80b5510b8b05a3f0102ec9dc516e94ae0fca44c13ca87d81681a5bd6f7703971

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 15:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_2f5263c3a09562d6aaf5e8a387abfd30_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Size 8.4MB
Sample260819-s85sysxeqa
SHA256 80b5510b8b05a3f0102ec9dc516e94ae0fca44c13ca87d81681a5bd6f7703971
MD5 2f5263c3a09562d6aaf5e8a387abfd30
SHA1 e575d3603c2317dcf9c1b0f0b9487ee8e8542411
SHA512 77b81139bb299c0f44a1f37ea74fdb09d15f9722fdd63b185b67b362ee824dfaad92fcf97bfd5a901f85f57e9d5987570a3f7808288b4ea07a090f7d5013e473
SSDEEP 196608:oJSzBFYeAdiYIxR7piDoFrwF30QfhdOXyFkhf:hnoiYIHQDoq93Ows
TLSH
T1F89622D1F221F505E765013189286AB4487A2E303750D9E7FE8F76D299782D2AEB1F33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	setup.exe

Executes dropped EXE 2 IoCs

pid	Process
1556	setup.exe
3280	Q-Dir.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe
File created	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe
File created	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_2f5263c3a09562d6aaf5e8a387abfd30_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1556	1992	2026-08-19_2f5263c3a09562d6aaf5e8a387abfd30_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe	85
PID 1556 wrote to memory of 3280	1556	setup.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-08-19_2f5263c3a09562d6aaf5e8a387abfd30_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_2f5263c3a09562d6aaf5e8a387abfd30_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Users\Admin\AppData\Local\Temp\7zS8C7D6488\setup.exe
  .\setup.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:1556
- - C:\Program Files\Q-Dir\Q-Dir.exe
    "C:\Program Files\Q-Dir\Q-Dir.exe"
    3⤵
    - Executes dropped EXE
    PID:3280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS8C7D6488\setup.exe
Size 1.8MB
SHA256 98b7edf8b4cf2b3da93a001b1e909d2195eebfa91742323473d9bc7e4bbdaa48
MD5 d49f1d732785e2e78f150bc53114c862
SHA1 3fb417b453ca26d0748175ea6b0c708cbb993fde
SHA512 2048c8a6cacbc44f9a481c00ee33cd78ca783a013895ed964ea79b815aae30d21f4e1bc6609181e4d4fd9c918d5722471c3b6e2694b11415e12b85d951e71bb5
SSDEEP 24576:MUK+cfYyt2FRwJpK2rVf1Y+9TGRHkXJILs2ToJpO93X0zA28dIsNoLs9Lqy:W+tRwJw2xNY+9TGREXyLscdIsNp
TLSH
T125955B52E6F14148E46FC176CEC6D723EB717D0A62318ABB4110FE152F767628E2932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Q-Dir.lnk

Path C:\Users\Admin\AppData\Local\Temp\Q-Dir_tmp_folder_2019\Q-Dir.lnk
Size 1KB
SHA256 d703cf79a7e3b88f92b81b69913a0501fb0ebfb5cba78695122a29ade2e2baaa
MD5 370cbf6ddc265e9afebf556536c023ec
SHA1 41452caf339f7583a76d755966e92a950983206a
SHA512 4c0557d5ace6552e2b8ef6048fad2e2634bdba409a307fdcc7be7efca9954c1d657874fce70cba48c9cac216a37f11a5ef316bcb25c5680282d97b12a051690f
TLSH
T14F31D6240F9F2B64F3E2C27157B256134237BC14E79C2F4D40875BA265B152162ADF9B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 41B
SHA256 fd22f0e02ea013da3e87d4d0fa1c6da8332783e5c96c4d22eebd5ba57072b96d
MD5 d9581d2fe14d409b5f00db6bb72075ad
SHA1 b5e979094162020266290136c1d8b2fe18373bb9
SHA512 454272581bece59e5912120418ed1dabf66104f2898ad1907644077e70e4787b53f45f87137405f578ba3f7b374df8eee5d11442d9c8091d874fd283200e1439
MD5 SHA1 SHA512

Submit Download

memory/1556-5-0x0000000002270000-0x0000000002271000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads