65e048ed089fc9cfb634e921ca3d744ed0b92861b14f73a4bcfc446f6a908319

Analysis

max time kernel
164s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 14:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_25555a94b5eef600519e98b1832e2c7f_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Size 8.4MB
Sample260802-r4yneavfne
SHA256 65e048ed089fc9cfb634e921ca3d744ed0b92861b14f73a4bcfc446f6a908319
MD5 25555a94b5eef600519e98b1832e2c7f
SHA1 b148a767965c43a8f7881876a10de4d066d0c5e1
SHA512 255f46f880ec9176eff66c25959c7020b89df7ea0a0b959d5cdba4741d4cab2992b849e2d92fda7a3aa70836ee8f7762b87f2d9c16b7e0dbc0145c2ec8980719
SSDEEP 196608:hZd97dDAeTC923CtdiZevHsDsrKKOP8soXyFkh+:J97V1W4Coe0D3uwd
TLSH
T1399612D1B625F119E7A10130882976B869662E303754E9EBBE8F35C158782D3BDB1F33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery spyware

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4868	setup.exe
5936	Q-Dir.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe
File created	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe
File created	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe
File created	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_25555a94b5eef600519e98b1832e2c7f_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Control Panel\Colors	Q-Dir.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\TypedURLs	Q-Dir.exe

Modifies registry class 29 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 19002f433a5c000000000000000000000000000000000000000000	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\MRUListEx = ffffffff	Q-Dir.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Q-Dir-Admin-Test	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	Q-Dir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 = 7e00310000000000e95c097c11004465736b746f7000680009000400efbee95c3372025dbd752e0000005d0000000000020000000000000000003e0000000000455dd9004400650073006b0074006f007000000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370036003900000016000000	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Q-Dir.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\Q-DIR-ADMIN-TEST	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 5000310000000000e95cb47c100041646d696e003c0009000400efbee95c3372025dba752e0000005300000000000200000000000000000000000000000023963000410064006d0069006e00000014000000	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 7800310000000000e95c33721100557365727300640009000400efbe8158a93a025dba752e000000880600000000010000000000000000003a00000000009784270155007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\NodeSlot = "2"	Q-Dir.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5936	Q-Dir.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 4868	880	2026-08-02_25555a94b5eef600519e98b1832e2c7f_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe	89
PID 4868 wrote to memory of 5936	4868	setup.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-02_25555a94b5eef600519e98b1832e2c7f_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_25555a94b5eef600519e98b1832e2c7f_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:880
- C:\Users\Admin\AppData\Local\Temp\7zS073DE0A9\setup.exe
  .\setup.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Program Files\Q-Dir\Q-Dir.exe
    "C:\Program Files\Q-Dir\Q-Dir.exe"
    3⤵
    - Executes dropped EXE
    - Modifies Control Panel
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    PID:5936

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS073DE0A9\setup.exe
Size 1.8MB
SHA256 98b7edf8b4cf2b3da93a001b1e909d2195eebfa91742323473d9bc7e4bbdaa48
MD5 d49f1d732785e2e78f150bc53114c862
SHA1 3fb417b453ca26d0748175ea6b0c708cbb993fde
SHA512 2048c8a6cacbc44f9a481c00ee33cd78ca783a013895ed964ea79b815aae30d21f4e1bc6609181e4d4fd9c918d5722471c3b6e2694b11415e12b85d951e71bb5
SSDEEP 24576:MUK+cfYyt2FRwJpK2rVf1Y+9TGRHkXJILs2ToJpO93X0zA28dIsNoLs9Lqy:W+tRwJw2xNY+9TGREXyLscdIsNp
TLSH
T125955B52E6F14148E46FC176CEC6D723EB717D0A62318ABB4110FE152F767628E2932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Q-Dir.lnk

Path C:\Users\Admin\AppData\Local\Temp\Q-Dir_tmp_folder_2019\Q-Dir.lnk
Size 1KB
SHA256 9e1267cc93f943207c7028403d0878aa95d48ccc9a543cf7b2cb1e23acac7700
MD5 e43cfa4e9177bce8053cf702754a613a
SHA1 065d4792b8bd1d3582a888a5fa6f881054fb0a51
SHA512 ecca71924f4d88d03a8332026f9d77b9b145b8153b27b01600b422d67b176c4d8b3d7d4a6206eadd72c0066bdaa78a5ef9f2e524c00ce9a236f45b1b74dcd4ba
TLSH
T1BC31F2240FDF2B24F3E2C17517B146138237B801EA982F4D40879BA256B151166A9F5B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 683B
SHA256 95be4e6b4066831d21784dbcc6d72c1564eff0b27025f9682b4ab82ae028ce25
MD5 1275bebfcf0333c954d32ff2c5fde849
SHA1 29fc95c607186f75c94e047119d1ff48555c61d9
SHA512 a4f8c3061e438d8a7551fc7bed4df19b6700502bddedba8a91b57d0d51a8521d6969690dd951f972896d44d53250a25195310d2e5862e3c504d72842c7c63302
TLSH
T1F901995302C41E3F0480ABA3EB3291C868F6BE08F29AE55D59564C48CC5CD1B7D85F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 702B
SHA256 31b8c1f876eadc42e2ecb8cc0ec45d78a1da26606bb33f559351733ab307e4f4
MD5 904d019eeb4b866770002b83b63aa25d
SHA1 dab8dff432f8f53846776f8b4cc44f6ef8d8e044
SHA512 837a3c439c08fe8e8192901fd4490d12ec523447bf3ec2a5f198e40d54f7acd565b9033cefad41f47498a67b0f85c1cb27bbdeb3da49867d3d0de7064b957715
TLSH
T11101765302C41E7F0480AAA3EB3291C868F6BE08F29AE95D59664C48CC5DD1BA985F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 730B
SHA256 bdcfbc1948c39da929d4874c7065950f557605c2987f1892cc6db8e6bacd28b3
MD5 131dcb1bdfea470f111cb48654817586
SHA1 6ed9b71480d033499c3fb9dadfefb8efd373a516
SHA512 e2059fce87058cc71eb4fca80728426be3ac0d3897b770a6f7168243bd1fb33a6c3c426e23ddbbabb1112c51de916098a1fe07c47c0b3039237716faaece7fb9
TLSH
T18B01CB5306C45E7F0441AA93EB3291C498F6BD08F29AF54D59674C08DC0DD1BB985F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 746B
SHA256 1c3c1a82ce9918df51f08266817f3bfe8427ef75569479cab2a21a42ebb9aaef
MD5 32e8172b6960a9e169cec14506bc3ebd
SHA1 afd08424b30a6f76eb8acba9ee23ecaf0c67f1a0
SHA512 e065ef2ac0b7a421a228436467dd63334b9b37540bd1154a079b57225ab73ff4fc2990584c030ac90afa92fd74ec4a64e82153c0f011bf0e67bd29f617f1477f
TLSH
T12501105302C41E7F0440AA93EB3251C858F67D08F29BF94D05570C08CC4DD1B7985F07
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 41B
SHA256 531d34582065e823027a9919ad1772f8277771a9fe9560fa6e7d851122ec4a3c
MD5 0076f34b2470584ada0014586ce3583e
SHA1 576001a4760b5a0ba80c96065bb24cb064a44158
SHA512 1d0f6502c75fb84427d5ed9159538b6c54a5ee84bbc14d14140e2a62e3266143f0e9e97035f15f04a3167010a72a693c148c28ab392aecfb20199c31b2984547
MD5 SHA1 SHA512

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 661B
SHA256 6c64b1da45d31a1d7396eeea5414c9d867b56d5729d8c97308e86e42ff6a069f
MD5 1a05c0fb6182cfb0817a2dae32b98237
SHA1 fb9ac5335ef2a591d9daaf08a981858504d811b8
SHA512 0810c09170333762f0804f9a4788b838f8ba2ccc4aa9d894a8214c6831218b1f8e0c80bac8e5afea6866151c4363196da2d9c9edfdc0e92ff67975706bdfdaaa
TLSH
T17401DD4302C41E3F0480ABA3EB3151C828F6BE08F29BE54D15564C48CC0CC1B7C85F0B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4868-6-0x0000000002320000-0x0000000002321000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads