7cb768a2d39bac00e8b81e32f2f06b75394e701f0943643a993a5bfe033ce263

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_c5d87597d3793f1f23d578186d2dd52e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Size 8.4MB
Sample260820-rysvzadr2w
SHA256 7cb768a2d39bac00e8b81e32f2f06b75394e701f0943643a993a5bfe033ce263
MD5 c5d87597d3793f1f23d578186d2dd52e
SHA1 515d9410e3205ac77b6d9900ea609c6b0cf879e5
SHA512 1a3bf285cdeb591b2909eaa4ca759f0a50c03f1b94e3af2d59305c47d64f0aa7e0fccdba12f5b38889d552d1cfebfdb180b40df716e82b47fe1b4b9431cc93b6
SSDEEP 196608:y17NVlAnhjTawnjp4HEmSXHzZCu/gxc4jPI6OBOCXyFkha:Dx4HPSDouJ4jPsBHwN
TLSH
T1509612D0F224F519E7650131882536A8596B1E303745D9A7BE8F7AC189782E3AEF0F73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery spyware

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4992	setup.exe
5744	Q-Dir.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe
File created	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe
File created	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_c5d87597d3793f1f23d578186d2dd52e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Control Panel\Colors	Q-Dir.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\TypedURLs	Q-Dir.exe

Modifies registry class 29 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	Q-Dir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 = 7e00310000000000e95c937e11004465736b746f7000680009000400efbee95c2f72145da0742e0000007b0000000000020000000000000000003e0000000000511527014400650073006b0074006f007000000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370036003900000016000000	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 7800310000000000e95c2f721100557365727300640009000400efbe8158a93a145d93742e000000880600000000010000000000000000003a0000000000c450ec0055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 5000310000000000e95c407f100041646d696e003c0009000400efbee95c2f72145d93742e0000007100000000000200000000000000000000000000000091c9bd00410064006d0069006e00000014000000	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 19002f433a5c000000000000000000000000000000000000000000	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\NodeSlot = "2"	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\MRUListEx = ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Q-Dir.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Q-Dir-Admin-Test	Q-Dir.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\Q-DIR-ADMIN-TEST	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Q-Dir.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5744	Q-Dir.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 4992	2316	2026-08-20_c5d87597d3793f1f23d578186d2dd52e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe	89
PID 4992 wrote to memory of 5744	4992	setup.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-20_c5d87597d3793f1f23d578186d2dd52e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_c5d87597d3793f1f23d578186d2dd52e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Users\Admin\AppData\Local\Temp\7zSC09A6769\setup.exe
  .\setup.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:4992
- - C:\Program Files\Q-Dir\Q-Dir.exe
    "C:\Program Files\Q-Dir\Q-Dir.exe"
    3⤵
    - Executes dropped EXE
    - Modifies Control Panel
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    PID:5744

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC09A6769\setup.exe
Size 1.8MB
SHA256 98b7edf8b4cf2b3da93a001b1e909d2195eebfa91742323473d9bc7e4bbdaa48
MD5 d49f1d732785e2e78f150bc53114c862
SHA1 3fb417b453ca26d0748175ea6b0c708cbb993fde
SHA512 2048c8a6cacbc44f9a481c00ee33cd78ca783a013895ed964ea79b815aae30d21f4e1bc6609181e4d4fd9c918d5722471c3b6e2694b11415e12b85d951e71bb5
SSDEEP 24576:MUK+cfYyt2FRwJpK2rVf1Y+9TGRHkXJILs2ToJpO93X0zA28dIsNoLs9Lqy:W+tRwJw2xNY+9TGREXyLscdIsNp
TLSH
T125955B52E6F14148E46FC176CEC6D723EB717D0A62318ABB4110FE152F767628E2932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Q-Dir.lnk

Path C:\Users\Admin\AppData\Local\Temp\Q-Dir_tmp_folder_2019\Q-Dir.lnk
Size 1KB
SHA256 d497d8ed0253d1324ce32ce709d5bdd6e6472f59f963943013e3d444cea3e3ca
MD5 0148f3e28cc6038ac3e220f955de32e8
SHA1 6635d4a2241050641bedec3bf8c43634e4c158be
SHA512 1c380c54981fb5157abc19c2db66c35bb8f00e673ee6fa9b172bfede75fe2e98624053900b22b830d05aba0450c531169a5ba3083a45c69c1228062011101902
TLSH
T1DD31F2140F9F2B24F3A2C271577146138237B810E69C2F4940875AA265B451066ACF9A
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 683B
SHA256 b04f93aea66685fa5375c7a0b225ff9b63d0028b367c2338e59f443e638301b6
MD5 cc94d4d8870757580edaa5d61f8d0f7d
SHA1 ba80b5cd9e500b71d840714727d81d92107d68d8
SHA512 7f6b708b96b5b058c87a179cca668cb7f1d9afe582183033bb3e4f31209da2080827c29a37b3aaef243f38f0084d4758cf6bbb71dc112ba5a9ddae04adcdcb4b
TLSH
T15201995302C81E3F0440ABA3EB3292C868F6BE08F29AE54D59564C48CC5CD1B7D85F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 702B
SHA256 dd8030d55da87718b318ab31a4ddf0408dab8c6259c2e1b55e84cc1589645bb8
MD5 21d0575db837eea9f12f9a3749346c83
SHA1 85626f51d9328ef26d2bea48c0244ec2f9016e29
SHA512 86b514b205eb31e0aaa6e2d00152a4abcfba747f66225a59a3627612aac20321ba6b9d469605be2f40af2c80b0c7f2fae249035a602940d61e5e74f67642298f
TLSH
T1E5017B5302C41E7F0440AA63EB3151C858F6BE08F29AE54D59564C48CC5CD1BBD45F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 730B
SHA256 c14136603425fa60ab7bac301813630bc359261185c6f9f9ee7d7872c877723e
MD5 b4a423215b7d269e8ff4c22a6200a825
SHA1 27ea096bc3447ac41cbab86a10c70239bca11221
SHA512 eb5dcf829e089892982d878f8e5c8ad0d96043dd45ed649698921172d48fd93f6ee16b280185f109dbc821dc79fd05d3157cb6768ebcb044eb442710f65b9c39
TLSH
T18501CB5306C45E7F0441AAA3EB3292C898F6BE08F29AF90D59670C08DC0DD1BBD85F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 746B
SHA256 5f48d5e839ba0fc3f9daea0abe7e3ffd7dfe7b4780aae357ba88d5dd50fa3213
MD5 88becb19c0b8cea72a7a2ef2d6e1eb0b
SHA1 0efd8d6a90bf772cdb346a83896b882f24daaf68
SHA512 40d6e6de56247b813fdf50114f215b9d06197ba7c8a1554c9497573dc61579191827bfddf752c25fb5b33b6b909e8061f4fd8f05ea571003ea632b1d39600135
TLSH
T1E001DC5302C41E7B0440AAA3EB3252C858F67D08F29AF90D05560C08DC4CD1B7985F07
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 41B
SHA256 489382a6466c508dac7aa965c53cfe5d6e1cc5dd5bdeafa86d3ede0858ef1270
MD5 20c28b8997426643102ea68e23797416
SHA1 e1cf29b57812d9b140d8c405da30230460cf0b34
SHA512 1bc0ce18101828f7b6708ca7edd0e0720346294491c8e6011a9ed64c0a8111251d0f5c0592905a884e23b980fbfb61c979e881ed2a364b787176ce2fea93ed8f
MD5 SHA1 SHA512

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 661B
SHA256 ed489a20d68c44a9b67803acc8873bac021af5624128982aace8c4700d148319
MD5 14b2046c0ffb58e057bb36dce2f13c49
SHA1 2fb64a2b7333a99e7e477dfb90cf40d7c79b419c
SHA512 78a475d4b7ba15c34cff8bdfdafcaff6ebbe63348feca0fc15f3669102be2091c67b13cf7b292aadaf3a122737aa8acaf62141aa7ec120b8ce23b7bce586f2f1
TLSH
T18B01994302C81E3B0440ABA3EB31528828F6BA08F28AE50D15564C48CC0CC1B7C81F0B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4992-6-0x0000000002310000-0x0000000002311000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads