58c78586482e9e2d067ff6aa9089c10f25ab3e2c0474d293d1a7b1463d554a27

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 16:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_cffa4667de4dfdbff3b7aaabce8b9527_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Size 8.4MB
Sample260729-vhn4mazzfv
SHA256 58c78586482e9e2d067ff6aa9089c10f25ab3e2c0474d293d1a7b1463d554a27
MD5 cffa4667de4dfdbff3b7aaabce8b9527
SHA1 0339beeb632855d9a5d01532aaab8326adc80cd8
SHA512 51eb0851cfa634a2ccb4ac11b957b6d2286883b570dd52e50b3403b9a4b2a957ade866724d446a5fc63e52ba697da3b5e60687ea5706aafcb5a2d18b06133425
SSDEEP 196608:S4cNOqbgiIQsAkdQ/xs10y8nr9DLWl3bmMwCFzXyFkhx:9wIdey8nrJyhbzdzwG
TLSH
T1889612D0F224F558E7A501308828266459662D303791E9ABFE8F76D259782C3EEF1F37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	setup.exe

Executes dropped EXE 2 IoCs

pid	Process
3264	setup.exe
4708	Q-Dir.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe
File created	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe
File created	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe
File created	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_cffa4667de4dfdbff3b7aaabce8b9527_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 456 wrote to memory of 3264	456	2026-07-29_cffa4667de4dfdbff3b7aaabce8b9527_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe	85
PID 3264 wrote to memory of 4708	3264	setup.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-29_cffa4667de4dfdbff3b7aaabce8b9527_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_cffa4667de4dfdbff3b7aaabce8b9527_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:456
- C:\Users\Admin\AppData\Local\Temp\7zS8C19F7C8\setup.exe
  .\setup.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:3264
- - C:\Program Files\Q-Dir\Q-Dir.exe
    "C:\Program Files\Q-Dir\Q-Dir.exe"
    3⤵
    - Executes dropped EXE
    PID:4708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS8C19F7C8\setup.exe
Size 1.8MB
SHA256 98b7edf8b4cf2b3da93a001b1e909d2195eebfa91742323473d9bc7e4bbdaa48
MD5 d49f1d732785e2e78f150bc53114c862
SHA1 3fb417b453ca26d0748175ea6b0c708cbb993fde
SHA512 2048c8a6cacbc44f9a481c00ee33cd78ca783a013895ed964ea79b815aae30d21f4e1bc6609181e4d4fd9c918d5722471c3b6e2694b11415e12b85d951e71bb5
SSDEEP 24576:MUK+cfYyt2FRwJpK2rVf1Y+9TGRHkXJILs2ToJpO93X0zA28dIsNoLs9Lqy:W+tRwJw2xNY+9TGREXyLscdIsNp
TLSH
T125955B52E6F14148E46FC176CEC6D723EB717D0A62318ABB4110FE152F767628E2932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Q-Dir.lnk

Path C:\Users\Admin\AppData\Local\Temp\Q-Dir_tmp_folder_2019\Q-Dir.lnk
Size 1KB
SHA256 2f9ddef243a6469666a1e3d743d2b112219d078ce97f7a2b8b8e4e26c1b11372
MD5 1b96133cce6ff2c9c287b01fbc6c7272
SHA1 1f71f68c0c757f4f0abf146ccc9106c802ff76a2
SHA512 83050d7c3f1f89bd25ef04937573f5f50c60dc82d6a65845a591be908076f6ea968f5fa25e79f3ff06f120ce3c0b3f4982a9b66dd0513222abc407a20f7982a8
TLSH
T1DD31A2240F9F2B64F3F2C17117B247234637B841E75C2F59408A57A255F452066EDF9B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 41B
SHA256 18566a52eed58ca3952dbe09dfb8b936153518082a4023f191b6b7f4a8159598
MD5 20c1bc53ae481adc7a1e76e925201e5b
SHA1 8fc9d617220bdbdf48a7353e9f1237df8670e936
SHA512 fc51e4f53b0a2167b99ac1c01e3934d15cef62e6e9113ebbdd2533be04d917d21e4ce90cbf72d9eb0e5ecdfb2c40e2713361b2f76ae0b60ed921bcf750d2ca3f
MD5 SHA1 SHA512

Submit Download

memory/3264-5-0x0000000002370000-0x0000000002371000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads