Overview
overview
10Static
static
7QZK RAT Fr...er.dll
windows10-2004-x64
1QZK RAT Fr...ll.xml
windows10-2004-x64
1QZK RAT Fr...er.dll
windows10-2004-x64
1QZK RAT Fr...es.dll
windows10-2004-x64
1QZK RAT Fr...ng.dll
windows10-2004-x64
1QZK RAT Fr...us.dll
windows10-2004-x64
1QZK RAT Fr...ox.dll
windows10-2004-x64
1QZK RAT Fr...er.bat
windows10-2004-x64
1QZK RAT Fr...rp.dll
windows10-2004-x64
1QZK RAT Fr...re.dll
windows10-2004-x64
1QZK RAT Fr...ms.dll
windows10-2004-x64
1QZK RAT Fr...UI.dll
windows10-2004-x64
1QZK RAT Fr...I2.dll
windows10-2004-x64
1QZK RAT Fr...ry.dll
windows10-2004-x64
1QZK RAT Fr...ry.dll
windows10-2004-x64
1QZK RAT Fr...VB.dll
windows10-2004-x64
1QZK RAT Fr...or.dll
windows10-2004-x64
1QZK RAT Fr...am.dll
windows10-2004-x64
1QZK RAT Fr...io.dll
windows10-2004-x64
1QZK RAT Fr...ip.dll
windows10-2004-x64
10QZK RAT Fr...ws.dll
windows10-2004-x64
5QZK RAT Fr...ne.dll
windows10-2004-x64
1QZK RAT Fr...AC.dll
windows10-2004-x64
1QZK RAT Fr...en.dll
windows10-2004-x64
1QZK RAT Fr...ks.dll
windows10-2004-x64
1QZK RAT Fr...at.dll
windows10-2004-x64
1QZK RAT Fr...um.dll
windows10-2004-x64
1QZK RAT Fr...AT.exe
windows10-2004-x64
7QZK RAT Fr...rs.dll
windows10-2004-x64
1QZK RAT Fr...fe.dll
windows10-2004-x64
1QZK RAT Fr...ib.dll
windows10-2004-x64
1Analysis
-
max time kernel
87s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
16-04-2023 14:14
Behavioral task
behavioral1
Sample
QZK RAT Free/Bug Fixer.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral2
Sample
QZK RAT Free/Bug Fixer.dll.xml
Resource
win10v2004-20230221-en
Behavioral task
behavioral3
Sample
QZK RAT Free/ConversionWrapper.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral4
Sample
QZK RAT Free/EPPlus.Interfaces.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
QZK RAT Free/EPPlus.System.Drawing.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral6
Sample
QZK RAT Free/EPPlus.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
QZK RAT Free/FastColoredTextBox.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral8
Sample
QZK RAT Free/Fixer.bat
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
QZK RAT Free/FontAwesome.Sharp.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral10
Sample
QZK RAT Free/GMap.NET.Core.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
QZK RAT Free/GMap.NET.WindowsForms.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral12
Sample
QZK RAT Free/Guna.UI.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral13
Sample
QZK RAT Free/Guna.UI2.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral14
Sample
QZK RAT Free/ICSharpCode.NRefactory.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral15
Sample
QZK RAT Free/ICSharpCode.SharpRefactory.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral16
Sample
QZK RAT Free/ICSharpCode.SharpRefactoryVB.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
QZK RAT Free/IconExtractor.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral18
Sample
QZK RAT Free/Microsoft.IO.RecyclableMemoryStream.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
QZK RAT Free/NAudio.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral20
Sample
QZK RAT Free/Plugins/7zip.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral21
Sample
QZK RAT Free/Plugins/ACTWindows.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral22
Sample
QZK RAT Free/Plugins/All-In-One.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral23
Sample
QZK RAT Free/Plugins/AskUAC.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral24
Sample
QZK RAT Free/Plugins/BlankScreen.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral25
Sample
QZK RAT Free/Plugins/Bookmarks.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral26
Sample
QZK RAT Free/Plugins/Chat.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral27
Sample
QZK RAT Free/Plugins/Chromium.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral28
Sample
QZK RAT Free/QZK RAT.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral29
Sample
QZK RAT Free/System.Numerics.Vectors.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral30
Sample
QZK RAT Free/System.Runtime.CompilerServices.Unsafe.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral31
Sample
QZK RAT Free/dnlib.dll
Resource
win10v2004-20230220-en
General
-
Target
QZK RAT Free/Plugins/ACTWindows.dll
-
Size
1.1MB
-
MD5
91c072b5c4eaf18b81d4c522f967df5c
-
SHA1
4290045e1382057ab339f3e0c269770714b5487b
-
SHA256
61451c536c1a5a9b2b676fa191c4a960d7952aff4cf8b3437860adcdedec3774
-
SHA512
03dba43bcb6f0ee1b82ed874a5a7ff7b94b2096e230f906927666438372f77a379301acbaa31c71a507dbd3e59944dab1fb4f8466a9808a6077719d33a99e540
-
SSDEEP
24576:AQ3sWYfdA5r6B/QIdMFmEADsHcxw6J6fG3tLVJnsdWUVSEPP:AQ8WIe5r61MFFADk+2fG3xPs40
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
rundll32.exepid process 1320 rundll32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
rundll32.exepid process 1320 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 376 wrote to memory of 1320 376 rundll32.exe rundll32.exe PID 376 wrote to memory of 1320 376 rundll32.exe rundll32.exe PID 376 wrote to memory of 1320 376 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\QZK RAT Free\Plugins\ACTWindows.dll",#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\QZK RAT Free\Plugins\ACTWindows.dll",#12⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1320-133-0x00000000745B0000-0x000000007494A000-memory.dmpFilesize
3.6MB