e4c60d29cb8e4f41b97959f5931785837115f83898999d5e18a1cc4546217378

Analysis

max time kernel
150s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 13:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_126fdac167f432657ac00decf98db266_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Size 8.4MB
Sample260728-qdpgdahd76
SHA256 e4c60d29cb8e4f41b97959f5931785837115f83898999d5e18a1cc4546217378
MD5 126fdac167f432657ac00decf98db266
SHA1 0b6ceafffb460577f8560d6486258588716f5a4d
SHA512 e07308b7c458b7bc42e1ff8acae175a9ea853faec2c1a3130896bee95c17cd2879b3654a88cd05148f66ae857a4d7af719ce7b62d853e90f3639294a62e192b2
SSDEEP 196608:TOQpXDnxTu7J6uoyw7yBCDhoJM87zpXnCIXyFkhv:Bzndc6uPiyBOoJM87dXCIww
TLSH
T15D962290F225F459E7A50130882576B419662E303B55D9EBFE8F36D219382D3AEB1F33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery spyware

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4956	setup.exe
1292	Q-Dir.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe
File created	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe
File created	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_126fdac167f432657ac00decf98db266_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Control Panel\Colors	Q-Dir.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\TypedURLs	Q-Dir.exe

Modifies registry class 29 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\MRUListEx = ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 19002f433a5c000000000000000000000000000000000000000000	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 5000310000000000e95c397b100041646d696e003c0009000400efbee95c3172fc5c21692e00000053000000000002000000000000000000000000000000141ca800410064006d0069006e00000014000000	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Q-Dir.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\Q-DIR-ADMIN-TEST	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 = 7e00310000000000e95c8c7a11004465736b746f7000680009000400efbee95c3172fc5c2c692e0000005d0000000000020000000000000000003e0000000000ebe44c004400650073006b0074006f007000000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370036003900000016000000	Q-Dir.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Q-Dir-Admin-Test	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 7800310000000000e95c31721100557365727300640009000400efbe8158a93afc5c21692e000000880600000000010000000000000000003a00000000003ef0970055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	Q-Dir.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\NodeSlot = "2"	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Q-Dir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	Q-Dir.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1292	Q-Dir.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5996 wrote to memory of 4956	5996	2026-07-28_126fdac167f432657ac00decf98db266_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe	91
PID 4956 wrote to memory of 1292	4956	setup.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-07-28_126fdac167f432657ac00decf98db266_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_126fdac167f432657ac00decf98db266_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5996
- C:\Users\Admin\AppData\Local\Temp\7zSC67D2EB9\setup.exe
  .\setup.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\Program Files\Q-Dir\Q-Dir.exe
    "C:\Program Files\Q-Dir\Q-Dir.exe"
    3⤵
    - Executes dropped EXE
    - Modifies Control Panel
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    PID:1292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4116

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC67D2EB9\setup.exe
Size 1.8MB
SHA256 98b7edf8b4cf2b3da93a001b1e909d2195eebfa91742323473d9bc7e4bbdaa48
MD5 d49f1d732785e2e78f150bc53114c862
SHA1 3fb417b453ca26d0748175ea6b0c708cbb993fde
SHA512 2048c8a6cacbc44f9a481c00ee33cd78ca783a013895ed964ea79b815aae30d21f4e1bc6609181e4d4fd9c918d5722471c3b6e2694b11415e12b85d951e71bb5
SSDEEP 24576:MUK+cfYyt2FRwJpK2rVf1Y+9TGRHkXJILs2ToJpO93X0zA28dIsNoLs9Lqy:W+tRwJw2xNY+9TGREXyLscdIsNp
TLSH
T125955B52E6F14148E46FC176CEC6D723EB717D0A62318ABB4110FE152F767628E2932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Q-Dir.lnk

Path C:\Users\Admin\AppData\Local\Temp\Q-Dir_tmp_folder_2019\Q-Dir.lnk
Size 1KB
SHA256 4762d54f8735a7f78b0d73911bb1e100ed62828e3495c662eaf0923a6ab66c8b
MD5 a3cf1abd44830143d15d7c8e1185897b
SHA1 f19f980b293165dd5a779a8064658a4183abe028
SHA512 e0dc8b1fab0662c75b50651057f18287482ff8ea2c65b1ec61a329c57ef1fbe98d12a10c066f069597ab2c222db868ab8e36baba634a39d971ab36c397433bef
TLSH
T16031D6240F9F2B74F3E3C275177146134237B845F7592F4E408756A255B052062EDF5B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 683B
SHA256 6dd1a024ca8f135baa148a383cfcc3762aa1be1166becd5fecf32621648a2c77
MD5 6f9a20a6f4a1cd4a6084be159bddeb29
SHA1 3d8a8ce5273f9e47acb50ed4b40311817a3b7243
SHA512 541974eaa722dd9e5c3a867846a9e50a4005739e7aaf285246d4330c9fb821c5a4da4432a6637694e8b849d7174b206b839789ba092f81cb5375175696f4790a
TLSH
T1BF01995312C41E3F0440ABA3EB3291C868F6BE08F29AE54D59674C48CC4CD1B7D81F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 702B
SHA256 b58c9262760b8fce94d04981b5026d5718b9918dfef6b527f5a16b42e8204de9
MD5 0155242a440ef74889b1b6ac43317dc9
SHA1 852f4641b7d7c3e461dc118b12d102f577d4ad0c
SHA512 b2734579ecc17654298427d651f6ce184940d5ed4c073dfcc020a15ce5746180e2eb53e8ce83fec7dac7de9ba5232fa25902a815262ae606fc02b06fc3e4595e
TLSH
T1EE01765312C41E7F0440AAA3EB3291C868F6BE08F29AE94D59674C48CC4CD1BBA85F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 41B
SHA256 d129a85f0181a0da2605a4c2d2f007456e47e3e71025cb0554f8d2d5ae1015a2
MD5 04051927586448ca2bda2300631619a6
SHA1 f1a88758da0b1c8b4c80d5c1fc6aec019495335e
SHA512 f264786ed0e69eff2baa5e7cbf64ab1f20d1d3ab2a48cf43a98157382dfaf0dfb02dcd2f11f209fb24046af93c856d5d28c16171592319df75fc28b28582c0ff
MD5 SHA1 SHA512

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 730B
SHA256 3a4253bafc7a298a1cdd90892fc6579ddc6cffce768cf4db8436ce4b28f9ddb4
MD5 95271431a75c7e52df5bef0e9fdf7b7d
SHA1 1eb7e6bc3dbf555aab57cf15998632104bf488fc
SHA512 473c1206c668e2db7d54b8832b501a58adc599f0d9caf129dbafad92d8a17eae84a469f4f19d5d8b104487e8236d60a51f56f7f621464f9f017e3a1afb639b9f
TLSH
T11201CB5316C45E7F0441AA93EB3291C498F6BD09F25AF54D59670C08DC0DD1BB985F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 746B
SHA256 201d9f0838d91aafc9a2cf889dc5fa9c0de04e0641f6ca0b3666a019d75b3b0b
MD5 7b56cff6732c9d118676c90a80773431
SHA1 acb5e96f47c5e6c4b5b3afacfe0f52d796391715
SHA512 8ead8f45b0efe2e761b52e1d51625ab4fef560a17640a7a104faaad5b78b2542bf5469f0c02e7f6494bb87f157bf31eaa5288d836004418eaf553b18c0ab503b
TLSH
T16901105302C41E7F0440AA93EB3251C858F67D09F25BF94D05670C08CC4CD1B7985F07
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 661B
SHA256 076d7df76cae0c2a85416cfb0f07e5b5b51889bf8b457cc08edd0afa4ee04047
MD5 b0d773d58df0802d5970fb6bbb9e23a2
SHA1 1643f278e03130516aa046697ed956b799a695cf
SHA512 f65cfd2ef7357b06b54604334c04f8307913097b66271ec6957d266e8cf24a4c2e27cef9758bf575b37e89b4c267136b9f1a784bbb4c199b5a237af62323b7e4
TLSH
T12E017D5716C45E3F4440ABA3EB3151C868F6BE09F69BE54D55664C48CC4CD1B7D81F0B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4956-6-0x0000000002320000-0x0000000002321000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads