470921e29e7c6fba67901548d0a2fd5a4b7a48b33c86b2f5de9bf8382a4f4164

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 14:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_e371f68bc9ed12fcc8444a666fba8910_amadey_dragonforce_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Size 9.5MB
Sample260730-r6lfvsbb79
SHA256 470921e29e7c6fba67901548d0a2fd5a4b7a48b33c86b2f5de9bf8382a4f4164
MD5 e371f68bc9ed12fcc8444a666fba8910
SHA1 0addd20549851871e5a33065b1a56e0b1f406049
SHA512 94e41294f8a7ea5066b31acefe5dc67f89779c43788dbbf235c69d28dc8a052c4fc2c29ce00a33cf868ea6b929624dc251cc0e230d5ae20e9013c50713ee18fe
SSDEEP 196608:lZgKvbnCBnF4jDVcVh8Wu+4HusYLNEdpGaEprzxXyFkhd:zgKfNcVC5khqpspr1wO
TLSH
T1FEA62380F252F558E365013049386AA455762A303755D9EBBFCF39C69A282D3BEB1F33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery spyware

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4236	setup.exe
1640	Q-Dir.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe
File created	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe
File created	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe
File created	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_e371f68bc9ed12fcc8444a666fba8910_amadey_dragonforce_elex_luca-stealer_lynx_njrat_smoke-loader.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Control Panel\Colors	Q-Dir.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\TypedURLs	Q-Dir.exe

Modifies registry class 29 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 5000310000000000e95cf87d100041646d696e003c0009000400efbee95c2f72fe5c14762e00000071000000000002000000000000000000000000000000de800f00410064006d0069006e00000014000000	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Q-Dir.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Q-Dir-Admin-Test	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 = 7e00310000000000e95c4d7d11004465736b746f7000680009000400efbee95c2f72fe5c18762e0000007b0000000000020000000000000000003e0000000000959390004400650073006b0074006f007000000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370036003900000016000000	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 19002f433a5c000000000000000000000000000000000000000000	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\NodeSlot = "2"	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	Q-Dir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 7800310000000000e95c2f721100557365727300640009000400efbe8158a93afe5c14762e000000880600000000010000000000000000003a0000000000c450ec0055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\MRUListEx = ffffffff	Q-Dir.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\Q-DIR-ADMIN-TEST	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = 00000000ffffffff	Q-Dir.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1640	Q-Dir.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 4236	1504	2026-07-30_e371f68bc9ed12fcc8444a666fba8910_amadey_dragonforce_elex_luca-stealer_lynx_njrat_smoke-loader.exe	89
PID 4236 wrote to memory of 1640	4236	setup.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-30_e371f68bc9ed12fcc8444a666fba8910_amadey_dragonforce_elex_luca-stealer_lynx_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_e371f68bc9ed12fcc8444a666fba8910_amadey_dragonforce_elex_luca-stealer_lynx_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Users\Admin\AppData\Local\Temp\7zS0E5BA249\setup.exe
  .\setup.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:4236
- - C:\Program Files\Q-Dir\Q-Dir.exe
    "C:\Program Files\Q-Dir\Q-Dir.exe"
    3⤵
    - Executes dropped EXE
    - Modifies Control Panel
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    PID:1640

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS0E5BA249\setup.exe
Size 1.8MB
SHA256 98b7edf8b4cf2b3da93a001b1e909d2195eebfa91742323473d9bc7e4bbdaa48
MD5 d49f1d732785e2e78f150bc53114c862
SHA1 3fb417b453ca26d0748175ea6b0c708cbb993fde
SHA512 2048c8a6cacbc44f9a481c00ee33cd78ca783a013895ed964ea79b815aae30d21f4e1bc6609181e4d4fd9c918d5722471c3b6e2694b11415e12b85d951e71bb5
SSDEEP 24576:MUK+cfYyt2FRwJpK2rVf1Y+9TGRHkXJILs2ToJpO93X0zA28dIsNoLs9Lqy:W+tRwJw2xNY+9TGREXyLscdIsNp
TLSH
T125955B52E6F14148E46FC176CEC6D723EB717D0A62318ABB4110FE152F767628E2932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Q-Dir.lnk

Path C:\Users\Admin\AppData\Local\Temp\Q-Dir_tmp_folder_2019\Q-Dir.lnk
Size 1KB
SHA256 d497d8ed0253d1324ce32ce709d5bdd6e6472f59f963943013e3d444cea3e3ca
MD5 0148f3e28cc6038ac3e220f955de32e8
SHA1 6635d4a2241050641bedec3bf8c43634e4c158be
SHA512 1c380c54981fb5157abc19c2db66c35bb8f00e673ee6fa9b172bfede75fe2e98624053900b22b830d05aba0450c531169a5ba3083a45c69c1228062011101902
TLSH
T1DD31F2140F9F2B24F3A2C271577146138237B810E69C2F4940875AA265B451066ACF9A
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 683B
SHA256 6918bc6d74af56dd02732e43962dfeb13e5966b292f7ed9df169922bbad1a519
MD5 d948a0bc56c9ddfe2e5d6f414cc0e17c
SHA1 ae5a3e80604eba44f0b08e00786c2f69a2e3e851
SHA512 df55f9caa514a8fd18ca1373c2f522c264b2dfba8006f5b70016d02de26d0766ddb2c6ec1d3dacdcccc25531181b9aee5144aaf0faa35379835c60773f9d2dd8
TLSH
T1C501995306C41E7F4440ABA3EB32A1C86CF6BE08F29AE54D59564C48CC4CD1B7D81F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 702B
SHA256 8f49f82fb39ed135157219f7d726dcd89fb97a4e26325f3b99fd33f939f2c2d7
MD5 08c94986d82def589c594875f133bac6
SHA1 924e202e4c9bcaf4c1c992790d7e1fa5305ccb6d
SHA512 8f4574dc257410a7caa3c06ad7dfb6e68309e70ae35086597ed0c75b233d0eb2b0e5e4d660997296607b3c61d12d64344f88a7f8ae7772a60265dd5f215a4cfa
TLSH
T1C4017B5306C41E7F4440AB53EB3151C458F6BD08F25AE54D59564C48CC4CD1BA945F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 41B
SHA256 acce2ef6b9275b2416c18faaf63aea0e8fea62b235fb21d086bca5be4e9ab59f
MD5 00e9466dde2bd9f52ca4c04fb746b6a3
SHA1 77614c97e98c273e8d3fe2ba9b3c4d26d052d723
SHA512 3c49862e76338b4a369104149611dcad34a05faf790dcdbc14716eda938ad802ede6a095ad489830006badb106e25c054b9df5024e2357ee06c18bb9ac427a26
MD5 SHA1 SHA512

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 730B
SHA256 44231533a07a9d4655b00835cdaf39905a78d5b6ca3ba3f7aa39e6c038b4ec43
MD5 17107ae00ceef2c3a34e96ce2eae380a
SHA1 3d1685967842e77a8664badf22fb5f158000c5fe
SHA512 2c31e55a8c24f29d6959177662f55576821dd56f6b3543235be1ea57026efb41acfb387c03a5048a88edffede949914eb2e4d00e1ffd9205d3beedf2f8783239
TLSH
T12F01CB5306C45E7F4441AB93EB32A1C498F6BD08F25AF50D5A670C48DC0DD1BB985F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 746B
SHA256 ac8cdfd74206153545b6eae191ddd90ac20e1d6301eca1baaefbb1c532911d7f
MD5 9f0785f5d5f18df9a0e68fe9fc4e6bfb
SHA1 8cc6ec523b3b4754650ee83b2efe16e5898b5000
SHA512 8c1b1a963d9ebda5d4e127bf4e8485300546735f490f114d27533f8d84e0272e070411dfff258ca5bcbf170180d7692efe7d6c35e85a6864b5f1b4b21da19446
TLSH
T13601DC5306C41E7B0440AA93EB32518858F67D08F25AF90D46560C08CC4CD1B6985F07
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 661B
SHA256 0ee0b14dd85c34e34a9472118ad10583d0f02c08a7947e8c18e93714a9e6e582
MD5 0185a8774cbbabed93e7f4b2bd5ece98
SHA1 cadc56e1185b3ef01cf828b0ae8bea4ae4b2fe15
SHA512 33a75943b29af9200b61fcb3e67c6f6fc45ec04227984a6d02a962d427d94ac1a03a7cd7777c9eb7b0744ab9a33a8cb166c4e1b30a697f8946868329dd829934
TLSH
T19D01995306C41E3B4440ABA3EB3161882CF6BA08F28AE50D55564C48CC0CC1B7C81F0B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4236-6-0x0000000002230000-0x0000000002231000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads