58c78586482e9e2d067ff6aa9089c10f25ab3e2c0474d293d1a7b1463d554a27

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 16:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_cffa4667de4dfdbff3b7aaabce8b9527_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Size 8.4MB
Sample260729-vhn4mazzfv
SHA256 58c78586482e9e2d067ff6aa9089c10f25ab3e2c0474d293d1a7b1463d554a27
MD5 cffa4667de4dfdbff3b7aaabce8b9527
SHA1 0339beeb632855d9a5d01532aaab8326adc80cd8
SHA512 51eb0851cfa634a2ccb4ac11b957b6d2286883b570dd52e50b3403b9a4b2a957ade866724d446a5fc63e52ba697da3b5e60687ea5706aafcb5a2d18b06133425
SSDEEP 196608:S4cNOqbgiIQsAkdQ/xs10y8nr9DLWl3bmMwCFzXyFkhx:9wIdey8nrJyhbzdzwG
TLSH
T1889612D0F224F558E7A501308828266459662D303791E9ABFE8F76D259782C3EEF1F37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery spyware

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2692	setup.exe
2132	Q-Dir.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe
File created	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe
File created	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe
File created	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_cffa4667de4dfdbff3b7aaabce8b9527_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Control Panel\Colors	Q-Dir.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\TypedURLs	Q-Dir.exe

Modifies registry class 29 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\NodeSlot = "2"	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 = 7e00310000000000e95c4f8011004465736b746f7000680009000400efbee95c3172fd5c03882e0000005e0000000000020000000000000000003e00000000004c91bd004400650073006b0074006f007000000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370036003900000016000000	Q-Dir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	Q-Dir.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\Q-DIR-ADMIN-TEST	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 19002f433a5c000000000000000000000000000000000000000000	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\MRUListEx = ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 7800310000000000e95c31721100557365727300640009000400efbe8158a93afd5c76872e000000880600000000010000000000000000003a00000000007142520055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 5000310000000000e95cf880100041646d696e003c0009000400efbee95c3172fd5c76872e000000540000000000020000000000000000000000000000009d143200410064006d0069006e00000014000000	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Q-Dir.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Q-Dir-Admin-Test	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	Q-Dir.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2132	Q-Dir.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5396 wrote to memory of 2692	5396	2026-07-29_cffa4667de4dfdbff3b7aaabce8b9527_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe	89
PID 2692 wrote to memory of 2132	2692	setup.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-29_cffa4667de4dfdbff3b7aaabce8b9527_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_cffa4667de4dfdbff3b7aaabce8b9527_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5396
- C:\Users\Admin\AppData\Local\Temp\7zS4158DC19\setup.exe
  .\setup.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:2692
- - C:\Program Files\Q-Dir\Q-Dir.exe
    "C:\Program Files\Q-Dir\Q-Dir.exe"
    3⤵
    - Executes dropped EXE
    - Modifies Control Panel
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    PID:2132

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS4158DC19\setup.exe
Size 1.8MB
SHA256 98b7edf8b4cf2b3da93a001b1e909d2195eebfa91742323473d9bc7e4bbdaa48
MD5 d49f1d732785e2e78f150bc53114c862
SHA1 3fb417b453ca26d0748175ea6b0c708cbb993fde
SHA512 2048c8a6cacbc44f9a481c00ee33cd78ca783a013895ed964ea79b815aae30d21f4e1bc6609181e4d4fd9c918d5722471c3b6e2694b11415e12b85d951e71bb5
SSDEEP 24576:MUK+cfYyt2FRwJpK2rVf1Y+9TGRHkXJILs2ToJpO93X0zA28dIsNoLs9Lqy:W+tRwJw2xNY+9TGREXyLscdIsNp
TLSH
T125955B52E6F14148E46FC176CEC6D723EB717D0A62318ABB4110FE152F767628E2932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Q-Dir.lnk

Path C:\Users\Admin\AppData\Local\Temp\Q-Dir_tmp_folder_2019\Q-Dir.lnk
Size 1KB
SHA256 2d626c5487be87b16c2d222ec00ef2d5ce0f2c2b27873b3fd4f0c04004a88e4d
MD5 3dbad7efc71175c2718135f30ee1f8b2
SHA1 2058da79554d4d20655df187edbd1d08bcdd17f5
SHA512 69640259989eeeb358c9738e1394c14dd12e2553029951dc89583032ebcdca8f004265fd4e9c870dc76bedce6ce17c757c4ae9aadb0f5f3ed74cee0966a7b8ca
TLSH
T17A3121240F9F2B24F3E2C271177247234237B801F7A82F0E40875AA269B152066ECF9B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 702B
SHA256 9c7c7fce02e34bc579258084329850a70ee35d6117db54678f724b595c607140
MD5 58c225be89dc89412f3896d457cf526c
SHA1 a2c91c1622a7334ad4f10a3e9a51dfde50ebe1ef
SHA512 dd8c4a07dfa2e5d321702fa18461e60b62dbf8e9746fa3fe8b746e11acc5065fcb1d25be2c47ec92d0aabaf05d2d2c87ee3e437eb2889219b6beadced79def73
TLSH
T1BD017B5302C45E7F0440AB53EB3191C468F6BD08F65AF54D59564C48CC4CD1BA945F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 730B
SHA256 48fe5d2cde3cf449458ca1208fa94c09c7aa700a29679fe9a346fe03bc56b3f2
MD5 c6db0f54a9609da52c6caf09cf997f1e
SHA1 c7a816c75d5b50f3a1b9e9bd3406c93ddbebc0b5
SHA512 ea0c18b38fcf7d17f320ec4e0c7b7635003abeb81c829b6ccc92d6e8f05b6377242217849c9fb97f6701d1d4e9b320231019041c6aec05d11235269a6eed5b96
TLSH
T11A01CB5306C45E7F0441AB93EB3291C4A8F6BD09F65AF50D59670C08DC0DD1BB986F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 746B
SHA256 025f2d34d17edd653395c232adce67bc47ba42b6404d72d900e5c27c5a44438b
MD5 4c6eac633ec4d0101d378616565c4176
SHA1 f274eac19a835681eed930f0f9f9aaf9a1ec266c
SHA512 e4cd3528e8389fda7d9cc87fa8317a695285950cf629664de9153aa875cf3b2340d2d28361fb5b9b1c2ada817f95ffe0174242059b746019c349f724a63eafc3
TLSH
T18501DC5302C45E7B0440AA93EB32918898F67D09F65AF90D09560C08CC4CD1B6986F07
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 41B
SHA256 19400c18a2df1c3063d18a16e21ecf80cf4fd09773cdc72be9c5a6cdf4e0d2cc
MD5 cdc81bd684ebab97a3707e75dc056196
SHA1 04386f208d6189f847c1f35d5640e91c56033e62
SHA512 91406be57816b735dd08ea7bd7e16d506a1b7b49310874d379738f0f30c563aec2a70de273459bc5ed810b4b29626f60c5788d7f74ca9bfa183a6a7a5f26023f
MD5 SHA1 SHA512

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 199B
SHA256 e6633de59732222bb135b0164552d0b2bf9a2f56ada11f21e963a1f0c8a97548
MD5 42dfddafa6fececfa0c9c25ae8f90e31
SHA1 d718379ddf37f6f14570f534b54aeee955ae8cf7
SHA512 bc8903b22fd899c8ffd6c029213090b1def2f352f35345707ceea168c68c08b36b0031caafbfe30c3bb202e5af5a04affa10ab10e51345443cf43c34694fa0d5
TLSH
T14DD0C97251C8A34F881AF2E35776F18CD8A0D548EBE93A928A5218C85E9192CEE4A01D
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 661B
SHA256 c0bd964a8da4adbd2ad937c867b44a5169c6af0845a4a25e06c06437a8ddd147
MD5 d030a601a786c221e857fa41900227b5
SHA1 6cca6aeb33d456e28b4f3aecff5856acc9131c09
SHA512 140d3b79a14eff8e38fcb293e086f0c050b40ecf229cb20afd1fd216305aabd45d16d08d5789044d6b0261b6deb66a97a32e7c8b53b421ae89079954e9ffb82b
TLSH
T1AE01994302C45E3B0840ABA3EB31918868F6BA08F68AE50D19564C48CC0CC1B7C82F0B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2692-6-0x0000000002310000-0x0000000002311000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads