263a46bfae2cefe1ab9b76aede59fd5ded245aeb840e47281a93f926802a7057

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 18:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_3f8b7b305e2748a8ff220593882c9ecb_amadey_elex_luca-stealer_lynx_njrat.exe
Size 8.4MB
Sample260818-wrhtmsfj91
SHA256 263a46bfae2cefe1ab9b76aede59fd5ded245aeb840e47281a93f926802a7057
MD5 3f8b7b305e2748a8ff220593882c9ecb
SHA1 276223c673c6396ab04376e21c66b7ef17de8e27
SHA512 09255b4d77cdf7273345d5f5c570c946deacd3a4984e94436e84a4b327e42fa16551e2340482b648af8f91aff5393be690d1bd9a03beb6e866fa987112221bbb
SSDEEP 196608:5pVwr6OgV6kABvdp5bMSgpt0U1D8B0yErIoDzZnRMHp2OrXyFkhs:yZvR90t1QB0FIutWEOrw7
TLSH
T19F9622C4B564F619E75201308828B66459262E303B85D8E7FF8F76C549782E3AEB1F73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery spyware

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4192	setup.exe
2908	Q-Dir.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe
File created	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe
File created	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_3f8b7b305e2748a8ff220593882c9ecb_amadey_elex_luca-stealer_lynx_njrat.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Control Panel\Colors	Q-Dir.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\TypedURLs	Q-Dir.exe

Modifies registry class 29 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 19002f433a5c000000000000000000000000000000000000000000	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0	Q-Dir.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\Q-DIR-ADMIN-TEST	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 5000310000000000e95cb67d100041646d696e003c0009000400efbee95c3172125d2a912e0000005300000000000200000000000000000000000000000023af1601410064006d0069006e00000014000000	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 7800310000000000e95c31721100557365727300640009000400efbe8158a93a125d2a912e000000880600000000010000000000000000003a00000000003ef0970055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\MRUListEx = ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Q-Dir.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Q-Dir-Admin-Test	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 = 7e00310000000000e95cd57c11004465736b746f7000680009000400efbee95c3172125d2f912e0000005d0000000000020000000000000000003e0000000000b64c44004400650073006b0074006f007000000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370036003900000016000000	Q-Dir.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\NodeSlot = "2"	Q-Dir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	Q-Dir.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2908	Q-Dir.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 4192	4372	2026-08-18_3f8b7b305e2748a8ff220593882c9ecb_amadey_elex_luca-stealer_lynx_njrat.exe	89
PID 4192 wrote to memory of 2908	4192	setup.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-18_3f8b7b305e2748a8ff220593882c9ecb_amadey_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_3f8b7b305e2748a8ff220593882c9ecb_amadey_elex_luca-stealer_lynx_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Users\Admin\AppData\Local\Temp\7zS411A3B29\setup.exe
  .\setup.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:4192
- - C:\Program Files\Q-Dir\Q-Dir.exe
    "C:\Program Files\Q-Dir\Q-Dir.exe"
    3⤵
    - Executes dropped EXE
    - Modifies Control Panel
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    PID:2908

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS411A3B29\setup.exe
Size 1.8MB
SHA256 98b7edf8b4cf2b3da93a001b1e909d2195eebfa91742323473d9bc7e4bbdaa48
MD5 d49f1d732785e2e78f150bc53114c862
SHA1 3fb417b453ca26d0748175ea6b0c708cbb993fde
SHA512 2048c8a6cacbc44f9a481c00ee33cd78ca783a013895ed964ea79b815aae30d21f4e1bc6609181e4d4fd9c918d5722471c3b6e2694b11415e12b85d951e71bb5
SSDEEP 24576:MUK+cfYyt2FRwJpK2rVf1Y+9TGRHkXJILs2ToJpO93X0zA28dIsNoLs9Lqy:W+tRwJw2xNY+9TGREXyLscdIsNp
TLSH
T125955B52E6F14148E46FC176CEC6D723EB717D0A62318ABB4110FE152F767628E2932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Q-Dir.lnk

Path C:\Users\Admin\AppData\Local\Temp\Q-Dir_tmp_folder_2019\Q-Dir.lnk
Size 1KB
SHA256 4762d54f8735a7f78b0d73911bb1e100ed62828e3495c662eaf0923a6ab66c8b
MD5 a3cf1abd44830143d15d7c8e1185897b
SHA1 f19f980b293165dd5a779a8064658a4183abe028
SHA512 e0dc8b1fab0662c75b50651057f18287482ff8ea2c65b1ec61a329c57ef1fbe98d12a10c066f069597ab2c222db868ab8e36baba634a39d971ab36c397433bef
TLSH
T16031D6240F9F2B74F3E3C275177146134237B845F7592F4E408756A255B052062EDF5B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 683B
SHA256 a7af506e0bf8a8d65fc49f89554b92c7c6b6e05322c531954633c85afd00589b
MD5 3a5ee82f8f3aceb82b1ee39d9aed3de2
SHA1 55868107f357c6dd98dc509e9aa711d8193d7ff6
SHA512 992790348625301ef5425d564db77b037aebdf2e01b50c5d149e7541e6552b59d2575d5ddd16b51642ad5e6fe55d35951fcf062ed4d77eecf155e38cf120605c
TLSH
T1D501995702C45E3F0440ABA3EB3291C868F6BE08F29AE55E59664C48CC5CD1B7D85F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 702B
SHA256 7076ee0826053a456ae8d086d62374be5ed38fee9ecb780b040bb7555b1a34c1
MD5 b63be0bfb1be658ba7ad91daf5450735
SHA1 a954c8061d74e87c3a2ed90612ec87c75502136c
SHA512 e8d5587fc9fea1904fd0a99e5c8a5925dd874840e490b93f5bddc0dad04963acaaf3864a3bf401c62ea98a6a21d84e4e97513fe898876c46f1cbdfc890e1860f
TLSH
T14901765702C45E7F0440AAA3EB3291C868F6BE08F29AE95E59664C48CC5CD1BB985F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 41B
SHA256 4c14796b1a7feab26e790fe7f789e850cee22b9d2d943b7bb8aa1b454009de66
MD5 ee5708d638ed1999d52d7e83aa900014
SHA1 df864856b0fa8ec6480dd03d09bf37bbc60d232e
SHA512 f952cf2fe7597c9e89f60e389309a8dade3ace13cd6b7d2ccabc878c93a15eec6464fff3469386fa93746ff73653aea3fa27a77506a832faee166559ba08bf0d
MD5 SHA1 SHA512

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 730B
SHA256 e67807f09f1fd4d34f4bf1cbe81a646878ecc992bff121699e6a1f64daa691b7
MD5 95e70e486f0ca1c8a75dad6dbe50e1f6
SHA1 5f29ee499d83995b6438d1efaa21e68d5773d9ed
SHA512 ea27cc03f77af520d5b9d3538f7b58dd42fb1fa5af8b266dcf1087c044b918e432e5cdede5f571b84a8dc156aea9fbba764280dc850c8fc9292ef648a61813ee
TLSH
T12201CB5306C45E7F0441AA93EB3291C4A8F6BD08F25AF51D59670C08DC0DD1BB985F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 746B
SHA256 cc4ebfbee0dc22014423ff0de57e19e1e518d6f92e37a32002f3904cb3205c3f
MD5 db187ddecfc831c06c341f104497d089
SHA1 f081e3b65471d56a6fd2c8cc0ae41812ecf7bd35
SHA512 9afd0a243baf95ad8c4f6c6ee88f2383b894546a2dd7325bbbf0a13ff16ef7a2904abae68d55ef4117b417001e37f6221a9c9e4e06c904fcaa86ea20a4fe3810
TLSH
T1B601105302C45E7F0440AA93EB3251C858F67D08F25BF91D45670C08CC4CD1B7985F07
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 199B
SHA256 d7b6c117356ff98770ec67944cee059c7d21a84a9fcdf33d588252f825bd16d3
MD5 29636a6f68fe90c8e4ff2eb34ae0358a
SHA1 7e40fe33347def2264f608b39cb476641a5e53ba
SHA512 e80ce0d2caae0a03b76771bc012e6721b56c85fa9a57c8fa680da048553a17fa4e07c1caa5494690e74eda46b20b781db95efd0bee2a1eafeae90b1927346781
TLSH
T19CD0C97612C8A34F881AF1E35776F19C94A0D548EBE92AA2CA5218CC5E9192CEE4902D
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 661B
SHA256 dd8b21bd80824164aaef0468c24aa57dba445203869bba2f5c98c6c0f71c177a
MD5 abf8090bc5a29cfbc2016d506d29be4a
SHA1 fabdf7d675beb710db10c650efdeeacdab1ccb5e
SHA512 809378ff074cbaafdfd5f9d1509df53ee752008156d328f3d609473e16b427305cd82a2ac9175ed242da133c6359ee2d1a35e2f1fb393831b8828540f8c2b647
TLSH
T11A01994702C45E3B0440ABA3EB31518828F6BA08F28AE50E55664C48CC0CC1B7C81F0B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4192-6-0x0000000002310000-0x0000000002311000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads