55b0408fdae5845554b59e4971a02b53746336001f38e577e151ca4c50bc7b7c

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 03:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_e3db4c78c9c5dd59b12860844bfb15d4_amadey_dragonforce_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Size 9.4MB
Sample260828-edjekssxa1
SHA256 55b0408fdae5845554b59e4971a02b53746336001f38e577e151ca4c50bc7b7c
MD5 e3db4c78c9c5dd59b12860844bfb15d4
SHA1 073b7e0863034d76e058cdd3e916581f0965625e
SHA512 6d25df9e168f92eff9fccb6f7d1a4f2ca9e022553d4295e43cd63f4f51bcd8c3ad26915769f189e482b7b11d4a146c35d7311f30a592a2548dc6a0768e352b99
SSDEEP 196608:8oRHdmQxNnp/e7ISNb9uo9aydoQOla67aczsl7nJQSZXyFkhH:fEQxN1apj9ayqQOE6jOVNwc
TLSH
T1D7A62390B625F459E7A5013088247AA844676E303751DCEBFF8B3AD629781D3ADB1F33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery spyware

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4580	setup.exe
4064	Q-Dir.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe
File created	C:\Program Files\Q-Dir\Q-Dir.exe	setup.exe
File created	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Uninstall Q-Dir.lnk	setup.exe
File created	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe
File opened for modification	C:\Program Files\Q-Dir\Q-Dir_Uninstall.ini	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_e3db4c78c9c5dd59b12860844bfb15d4_amadey_dragonforce_elex_luca-stealer_lynx_njrat_smoke-loader.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Control Panel\Colors	Q-Dir.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\TypedURLs	Q-Dir.exe

Modifies registry class 29 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Q-Dir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\MRUListEx = ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 = 7e00310000000000e95cd97c11004465736b746f7000680009000400efbee95c33721c5d341e2e0000005d0000000000020000000000000000003e00000000009c7f73004400650073006b0074006f007000000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370036003900000016000000	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Q-Dir-Admin-Test	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 19002f433a5c000000000000000000000000000000000000000000	Q-Dir.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\NodeSlot = "2"	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 7800310000000000e95c33721100557365727300640009000400efbe8158a93a1c5d301e2e000000880600000000010000000000000000003a00000000009a2bbd0055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 5000310000000000e95c847d100041646d696e003c0009000400efbee95c33721c5d301e2e00000053000000000002000000000000000000000000000000da50d700410064006d0069006e00000014000000	Q-Dir.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = 00000000ffffffff	Q-Dir.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Q-Dir.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\Q-DIR-ADMIN-TEST	Q-Dir.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4064	Q-Dir.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 4580	4964	2026-08-27_e3db4c78c9c5dd59b12860844bfb15d4_amadey_dragonforce_elex_luca-stealer_lynx_njrat_smoke-loader.exe	89
PID 4580 wrote to memory of 4064	4580	setup.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-27_e3db4c78c9c5dd59b12860844bfb15d4_amadey_dragonforce_elex_luca-stealer_lynx_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_e3db4c78c9c5dd59b12860844bfb15d4_amadey_dragonforce_elex_luca-stealer_lynx_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Users\Admin\AppData\Local\Temp\7zS463F5C39\setup.exe
  .\setup.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:4580
- - C:\Program Files\Q-Dir\Q-Dir.exe
    "C:\Program Files\Q-Dir\Q-Dir.exe"
    3⤵
    - Executes dropped EXE
    - Modifies Control Panel
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    PID:4064

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS463F5C39\setup.exe
Size 1.8MB
SHA256 98b7edf8b4cf2b3da93a001b1e909d2195eebfa91742323473d9bc7e4bbdaa48
MD5 d49f1d732785e2e78f150bc53114c862
SHA1 3fb417b453ca26d0748175ea6b0c708cbb993fde
SHA512 2048c8a6cacbc44f9a481c00ee33cd78ca783a013895ed964ea79b815aae30d21f4e1bc6609181e4d4fd9c918d5722471c3b6e2694b11415e12b85d951e71bb5
SSDEEP 24576:MUK+cfYyt2FRwJpK2rVf1Y+9TGRHkXJILs2ToJpO93X0zA28dIsNoLs9Lqy:W+tRwJw2xNY+9TGREXyLscdIsNp
TLSH
T125955B52E6F14148E46FC176CEC6D723EB717D0A62318ABB4110FE152F767628E2932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Q-Dir.lnk

Path C:\Users\Admin\AppData\Local\Temp\Q-Dir_tmp_folder_2019\Q-Dir.lnk
Size 1KB
SHA256 ad24e6c09dfe703daf1c239746b950d5e42e64c6da015daa4a3a3afda2ae4a74
MD5 bdbbb5d083ddd947a1e30e9321c0648b
SHA1 bbd6080a4ebe6d2cf142bab9bcd83b017a44e319
SHA512 df2a88ccacec4cb14d40a27cfc296d00b0bf57ec1924a20642af0a3d4867f2ef2dbd51fa71b181aab89a5ebf591a57a2cf59faee80500faec12b0345ef29a7c0
TLSH
T18B31D6140FDF2B74F3A3C175177156138237B855F75C2F4D40875BE255B051062A9F5A
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 683B
SHA256 150e33ba3618a41d109084dcbd77a58a2cb41659c310432f034d2824b61f0918
MD5 102c006f7350a79567d5396684bce66c
SHA1 508de42d7a93309c9f9d009fd776ac244f7a18a7
SHA512 a166c5dc1d2913b14aeeb665a04de861b54e0727da16c8319eb9a7abb7357aa1ed5fb7e38b8e9d5053e15627e3d6af0d668b3f30dd0f7db3cf2fd19baacc7857
TLSH
T15301995702C41E7F0440ABA3EB3291C868F6BE08F29AF54D59564C48CC4CD1BBD82F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 702B
SHA256 785f4c479d2747ff834c84b297ce4c5719b5906a17edd550477ca8a90defe3bb
MD5 2d06594136c75a7e6e1916e67de93e84
SHA1 452d7c7e3b43cff55ba08d1061ed682f86949f96
SHA512 bb02e8646cd1c06b7be142f3939fbf394ac3f5d35929ba1f1c05a22a24073f13205549540ef193d097313f72abf037dcfe46c5b56b193b090915526880c76fe5
TLSH
T101017B5702C41E7F0440AA53EB3151C558F6BE08F25AF54D59564C48CC4CD1BAD85F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 730B
SHA256 4f708d86374887ec863f06fca13ea2b49e24fa605b9631e17d93c1849c141f69
MD5 84848e5f422176aa919535babd853544
SHA1 b46e771f0d702f49d7d2a5a98fa1d4f0ccac3e5b
SHA512 d6532e2c3f9e9242e5651382f8f361410834a0f8a97dd5110cbdcdd26d4a9bd761b27d2812e1b602c21f5b42bb81cddc4009157f04d551a7cc0e716e8356dc17
TLSH
T10201CB5306C45E7F0441AA93EB3291C498F6BE08F25AF50D59670C48DC4DD1BBD86F0B
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 746B
SHA256 b785a34480b918cc89e0befdcf96fef0cb723e0558d3ac2bf2dc3ee42f22994a
MD5 f2b71a7750373f4aac93c10cd1446691
SHA1 52252ac3f7840bb1e3bcd0091f20518cb9aabf56
SHA512 f358d6efd425dd16866ca83a0130debc79bf78dea9724391880d72608c982975bb87c32c498273d46c8d55d2372d59e70d573fdb508d0d30a172f86ce51fd160
TLSH
T12201DC5302C41E7F0440AA93EB32518858F67D08F25AF90D45560C08CC4CD1B6986F07
MD5 SHA1 SHA512 TLSH

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 41B
SHA256 865a1c7a1449b96bebde7868643f9b6c0a4b5731cbb4ae0dcef9fc3ee126207a
MD5 e7622b2bdac27e0344a4b5fdcac11321
SHA1 09473c9b37269efe1792480e8ee5d1190957c3fe
SHA512 18e2a5a8ae372b546bcb9268319810ebf056c3ec2d69dbe1e4103be02b1d0c47f025d8248fee0c0f6529fd2aaa631e885ec302c12ce4d87efede03acb0a36337
MD5 SHA1 SHA512

Submit Download

Q-Dir.ini

Path C:\Users\Admin\AppData\Roaming\Q-Dir\Q-Dir.ini
Size 661B
SHA256 77d4b5ec27a9083c09364eb57278a2a42ea0a26a445972af1038540e381ae88f
MD5 b1e024158ff4f98098a0cf4a9f88caa2
SHA1 c597c94a8b14ce362f8fbf48a29d618aa2f64065
SHA512 ef2cd3b18e96ff3d03f0da69412208d17b6dfebae49f0c32b6d031bc36239d3dfc228b2d11220926ae378224d6aeccb268865ca5e1a6da71cf6817ea0e476986
TLSH
T1E9017D5716C45E3F4440BBA3EB31518968F6BE08F69BE54D55564C48CC4CD1B7D82F0B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4580-6-0x0000000002320000-0x0000000002321000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads