a961a578b1b4119e27eed1bde7fe9a11cd40a500f2f3b87a8b82ebe448c9073a

Analysis

max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_e916c961beaed0787e0de33c9b776bf6_amadey_dragonforce_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Size 9.3MB
Sample260729-vbw6nabf59
SHA256 a961a578b1b4119e27eed1bde7fe9a11cd40a500f2f3b87a8b82ebe448c9073a
MD5 e916c961beaed0787e0de33c9b776bf6
SHA1 c1e17d396f60fa3d6af6b3ddfb2ca6739808f0ca
SHA512 8d38de41712425b65623b6d763e6baf2a52bb69f21a04ef5509fbdc49dc5f9a3527a273e3d82154cbf702d2ed3a6653d5f05a9c2144c19c476014c0933d26c04
SSDEEP 196608:sWF6NKxIK9x+9hkJokCJQQ7qQYc2/fbfT0dMGAEzXGNeU1XNRxBY5vXyFkhn:dF6NKtvwxFJQQK5TbHdx35Y5vwQ
TLSH
T13BA62381B265F114E76101300928B6B4492B6D303761DDEBBECB7AD64A752C3AEB1F73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery spyware

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4380	setup.exe
4812	Q-Dir.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe
File created	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe
File created	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_e916c961beaed0787e0de33c9b776bf6_amadey_dragonforce_elex_luca-stealer_lynx_njrat_smoke-loader.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Control Panel\Colors	Q-Dir.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\TypedURLs	Q-Dir.exe

Modifies registry class 29 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Q-Dir.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\NodeSlot = "2"	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 7800310000000000e95c30721100557365727300640009000400efbe8158a93afd5c37862e000000880600000000010000000000000000003a000000000077d5190155007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\MRUListEx = ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 = 7e00310000000000e95c7a7a11004465736b746f7000680009000400efbee95c3072fd5c4a862e0000007d0000000000020000000000000000003e000000000069632a004400650073006b0074006f007000000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370036003900000016000000	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Q-Dir.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\Q-DIR-ADMIN-TEST	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 5000310000000000e95c297b100041646d696e003c0009000400efbee95c3072fd5c37862e0000007300000000000200000000000000000000000000000074a3ac00410064006d0069006e00000014000000	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 19002f433a5c000000000000000000000000000000000000000000	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Q-Dir-Admin-Test	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	Q-Dir.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4812	Q-Dir.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3280 wrote to memory of 4380	3280	2026-07-29_e916c961beaed0787e0de33c9b776bf6_amadey_dragonforce_elex_luca-stealer_lynx_njrat_smoke-loader.exe	90
PID 4380 wrote to memory of 4812	4380	setup.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-07-29_e916c961beaed0787e0de33c9b776bf6_amadey_dragonforce_elex_luca-stealer_lynx_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_e916c961beaed0787e0de33c9b776bf6_amadey_dragonforce_elex_luca-stealer_lynx_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3280
- C:\Users\Admin\AppData\Local\Temp\7zS0DCE76A9\setup.exe
  .\setup.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:4380
- - C:\Program Files\Q-Dir\Q-Dir.exe
    "C:\Program Files\Q-Dir\Q-Dir.exe"
    3⤵
    - Executes dropped EXE
    - Modifies Control Panel
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    PID:4812

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS0DCE76A9\setup.exe
Size 1.8MB
SHA256 98b7edf8b4cf2b3da93a001b1e909d2195eebfa91742323473d9bc7e4bbdaa48
MD5 d49f1d732785e2e78f150bc53114c862
SHA1 3fb417b453ca26d0748175ea6b0c708cbb993fde
SHA512 2048c8a6cacbc44f9a481c00ee33cd78ca783a013895ed964ea79b815aae30d21f4e1bc6609181e4d4fd9c918d5722471c3b6e2694b11415e12b85d951e71bb5
SSDEEP 24576:MUK+cfYyt2FRwJpK2rVf1Y+9TGRHkXJILs2ToJpO93X0zA28dIsNoLs9Lqy:W+tRwJw2xNY+9TGREXyLscdIsNp
TLSH
T125955B52E6F14148E46FC176CEC6D723EB717D0A62318ABB4110FE152F767628E2932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Q-Dir.lnk

Path C:\Users\Admin\AppData\Local\Temp\Q-Dir_tmp_folder_2019\Q-Dir.lnk
Size 1KB
SHA256 1238c450663e5fc26b5ff1076b462890b2d218b00a1cde391d336c0c9d1dfdac
MD5 1be1e246300f46837278698868748e82
SHA1 c878695a7b13ae54d0f8bb8ce290f0332fa6c85b
SHA512 beb73e5c3a87122115f5a4d83829d4b69104b016c6227adf9780e22b3f6a72e1f9b12d7f9896a773a4cccbf08e13b7b443b0e29f094ea423058ea1d0144667fd
TLSH
T1B631F2141F9F2B30F3E2C27117B146138237B811E7AC2F0D408756A255B051162ACF9A
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 683B
SHA256 86deacc42fb5062795d27fa97f6b3d3dc009949b8e503d1097d61ef1e31ab413
MD5 9914a485c3bfdf0c506d521b45b5d1ff
SHA1 4d4b79ce7ac5fe22ade3518ea40747cc5be25d44
SHA512 ce8d1b769ca65c4f421da9e5b4780c9746f5ab1a3c045ca0f4b26155947b0c3c698b2e3c06821d7123912961ed1542e5c41ccdda0abd290fd47e21c6d2904647
TLSH
T1DB01995306C45E3F0440ABA3EF32A1C868F6BE08F29AE94D59564C48CC5CD1B7D81F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 702B
SHA256 36eb050deb33c37509c566063cc37ca29ca8c89d0c48fa1fbec7f3b358061b80
MD5 f713058c0ca13fec60d7320c6945f58a
SHA1 4beaaa236959f051945158bc2f2e425cef76171b
SHA512 43c005a808955751aae1214ff4152e87cc37de8f839ec03821ed76f017fe7dae2e07e7a770ccb1d78850d0c5d6ed4029e341ba99a500a2a4a60c8b6a4d7b3d32
TLSH
T12A017B5306C45E7F0440AA53EF3191C558F6BD08F25AE94D59564C48CC5CD1BA945F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 41B
SHA256 8c268f205d2eaf77fa198a19856d75ef47cd369ace91e6aa71a88a6770cf977d
MD5 b5ee875adc97222f9d7a2c3ab941d627
SHA1 a95eaa53e665e06da70118d014323080532aeeae
SHA512 bfda4322c2f215a15b020dd3d96d17a937727bc5cfadc8b5d1828215979cbcb4fab8dbc6820594189627a4e0102e307f6a7bbfdd51c16609161cca16e0286413
MD5 SHA1 SHA512

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 730B
SHA256 d91fec073885f133e90baae51120d45ebe2313b1b0d49f01005a30a0c7ec1771
MD5 7fff8905837322f9aeccf5bc948512b8
SHA1 229f9c01aa55501db7b8addf00542d3e2d04fd21
SHA512 87c0e3dd124e44b7ae316734f2a23d324691929a38110621a390dd80049fdeb79f86700c7a280e08ab39480fcaad3a67a152b774b881a0e5035a059cf451538f
TLSH
T11601CB5306C45E7F0441AA93EB3291C498F6BD08F25AF90D59670C08DC0DD1BB985F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 746B
SHA256 e0e05aca43bb494fcba2d029acacf7da5f7056f408dfe0d72e3f2cc841982e4a
MD5 de32d5a01f45483f24c138ecc39bfa18
SHA1 742cfd4751b734707b680b44eda363bca0eea954
SHA512 ec2eebcbdf05e48160cd6829da726b19673231076ebc814511d47dabd2ef926e03e681208da9d034f4bbaaea91fd56e5905db7f7a0a81ef00792a7286d9725da
TLSH
T13C01105306C45E7F0440AA93EB3291C858F67D08F25BF90D45570C08DC4CD1B7985F07
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 199B
SHA256 20ef70997ed8472bfd4c56ef193e21513e68b9d4635f8478f0608986070f5e82
MD5 675bf649bfd7bb6a636ff3be79e17d1f
SHA1 6f309de77c64d4ca3675652c5acbc2cf0d0feb9a
SHA512 f99626dbdf505def0ea3eac2f81d821846976a7a6cecf6d1f6710d1756aa17818c546caed113d99e5017657ab998e5ea7aef7a2fe36533953b1454065ae610b4
TLSH
T1FED0C97251C8A34F981AF1E35B76F18C94A0D588EBE92A92CA5618C86E9192CEE4501D
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 661B
SHA256 a913089680a7d6a550b93414d05dd4409a810ad25314cb2011eed6014e547e27
MD5 6017dcd7c618d35d25ecd623fef8901f
SHA1 67374349e65552d71ab6b0e1396aa931ce384398
SHA512 abb99fba89a83f10754cc3352a51d0999ca15f95df524a871a2f29f7e725ff260d22a1ccfcdaaff49732902398a70c46362dc5c6593dd555b13ae5ef98d9d893
TLSH
T1F801DD5306C45E3F0440ABA3EF31A18828F6BE08F28BE50D55564C48CC0CC1B7D81F0B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4380-6-0x0000000002310000-0x0000000002311000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads