470921e29e7c6fba67901548d0a2fd5a4b7a48b33c86b2f5de9bf8382a4f4164

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 14:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_e371f68bc9ed12fcc8444a666fba8910_amadey_dragonforce_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Size 9.5MB
Sample260730-r6lfvsbb79
SHA256 470921e29e7c6fba67901548d0a2fd5a4b7a48b33c86b2f5de9bf8382a4f4164
MD5 e371f68bc9ed12fcc8444a666fba8910
SHA1 0addd20549851871e5a33065b1a56e0b1f406049
SHA512 94e41294f8a7ea5066b31acefe5dc67f89779c43788dbbf235c69d28dc8a052c4fc2c29ce00a33cf868ea6b929624dc251cc0e230d5ae20e9013c50713ee18fe
SSDEEP 196608:lZgKvbnCBnF4jDVcVh8Wu+4HusYLNEdpGaEprzxXyFkhd:zgKfNcVC5khqpspr1wO
TLSH
T1FEA62380F252F558E365013049386AA455762A303755D9EBBFCF39C69A282D3BEB1F33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	setup.exe

Executes dropped EXE 2 IoCs

pid	Process
5708	setup.exe
5292	Q-Dir.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe
File created	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe
File created	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_e371f68bc9ed12fcc8444a666fba8910_amadey_dragonforce_elex_luca-stealer_lynx_njrat_smoke-loader.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 5708	4720	2026-07-30_e371f68bc9ed12fcc8444a666fba8910_amadey_dragonforce_elex_luca-stealer_lynx_njrat_smoke-loader.exe	86
PID 5708 wrote to memory of 5292	5708	setup.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-30_e371f68bc9ed12fcc8444a666fba8910_amadey_dragonforce_elex_luca-stealer_lynx_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_e371f68bc9ed12fcc8444a666fba8910_amadey_dragonforce_elex_luca-stealer_lynx_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Users\Admin\AppData\Local\Temp\7zS0726D158\setup.exe
  .\setup.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:5708
- - C:\Program Files\Q-Dir\Q-Dir.exe
    "C:\Program Files\Q-Dir\Q-Dir.exe"
    3⤵
    - Executes dropped EXE
    PID:5292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS0726D158\setup.exe
Size 1.8MB
SHA256 98b7edf8b4cf2b3da93a001b1e909d2195eebfa91742323473d9bc7e4bbdaa48
MD5 d49f1d732785e2e78f150bc53114c862
SHA1 3fb417b453ca26d0748175ea6b0c708cbb993fde
SHA512 2048c8a6cacbc44f9a481c00ee33cd78ca783a013895ed964ea79b815aae30d21f4e1bc6609181e4d4fd9c918d5722471c3b6e2694b11415e12b85d951e71bb5
SSDEEP 24576:MUK+cfYyt2FRwJpK2rVf1Y+9TGRHkXJILs2ToJpO93X0zA28dIsNoLs9Lqy:W+tRwJw2xNY+9TGREXyLscdIsNp
TLSH
T125955B52E6F14148E46FC176CEC6D723EB717D0A62318ABB4110FE152F767628E2932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Q-Dir.lnk

Path C:\Users\Admin\AppData\Local\Temp\Q-Dir_tmp_folder_2019\Q-Dir.lnk
Size 1KB
SHA256 7e6ed593589b62da8a43cee2b099e904593baa8b15fefbf4bf07fefc5536e65b
MD5 650f8f23382d6dfddbf51bb43919635f
SHA1 c4463b0590dbfad35528a98af13f5112f97548b2
SHA512 4b3aaf811b9fadf2277d1c5218ffcfa561e84912f7d9a8e7fe190bb3a5488fbca39c7ee03a7b914a93c64a098e284190bbe81a62e2dbdcfd703d1e6fac85b6cc
TLSH
T1733126200F9F2B35F3E3C27157B25A134237B801E75C2F49408757E255B191156A9F9B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 41B
SHA256 3eabf0e127fd404a91e76683fd03f4b041d0caf6798e16930a3bf4fc2fbd7983
MD5 f90dfcaa2675b4db2aef7c54b47022b1
SHA1 6ba1e4ebabeab61576a496bcd2abc0d90a35c02d
SHA512 f0b73c6e6d8e3dcc0ac34e3c09c0bbc1449020a46aa446d9c42c2f7c7a09f7469e3819b56e6a12bcad03aa8ed9934cb0513eec551f12e5178554b20444db8710
MD5 SHA1 SHA512

Submit Download

memory/5708-5-0x0000000002280000-0x0000000002281000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads