ffa8c9d92089b13bbc2649daaead92cb39aefaea36533ae99edf20fbcc33c3ff

Analysis

max time kernel
164s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 18:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_65f4d07abb8cfe4fa1e8227a92b69046_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Size 8.4MB
Sample260728-xc4m8svthy
SHA256 ffa8c9d92089b13bbc2649daaead92cb39aefaea36533ae99edf20fbcc33c3ff
MD5 65f4d07abb8cfe4fa1e8227a92b69046
SHA1 cf07fb44505186fb56ef1a3871c50a3325ce2c41
SHA512 5be32c052899c1ad22fcda1c7a835ad5c30bcd0b7c894c872f0cbf8a0458eb1ea5c0229544d0662043594f0eff987cb2a348229bf627eb3162d5067042065cf9
SSDEEP 196608:N3g0Qv2GAaKr2KITfPtfvHRiLXczikKIxDHV0oXyFkhFBJ:pEO1r2hRKgiK1VfwEBJ
TLSH
T1159612C5F224F518E3A50030982876A459662D303B55D9E7BE8F3AD249742E3AEF1F73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery spyware

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4304	setup.exe
3428	Q-Dir.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe
File created	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe
File created	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe
File created	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_65f4d07abb8cfe4fa1e8227a92b69046_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Control Panel\Colors	Q-Dir.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\TypedURLs	Q-Dir.exe

Modifies registry class 29 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\NodeSlot = "2"	Q-Dir.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\Q-DIR-ADMIN-TEST	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 = 7e00310000000000ea5c0a6611004465736b746f7000680009000400efbeea5c945afc5c85952e0000005e0000000000020000000000000000003e0000000000b2f118004400650073006b0074006f007000000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370036003900000016000000	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 7800310000000000ea5c945a1100557365727300640009000400efbe8158a93afc5c74952e000000880600000000010000000000000000003a00000000000ec3450055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\MRUListEx = ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 5000310000000000ea5cb566100041646d696e003c0009000400efbeea5c945afc5c74952e000000540000000000020000000000000000000000000000000c09e500410064006d0069006e00000014000000	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Q-Dir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	Q-Dir.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Q-Dir-Admin-Test	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 19002f433a5c000000000000000000000000000000000000000000	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = 00000000ffffffff	Q-Dir.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3428	Q-Dir.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 4304	4868	2026-07-28_65f4d07abb8cfe4fa1e8227a92b69046_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe	90
PID 4304 wrote to memory of 3428	4304	setup.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-07-28_65f4d07abb8cfe4fa1e8227a92b69046_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_65f4d07abb8cfe4fa1e8227a92b69046_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Users\Admin\AppData\Local\Temp\7zS403A42A9\setup.exe
  .\setup.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\Program Files\Q-Dir\Q-Dir.exe
    "C:\Program Files\Q-Dir\Q-Dir.exe"
    3⤵
    - Executes dropped EXE
    - Modifies Control Panel
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    PID:3428

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS403A42A9\setup.exe
Size 1.8MB
SHA256 98b7edf8b4cf2b3da93a001b1e909d2195eebfa91742323473d9bc7e4bbdaa48
MD5 d49f1d732785e2e78f150bc53114c862
SHA1 3fb417b453ca26d0748175ea6b0c708cbb993fde
SHA512 2048c8a6cacbc44f9a481c00ee33cd78ca783a013895ed964ea79b815aae30d21f4e1bc6609181e4d4fd9c918d5722471c3b6e2694b11415e12b85d951e71bb5
SSDEEP 24576:MUK+cfYyt2FRwJpK2rVf1Y+9TGRHkXJILs2ToJpO93X0zA28dIsNoLs9Lqy:W+tRwJw2xNY+9TGREXyLscdIsNp
TLSH
T125955B52E6F14148E46FC176CEC6D723EB717D0A62318ABB4110FE152F767628E2932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Q-Dir.lnk

Path C:\Users\Admin\AppData\Local\Temp\Q-Dir_tmp_folder_2019\Q-Dir.lnk
Size 1KB
SHA256 88ffdd89d000f021792992159a457b4dc84d3c46c9b18d848af1892efbaef0fd
MD5 b7431c8897f4a460cac0b88ce207a83a
SHA1 8a6d01c95d7bb1caed447bed9958718c46588d61
SHA512 3bcf8a7567c92ed2a7d08c1714f30ca895d063f209a5326178bfc723af85d7dd82b718aa20aa51f237cb85f12b9c12bc0cbb3161a6f23ee406495ed94a73bf14
TLSH
T1D131F2240F9F2B20F3E2C275177246138237B805E75C2F4D40C75AA296B051162E9FAA
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 683B
SHA256 727bc090e47e1a12eb41327b020702c93eb11f7918103d06e551c7ccdb3fff78
MD5 26be390914337635fc41a0d0a1b9c915
SHA1 da4d195ceee63ae51187cfbeb85bfb32d55a28b0
SHA512 96a8e9cf3420bd0b1d40ebc593df5ec1cb7abb1be5c68b4eebc5a745e4c7b4a67aa569dfeed19edf9fc19b5dd0c9336430ce41a0d7bcd4017b193030ebb356c1
TLSH
T1EB01995302C41E3F0480ABA3EB3291C868F6BE08F29AE95E59664C48CC4CD1B7D85F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 702B
SHA256 5cc05506fc18e89a5a4cc6c6c995ad0d3424f827e5c2ac004d83129084691656
MD5 6248e0468cefc873d86018e68e417707
SHA1 ee938c79df53837bf0865078c1bb253c602b5175
SHA512 1ee0bc214ebfefe39dd4badf4ab46f9aa4339bdfaccfaf8cf5913fbfb1f9c65060413d174122823d9344690615ac7c16f303a3ff4547bca34746ad4b7eec4c03
TLSH
T19A017B5302C41E7F0440AB93EB3191C558F6BD08F25AE95D59664C48CC4DD1BA945F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 41B
SHA256 62c269fef603674381f8cae6fe879c40a1f2bf48aed71cb0196cff1031b7e601
MD5 cfe4e2b4821890849b9aa928138880aa
SHA1 83ca1c5014d686e133038b1ab4e5bb8d3705f573
SHA512 857a6f92f951ccb97040034e73d471b8cbeca2b6ef97bb51a11fc538573e955dcb74dc1561ca4b4777e1441b410663e6d77e1a1a18b708026a33d3a9dd28fb85
MD5 SHA1 SHA512

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 730B
SHA256 559cff0dac9af086dfb1b9bab867d7a4ea1d2f73ec80da015872f2c18e550b30
MD5 89dd7ae6f12182836aa22828da75265e
SHA1 fa2d5bdd94b968e327f187579776fb3a0995ef89
SHA512 f33a607c0ab7e89ad3769da429f0ebf0d74945bac11c877474054bb83d95ff34321d366c531613f63538ec71df7d8f4754c29d4397399e1339518cff777d6ebb
TLSH
T10B01CB5306C45E7F0441AB93EB3291C498F6BD08F65AF51E5A670C08DC4DD1BB985F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 746B
SHA256 9976f301977b531454125c9ff7e661121e1419301fcc29b09f209f8c3ae2c069
MD5 4703e649e3661bb51c5e3b4709470b0f
SHA1 a85775e7fc02b457349d2a01e76a5b43fbc5558b
SHA512 c572971459455526b5b3c37034046c0db973dc46c5d3027c6a12b780949b10e259310c0118e35c2ba1366894cc147aaa23720effdb57b03a094890870c82873f
TLSH
T13201DC5302C41E7F0440AA93EB32918858F6BD08F65AF91E06670C08DC4DD1B6985F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 661B
SHA256 541f9677645ef7ed2fcc38bf0aff26688cf24367d2669a8b378870a28cbd4fdd
MD5 0c16e65d9eb8f10b49ebb72f9cde21e7
SHA1 6465775d28cd96d356e9c27f067fa10920929369
SHA512 26145bbf8d2ca9307a2f1a091f3b50166d8002efb6b2f289a0d3ca3ce2e4009eb2d74d743acdf737b20e35bd0b117b87f2e3095e0ad657aab828bfa30f5b60c1
TLSH
T1BF01994302C41E3F0480ABA3EB31918828F6BA08F28AE50E15664C48CC4CC1B7C81F0B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4304-6-0x00000000022F0000-0x00000000022F1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads