91190c29829ac97ca88fde682a4d8e336d64801d068305c82cc823a9d9f1a8f1

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 16:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_efe32b500d9a29364b7879babcbf53ee_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Size 8.4MB
Sample260816-tz1nbasama
SHA256 91190c29829ac97ca88fde682a4d8e336d64801d068305c82cc823a9d9f1a8f1
MD5 efe32b500d9a29364b7879babcbf53ee
SHA1 a23548fcb6d299b779f0224ce2d15df37a2e7958
SHA512 bc76422bcc83622542447c9ed4b808ab560a578c0d17838dd563a0fae80a73abd7db024bbba34d045029ae2578cbc20e26c106f019039247e50eaec8a3663ec0
SSDEEP 196608:9+e0Cg3xOEARsxNSLhPnOxVlJvlH0CWL+FgliKbSUXyFkhP:cq5eNSLhPnOhJvx0C2ckxw8
TLSH
T1119612D0B221F558E3610130893976A019661E343741E9EBBE8F39D298796D3EEB5F33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery spyware

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1376	setup.exe
4364	Q-Dir.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe
File created	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe
File created	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe
File created	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_efe32b500d9a29364b7879babcbf53ee_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Control Panel\Colors	Q-Dir.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Internet Explorer\TypedURLs	Q-Dir.exe

Modifies registry class 29 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Q-Dir-Admin-Test	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 7800310000000000e95c2b721100557365727300640009000400efbe8158a93a105dd3832e000000880600000000010000000000000000003a0000000000234ef80055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\MRUListEx = ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 = 7e00310000000000e95c7b7e11004465736b746f7000680009000400efbee95c2b72105dd7832e0000005e0000000000020000000000000000003e0000000000423cc4004400650073006b0074006f007000000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370036003900000016000000	Q-Dir.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\NodeSlot = "2"	Q-Dir.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\Q-DIR-ADMIN-TEST	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Q-Dir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 19002f433a5c000000000000000000000000000000000000000000	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 5000310000000000e95c2c7f100041646d696e003c0009000400efbee95c2b72105dd3832e000000540000000000020000000000000000000000000000004a00a500410064006d0069006e00000014000000	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = 00000000ffffffff	Q-Dir.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4364	Q-Dir.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 1376	1372	2026-08-16_efe32b500d9a29364b7879babcbf53ee_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe	89
PID 1376 wrote to memory of 4364	1376	setup.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-16_efe32b500d9a29364b7879babcbf53ee_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_efe32b500d9a29364b7879babcbf53ee_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Users\Admin\AppData\Local\Temp\7zSC5557559\setup.exe
  .\setup.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:1376
- - C:\Program Files\Q-Dir\Q-Dir.exe
    "C:\Program Files\Q-Dir\Q-Dir.exe"
    3⤵
    - Executes dropped EXE
    - Modifies Control Panel
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    PID:4364

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC5557559\setup.exe
Size 1.8MB
SHA256 98b7edf8b4cf2b3da93a001b1e909d2195eebfa91742323473d9bc7e4bbdaa48
MD5 d49f1d732785e2e78f150bc53114c862
SHA1 3fb417b453ca26d0748175ea6b0c708cbb993fde
SHA512 2048c8a6cacbc44f9a481c00ee33cd78ca783a013895ed964ea79b815aae30d21f4e1bc6609181e4d4fd9c918d5722471c3b6e2694b11415e12b85d951e71bb5
SSDEEP 24576:MUK+cfYyt2FRwJpK2rVf1Y+9TGRHkXJILs2ToJpO93X0zA28dIsNoLs9Lqy:W+tRwJw2xNY+9TGREXyLscdIsNp
TLSH
T125955B52E6F14148E46FC176CEC6D723EB717D0A62318ABB4110FE152F767628E2932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Q-Dir.lnk

Path C:\Users\Admin\AppData\Local\Temp\Q-Dir_tmp_folder_2019\Q-Dir.lnk
Size 1KB
SHA256 9ebb162aa895b549793c0c4399c9e66987f7730e178c1535d46c2fb085c946c0
MD5 2a3d50a1db945ec2a5091aa6e0310f37
SHA1 77353fda1fc25f1cf7b2133b954657bae1a46ca0
SHA512 f57914f5aa8807744b6b2c28e01de9efed46d8402c1676b8218058e652debfa912b9203d016142a0a6bd29718511b3aa5053e098620ad900b51cc2e552113c8a
TLSH
T12231A2240F9F2B74F3E2C27227714A138637B801E7582F4E40875AA256B551066A9F9F
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 702B
SHA256 888576f596cb0165719027dbe9741c84111317f9a51dfa8062ce70bc15b96b41
MD5 730751f3fe4ff0256f238dd04fdba607
SHA1 9453bda7aa8c8c388702dbacbd405112fff41701
SHA512 629d391b85bd4cad309bd12be6c8d2d10a88940f068c310770c641af83ef81e5cb91e33a670d47c6682a771bd8d1e60848918228c6c97f074b8eba64f039b3bd
TLSH
T11F017B5312C41E7F0441AA53EB3151C858F6BD08F25AE54D59564C48CC4CD1BA945F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 730B
SHA256 db511f587a7b701f1851bfa429abeef99621f4ee4451e957062504a63d66b5c9
MD5 01d502ec71eb6387c012a33751840610
SHA1 36ec8b6ff8bae9182702efce9ea1b75bcbf31b13
SHA512 7f455813cf1b9516702cd2905b61ed397467740f0b57bbe0d0cc8c54d444ff736c2fb416d78401955f7e0b6f4a7b39af51f831b81bcc5089878dc2e197338930
TLSH
T17501CB5316C55E7F0441AA93EB3291C898F6BD09F25BF50E59670C08DC0DD1BB985F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 746B
SHA256 602866ad3d8d1a267b54ece4da507f25bd63fd094fc17ef8e154164e7be62683
MD5 796a62cce8b40fa21c3b0c62fc40a1c6
SHA1 3508338bb65dde1d93afe9bb776f7fea3965de97
SHA512 1423bda536de63f01a37526a969132d6a393c878355f22d802dd16e52a82d97100802eb7ca217033627849eb134dbd5200590bc615fac987fca7c43ec6734bd5
TLSH
T1A201105302C41E7F0441AA93EB3251C858F67D09F25BF90E05570C08DC4CD1B7985F07
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 41B
SHA256 2393c827d804b3e3cf41987e2a83052314a18a17bff17bf0b74614e7654008cc
MD5 cb328f973cbde9d61ccc80d6678841e5
SHA1 e6891866ef44cb9834a482fa8f10ec5822baa0d7
SHA512 462d33a751decdecf5e98f173e4d78e7a7cdf2c793773b1ba4621d1416cbe26d34da717ad22bb40a03318321dbe52d1a80f8317e031301382abe05e7ff3e280c
MD5 SHA1 SHA512

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 661B
SHA256 2c800ce973bd55f4dbfa1bb0e65831f718a3bb3b47d4f6bd3faaf06d82a369e8
MD5 39ec17606517a684193339deac001710
SHA1 789f23d0a31a41acc2cc823bd54b38710b5fc1a2
SHA512 d88647f8ca6eb526d62671b55c5b64d87dc57f40a23ca0224e9834e2a8527b7663dbc086ca3c9a8b972bcfb1f4415bc4110af27b52097e534580011fe781a4c2
TLSH
T14001DD5312C41E3F0440AFA3EB31518828F6BE08F28BE50E15564C48CC0CD1B7D81F0B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1376-6-0x0000000002320000-0x0000000002321000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads