61714aa62c9c56068731ba1a010112d5255754d437bdc2dc3542f0ba8b6307b5

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 12:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-24_5d2c2284c5bc6c9df278570b837f04a3_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Size 8.3MB
Sample260825-pnlb2ayway
SHA256 61714aa62c9c56068731ba1a010112d5255754d437bdc2dc3542f0ba8b6307b5
MD5 5d2c2284c5bc6c9df278570b837f04a3
SHA1 08dec37f4c3da44f280f9212dc8075c50899046c
SHA512 ca17b78881413e37d45f81b3633c42de2e4c29eacdf1756708384900829a78fe06956e1dbd52f4c68b33d6723fca0f66614f7fb01d9342a8f1ea974bae52d2c4
SSDEEP 196608:1etJSMYiRRlpB5OGSsi9AyLtgXsnbkXXnSr9LXyFkhM:AtcMYi777XaawtgXEbkHSpLw7
TLSH
T15B962280F221F564E355013188287AA459662D343781D9A7FF8F36D26A782D3EEF5B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery spyware

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
240	setup.exe
2612	Q-Dir.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe
File created	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe
File created	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe
File created	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-24_5d2c2284c5bc6c9df278570b837f04a3_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Control Panel\Colors	Q-Dir.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\TypedURLs	Q-Dir.exe

Modifies registry class 29 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 19002f433a5c000000000000000000000000000000000000000000	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Q-Dir.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Q-Dir-Admin-Test	Q-Dir.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\Q-DIR-ADMIN-TEST	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 5000310000000000e95c117a100041646d696e003c0009000400efbee95c3372195d95632e00000053000000000002000000000000000000000000000000ad2eac00410064006d0069006e00000014000000	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 7800310000000000e95c33721100557365727300640009000400efbe8158a93a195d95632e000000880600000000010000000000000000003a00000000009784270155007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 = 7e00310000000000e95c5c7911004465736b746f7000680009000400efbee95c3372195d99632e0000005d0000000000020000000000000000003e000000000028af23014400650073006b0074006f007000000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370036003900000016000000	Q-Dir.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\NodeSlot = "2"	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\MRUListEx = ffffffff	Q-Dir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	Q-Dir.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2612	Q-Dir.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 240	2080	2026-08-24_5d2c2284c5bc6c9df278570b837f04a3_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe	89
PID 240 wrote to memory of 2612	240	setup.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-24_5d2c2284c5bc6c9df278570b837f04a3_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_5d2c2284c5bc6c9df278570b837f04a3_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Users\Admin\AppData\Local\Temp\7zS028B5B79\setup.exe
  .\setup.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:240
- - C:\Program Files\Q-Dir\Q-Dir.exe
    "C:\Program Files\Q-Dir\Q-Dir.exe"
    3⤵
    - Executes dropped EXE
    - Modifies Control Panel
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    PID:2612

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS028B5B79\setup.exe
Size 1.8MB
SHA256 98b7edf8b4cf2b3da93a001b1e909d2195eebfa91742323473d9bc7e4bbdaa48
MD5 d49f1d732785e2e78f150bc53114c862
SHA1 3fb417b453ca26d0748175ea6b0c708cbb993fde
SHA512 2048c8a6cacbc44f9a481c00ee33cd78ca783a013895ed964ea79b815aae30d21f4e1bc6609181e4d4fd9c918d5722471c3b6e2694b11415e12b85d951e71bb5
SSDEEP 24576:MUK+cfYyt2FRwJpK2rVf1Y+9TGRHkXJILs2ToJpO93X0zA28dIsNoLs9Lqy:W+tRwJw2xNY+9TGREXyLscdIsNp
TLSH
T125955B52E6F14148E46FC176CEC6D723EB717D0A62318ABB4110FE152F767628E2932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Q-Dir.lnk

Path C:\Users\Admin\AppData\Local\Temp\Q-Dir_tmp_folder_2019\Q-Dir.lnk
Size 1KB
SHA256 9e1267cc93f943207c7028403d0878aa95d48ccc9a543cf7b2cb1e23acac7700
MD5 e43cfa4e9177bce8053cf702754a613a
SHA1 065d4792b8bd1d3582a888a5fa6f881054fb0a51
SHA512 ecca71924f4d88d03a8332026f9d77b9b145b8153b27b01600b422d67b176c4d8b3d7d4a6206eadd72c0066bdaa78a5ef9f2e524c00ce9a236f45b1b74dcd4ba
TLSH
T1BC31F2240FDF2B24F3E2C17517B146138237B801EA982F4D40879BA256B151166A9F5B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 683B
SHA256 fa730b6dd6aeb454f08895fcfcddf9ce04264372a32833aa2f49d07fc93ac61b
MD5 77013b41d5261324c0efd4539413a7e4
SHA1 a357d305377b47e333dc3526e910db43e28c5053
SHA512 9f8a91097f2172e0f85d348afc0ee30efff5e183277241ce4a66c34778318f07ddcc3eaeeb98996b3573d97a9e4770c6de3fdc00a40a4004b1f3b8962d3d83fc
TLSH
T15D01999306C45E3F0440ABA3EB3291C868F6BE08F29AE54E59564C48CC4CD1B7D86F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 702B
SHA256 c06d07896c73b75e4212d63d24fde183cbcb5c8d250eb0fe6d806e95604c1bdb
MD5 1d595ec7dbca658d03a7829d71b4ec60
SHA1 85fcb1bfca6c7ac74c0878184fa77e79ca576011
SHA512 3eab0848f42f9b7bd5b8f43f3c9ee239659377ccc92308f3f764a3449bc9b057549829845d79eca8fd11efa617c829966729dc2935c53a980c121cbfd84bf683
TLSH
T171017B5306C45E7F0440AA53EB3151C468F6BD08F25AE54D59564C48CC4CD1BA945F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 730B
SHA256 48922b4f7bcf23d8f864f8a2bafd0d2bcba17a924a7c71c737acef57f511ac42
MD5 18c8afb04bf85aed443cc3c0f0da9762
SHA1 734815a046e6eb3323d7788bac8f80b828e77689
SHA512 2cc9e8c43ee38cf81c140570444fa5298dae7c776ed156ffc8fd5f00cb45509ea5af99ed648a539464aaebd7aaa64a4896bdf1ea2f7990f7fbe5bd3f86810fba
TLSH
T1E601CB5306C45E7F0441AA93EB3291C4A8F6BD08F25AF50D59670C08DC4DD1BB986F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 746B
SHA256 8ea63f0b46725c237506d7bfc9db1831ebafeb7a5894b2f9dbb2fb696bb576b8
MD5 0e1bc1cd8371d287917df7c300224b27
SHA1 4d2ec33123142ee7f5c605b36c8aaf7057378c25
SHA512 f278ce2bda20a82415ae7cb0626b21fc56b6a854b845a9303c67ed20b1f03a6cb4d50c893af7e12d19788bd9194f03214edf3e22e3d354005f8079e040b95c53
TLSH
T10F01105306C45E7F0440AA93EB3251C858F67D08F25BF90D05570C08CC4CD1B7986F07
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 41B
SHA256 07e5f89a5b55003eb9739b81233ad32945bfb232ec89a9f4b7fe75732d08183d
MD5 00c12214bc205f1bb911aae720e43c2f
SHA1 3fa299de07b48286b610ff66a06e3e7be56be0e3
SHA512 fef091b1f6a6f0aefdb17e2a96e41895d746b9722afbccae48dc4fe50783dbbfba08b7a9220c408e54e9357434c220470af120fab7823c79f9ceacc371e031a6
MD5 SHA1 SHA512

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 661B
SHA256 6b1855dfd6383f3d3c45b7b22d41b09175ef8eabcb7618985d33fadf6b050934
MD5 ef5d54e163883a6efdb0b8cffe495b33
SHA1 8d921226719000b912d85bfd025cc4f1575aaf93
SHA512 5788fb3674b6204448d4594640e5fe85b7488b7ecbfcc07a735215bfeee82132ef6defd1e3b64a6c430847dba6f115bf2c9bc2b60b7b0bf47073e376485308db
TLSH
T13201DD8306C45E3F0440ABA3EB31518828F6BE08F28BE50E15564C48CC4CD1B7C82F0B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/240-6-0x00000000022E0000-0x00000000022E1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads