cf2a311682db4db01db5b1ac5f70305ab39da6ac1fec150dd92833e54ee9ecf6

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 14:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_3bb2ea92b456471a37faad7784c1e6e8_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Size 8.4MB
Sample260802-ry6f3a1wht
SHA256 cf2a311682db4db01db5b1ac5f70305ab39da6ac1fec150dd92833e54ee9ecf6
MD5 3bb2ea92b456471a37faad7784c1e6e8
SHA1 03598b1e7d2d86480388ea9db53ff8aecbb36312
SHA512 7faab46e8a54caeeb4f3134a97431e201e88c8f005bb0a95709558f6abb75f0b8fc19444b3740fae76270db3a2252b5f1ee834a6bdcea14e94a3efaa20016b4a
SSDEEP 196608:MilV2kAdQsoQwzK5YctIUgzprdtDG8NtpEiXyFkh7:TAkASslwGhtEhDGOZwM
TLSH
T1B79612D0F628F158E7A50231882466A819662E303755D9EBBE8F35C659382D3BDF0F37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery spyware

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
460	setup.exe
3340	Q-Dir.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe
File created	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe
File created	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe
File created	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_3bb2ea92b456471a37faad7784c1e6e8_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Control Panel\Colors	Q-Dir.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\TypedURLs	Q-Dir.exe

Modifies registry class 29 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Q-Dir.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\NodeSlot = "2"	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Q-Dir.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Q-Dir-Admin-Test	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 = 7e00310000000000e95cac7a11004465736b746f7000680009000400efbee95c3172025dab742e0000005e0000000000020000000000000000003e0000000000c6e03e004400650073006b0074006f007000000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370036003900000016000000	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 7800310000000000e95c31721100557365727300640009000400efbe8158a93a025da7742e000000880600000000010000000000000000003a00000000007142520055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0	Q-Dir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	Q-Dir.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\Q-DIR-ADMIN-TEST	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 5000310000000000e95c557b100041646d696e003c0009000400efbee95c3172025da7742e000000540000000000020000000000000000000000000000003d355100410064006d0069006e00000014000000	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 19002f433a5c000000000000000000000000000000000000000000	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\MRUListEx = ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = 00000000ffffffff	Q-Dir.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3340	Q-Dir.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5368 wrote to memory of 460	5368	2026-08-02_3bb2ea92b456471a37faad7784c1e6e8_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe	89
PID 460 wrote to memory of 3340	460	setup.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-02_3bb2ea92b456471a37faad7784c1e6e8_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_3bb2ea92b456471a37faad7784c1e6e8_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5368
- C:\Users\Admin\AppData\Local\Temp\7zS8F47F359\setup.exe
  .\setup.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:460
- - C:\Program Files\Q-Dir\Q-Dir.exe
    "C:\Program Files\Q-Dir\Q-Dir.exe"
    3⤵
    - Executes dropped EXE
    - Modifies Control Panel
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    PID:3340

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS8F47F359\setup.exe
Size 1.8MB
SHA256 98b7edf8b4cf2b3da93a001b1e909d2195eebfa91742323473d9bc7e4bbdaa48
MD5 d49f1d732785e2e78f150bc53114c862
SHA1 3fb417b453ca26d0748175ea6b0c708cbb993fde
SHA512 2048c8a6cacbc44f9a481c00ee33cd78ca783a013895ed964ea79b815aae30d21f4e1bc6609181e4d4fd9c918d5722471c3b6e2694b11415e12b85d951e71bb5
SSDEEP 24576:MUK+cfYyt2FRwJpK2rVf1Y+9TGRHkXJILs2ToJpO93X0zA28dIsNoLs9Lqy:W+tRwJw2xNY+9TGREXyLscdIsNp
TLSH
T125955B52E6F14148E46FC176CEC6D723EB717D0A62318ABB4110FE152F767628E2932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Q-Dir.lnk

Path C:\Users\Admin\AppData\Local\Temp\Q-Dir_tmp_folder_2019\Q-Dir.lnk
Size 1KB
SHA256 2d626c5487be87b16c2d222ec00ef2d5ce0f2c2b27873b3fd4f0c04004a88e4d
MD5 3dbad7efc71175c2718135f30ee1f8b2
SHA1 2058da79554d4d20655df187edbd1d08bcdd17f5
SHA512 69640259989eeeb358c9738e1394c14dd12e2553029951dc89583032ebcdca8f004265fd4e9c870dc76bedce6ce17c757c4ae9aadb0f5f3ed74cee0966a7b8ca
TLSH
T17A3121240F9F2B24F3E2C271177247234237B801F7A82F0E40875AA269B152066ECF9B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 683B
SHA256 73e488687200b18385062f52c439169f9bff730aa7b6fa6523f2728a1e315020
MD5 641c3190350ff819000bd145d314bdc7
SHA1 b400fa520f231b0cc434ee1c328d5351eb0e128e
SHA512 a6d92a4df6df3053ae18154a61e8e8d268746cf850cd92c5eae2816b66cd0313cfe956fc994d261eb750e7cfa40354031d158fdf769f82799cbb676b16ca1a7f
TLSH
T13401995302C41E3F0440ABA3EB32A1C868F6BE08F29AE54D59564C48CC4CD1B7D85F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 702B
SHA256 ac8112a8d1b573fe06a64ff8aee30b70ca4daa47aad689a363c300ee1ded9806
MD5 b416adfc7a04d094623184a9cd1f0304
SHA1 d3f3ca244044e3ee3d2670b405caecd682c5f165
SHA512 ec99d4b33f1de9fa812c412e22b2a59ad28a0bc5a7063bfc7b4086c30ff91fa5a2baddfe3111fa6acfbd1ce9c5690068fdfc0eb87a34de42eb1aa168777e4df1
TLSH
T18D017B5302C41E7F0440AB63EB3191C558F6BD08F25AE54D59564C48CC4CD1BA945F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 730B
SHA256 e027ca6b97b18900c644ab176f1d440aa67bdc08d3b308807dbe8a6e3a50fde6
MD5 a8e0897e7f9f3019bffcd74303034654
SHA1 35b86ac0932c31a6d7f75b2947e85556127e0c94
SHA512 5be4dc948954fd7b6ca2d7b68fb8f289c0ed694b367144f977bc781be9e2b7ee9c95d07b878f678cd864f250bed7fe836c94ac07e05b2b2bcb7e6d5ca3c4d10a
TLSH
T15A01CB5306C45E7F0441ABA3EB32A1C498F6BD08F25AF50D5A670C48DC0DD1BB985F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 746B
SHA256 19465bdfaaf77bf2ff46bc5239b114203abf85bed58c3fc857885ac15dc30799
MD5 7f232ae49264b926ff9c26a5448a07c6
SHA1 cfea493ac871dc73f812248e8504918835482131
SHA512 d227f5452c93747c599f305be805f7734f3a9958b337e560bbf385446e3b04d9baeff4a2cfa61c2f8770d07cae47f432bb5f5ca0c31cf64e5cc5292bf2d2bb70
TLSH
T19C01DC5302C41E7B0440AB93EB32918858F67D08F25AF90D46560C08CC4CD1B6985F07
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 41B
SHA256 e4023fbb26a64b64536de0c06dc4ca2a5560a66bd7c4a97888163a2c3ce94f3b
MD5 47237be04448ae289418eff440898da7
SHA1 a0523ba76f890a798cbbd1cab52754f9e201289d
SHA512 cd5422d5d1f0eec79ab78e3711a106344a3921075648eddd7c953bd6cc9a42d9ba1c031fc1e32684236a2da5c87953499c850b62fa44767e31d3594248e2abfa
MD5 SHA1 SHA512

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 661B
SHA256 e4606b8d505274299b84ed961e8424919ea5ea2627698e9970a970d4b5428c4b
MD5 44becfbe4c52411a90e8aeb88ef01aa5
SHA1 93c3b924707da8f7a079a41e558812f58b14a1f1
SHA512 ddc51cfea3dd44ce82844c298ab5121c4726b45029abd950ec6ced193c7aaeb4328488b99c5ca0579ec72012a8f5fc2c73abb71569394c9527fa54a2b0446037
TLSH
T1EF01DD4302C41E3F0440ABA3EB31A1882CF6BE08F28BE50D55564C48CC0CC1B7C85F0B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/460-6-0x00000000021E0000-0x00000000021E1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads