35a7f8b0925f599540b7023c1246d998c0df7d76d8b2bc8a505a356fb7a6a3a7

Analysis

max time kernel
150s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 18:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_b8ecf97d0894f87c9bde7ad56632255d_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Size 8.4MB
Sample260804-w8dk9acj3x
SHA256 35a7f8b0925f599540b7023c1246d998c0df7d76d8b2bc8a505a356fb7a6a3a7
MD5 b8ecf97d0894f87c9bde7ad56632255d
SHA1 62b373d77465865d69c02a71385e346c6e40afd8
SHA512 fdb6d7b10774328492b00b7f1b249ed86c10f0c88e68d863aba29458754959475cb5674fda53dbd108032fb8a4339b9fa147fa5c61ed499cc3bf1eb7324ab46a
SSDEEP 196608:9glkhJoGYPZ7zE9KCc4iVAiRi5szhCz1ijIdDNXyFkhI:rJoGYWKCc4e0iAzsINw/
TLSH
T1769612D1B229F519E3610131882426A419662E303751D9EBFE8F36D689792D3FEB0F37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery spyware

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3548	setup.exe
4168	Q-Dir.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe
File created	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe
File created	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe
File created	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_b8ecf97d0894f87c9bde7ad56632255d_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Control Panel\Colors	Q-Dir.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\TypedURLs	Q-Dir.exe

Modifies registry class 29 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Q-Dir-Admin-Test	Q-Dir.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\Q-DIR-ADMIN-TEST	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 5000310000000000e95c5d7b100041646d696e003c0009000400efbee95c3172045d6a942e000000540000000000020000000000000000000000000000006c0f7200410064006d0069006e00000014000000	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 7800310000000000e95c31721100557365727300640009000400efbe8158a93a045d6a942e000000880600000000010000000000000000003a00000000007142520055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 = 7e00310000000000e95cb37a11004465736b746f7000680009000400efbee95c3172045d6e942e0000005e0000000000020000000000000000003e0000000000590e5b004400650073006b0074006f007000000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370036003900000016000000	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 19002f433a5c000000000000000000000000000000000000000000	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\NodeSlot = "2"	Q-Dir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\MRUListEx = ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	Q-Dir.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4168	Q-Dir.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5896 wrote to memory of 3548	5896	2026-08-04_b8ecf97d0894f87c9bde7ad56632255d_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe	90
PID 3548 wrote to memory of 4168	3548	setup.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-04_b8ecf97d0894f87c9bde7ad56632255d_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_b8ecf97d0894f87c9bde7ad56632255d_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5896
- C:\Users\Admin\AppData\Local\Temp\7zS80734019\setup.exe
  .\setup.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:3548
- - C:\Program Files\Q-Dir\Q-Dir.exe
    "C:\Program Files\Q-Dir\Q-Dir.exe"
    3⤵
    - Executes dropped EXE
    - Modifies Control Panel
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    PID:4168

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS80734019\setup.exe
Size 1.8MB
SHA256 98b7edf8b4cf2b3da93a001b1e909d2195eebfa91742323473d9bc7e4bbdaa48
MD5 d49f1d732785e2e78f150bc53114c862
SHA1 3fb417b453ca26d0748175ea6b0c708cbb993fde
SHA512 2048c8a6cacbc44f9a481c00ee33cd78ca783a013895ed964ea79b815aae30d21f4e1bc6609181e4d4fd9c918d5722471c3b6e2694b11415e12b85d951e71bb5
SSDEEP 24576:MUK+cfYyt2FRwJpK2rVf1Y+9TGRHkXJILs2ToJpO93X0zA28dIsNoLs9Lqy:W+tRwJw2xNY+9TGREXyLscdIsNp
TLSH
T125955B52E6F14148E46FC176CEC6D723EB717D0A62318ABB4110FE152F767628E2932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Q-Dir.lnk

Path C:\Users\Admin\AppData\Local\Temp\Q-Dir_tmp_folder_2019\Q-Dir.lnk
Size 1KB
SHA256 2d626c5487be87b16c2d222ec00ef2d5ce0f2c2b27873b3fd4f0c04004a88e4d
MD5 3dbad7efc71175c2718135f30ee1f8b2
SHA1 2058da79554d4d20655df187edbd1d08bcdd17f5
SHA512 69640259989eeeb358c9738e1394c14dd12e2553029951dc89583032ebcdca8f004265fd4e9c870dc76bedce6ce17c757c4ae9aadb0f5f3ed74cee0966a7b8ca
TLSH
T17A3121240F9F2B24F3E2C271177247234237B801F7A82F0E40875AA269B152066ECF9B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 683B
SHA256 f3d974d0b232188a61f9ed88a12b73bd344dcfeb002b2bafebf6345c98009c53
MD5 d989dcd5a5ccb07f19ff95fc2a244abd
SHA1 e7e772b24c80214bf0d49ad6e70cc15fa2cb5fb5
SHA512 a915ce11cc52ce3a029457cdef905c3382d480a872d645c8bad4000f32e56695d173fe9fa5157b1d9acba27eeec20890cc442eff9947e3c29c421d717d0b392e
TLSH
T1ED01995306C41E3F0440ABA3EB3291C868F6BE08F69AF54E59564C48CC5CD1B7D86F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 702B
SHA256 27016658486d93fe70957e230fc7ed502ad1cb65c906192b525747e181cc2963
MD5 f3bb78fc12512ed636de0d22a035dee7
SHA1 bff800472cf27fec3cb1d3f68c985a7c45faf6c5
SHA512 b4a85db5a065a2e108f03bc177c9f971aa71a8bb670d160d2c9f599ecb0f92ac2d4e97b660129dbd9b240caec78abe7879cbb944e150a50b656717c2031bc0ad
TLSH
T123017B5306C41E7F0440AA53EB3151C958F6BD08F65AF54D59564C48CC5CD1BA945F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 41B
SHA256 09b0ab5fee0d0e78e958bb16bc4b5ca7255bc3fa7feeec899b9ec681791cf902
MD5 80c535ab97f8f6523774a866f978a789
SHA1 5eb7bb305820beca6e768be691614c2f8e08b54f
SHA512 0fc8a41b35536503e45da150bb36af7d100ca7f4f66c7820a465c8609cd606226b0475b4ad78b0001c1ff528c2d6b32cf4a54a40417ee07706813eb6a2ed3d90
MD5 SHA1 SHA512

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 730B
SHA256 46995d0bc2d6dcbc8b61839806f1e4ef297e082bfbbb7ec743862928b6feac43
MD5 b7bc3267e56555fe938750563c103205
SHA1 55ba16364aea80618604f4c743ddb5075c422e3d
SHA512 840daf6e92f0c35d1291edabceecd90979e303fc01085cd53a09beda08e4c466c3b619d0052431cede42d984997dedf05166e44ee5536e335280bc06a310e4c2
TLSH
T17001CB5306C45E7F0441AA93EB3291C898F6BD08F65AF90E59674C08DC0DD1BB986F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 746B
SHA256 0198ca246954e5af61919b307a95abf5586c1bdb53959ffbcb048df6027bfb7a
MD5 841d874e10e087f17d0a1f36ac00b5b1
SHA1 736bffca43a0bafde2613628bbef1125f577d481
SHA512 18929b909ee7c6ecc82beb100ce63bada79eac905dd324a9af44867640625f1e07ead4f0c82ee160e9630255659a0325f473891005b6ad1d4746605032306c42
TLSH
T1AD01105306C41E7F0440AA93EB3251C858F67D08F65BF90E05570C08CC4CD1B7986F07
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 661B
SHA256 6df84f63db6363456c27452aee37486b236c06f4a65aa019546b05327b84ae88
MD5 d6c20b8bdcee9dc175deb92562dfb268
SHA1 b7dad2918a1e1308ae8f732cd55dd3f890e76b20
SHA512 2f00babb49a0517950c48c01841eca44ce5bead2b2b1fd605c6c8ecbdcbb534020284891e54afc974c9a594316b13c39816789963a5f1379856c544d3ca864f3
TLSH
T1FF01DD4306C41E3F0440ABA3EB3151882CF6BE08F68BE50E15564C48CC0CD1B7C82F0B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3548-6-0x0000000002340000-0x0000000002341000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads