a94206020863bce4f4
SHA512 4306edfa8a750f7e2f77d5b88dcb8c51bc3d37c94a2a2c7d73309099728620c3cd11c645bce22d3483a251e7c8b14e8370ffed87828c2c263b69d983da96a889
TLSH
T12901DC5306C41E7B0440AA93EB32518858F67D08F65AF90D05560C08CC4CD1B6986F07
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 41B
SHA256 1159ef725cd906ca9150fccaf6dce97846fd49814e80ecf7b9a9d40e7713d868
MD5 a5c4ae5ee95532267eebf7e90db4e22e
SHA1 19e47322315dfcf63445d1f35d9d733ac0030e0d
SHA512 d071c31e5d2c0a904bbe138b4f902b99ed528f39b55b0a13f2f3bd63dd516e08fccea512e80a6cde2e694ee66a1bdf9679ff7181c4f6d759be2461f5781ed6e1
MD5 SHA1 SHA512

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 199B
SHA256 ae8b4688848bd9a8be37f4290c8fc35af06c8773a261faf959ea7cd7147268e8
MD5 adb89767708946ffec9601fae95630e0
SHA1 dbd64925b1f909c72bab2583df3024c6beb5d662
SHA512 8fe944963e6cf2163e1d86e5eb2b534aa366acd4bc6819142729a029a755f98cbeb927e22e79b1227c79afab2c20d3e216cb6fe51689dec8fd6c7546cdf1d9d0
TLSH
T117D0C77151C8574F4819F1E35775F18C9491D588EBE52A528A511CC85D5192CED4501D
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 661B
SHA256 bb6d7db4b7fd0666c75dbc4a4584e838193fc7ca9c014ddea23d6a8611608daa
MD5 f414693ab69f9044d408ba22acd04e76
SHA1 0efcfe1b16a4032c45b4cf784a829112fb702ba2
SHA512 d778d4da82668e56271bf7227491f2f2b85c0a677b0f95a009019d72f3f82f56b83de9ba4a914b3cdc5ba8d008385592f54d1fc63f8b82f410ab103ef4f6c70a
TLSH
T1A4017D5716C45E3F4480ABA3EB3151C868F6BE08F69BE54D55564C48CC4CD1B7D82F0B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4416-6-0x0000000002320000-0x0000000002321000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads