Analysis
- user interaction
yes - max time kernel
57s - max time network
57s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
- submitted
23/05/2026, 22:08
General
- Target Windows Defender Authority Service.exe
- Size 2.0MB
- Sample260523-12cslabt4p
- SHA256 13e3abe804666c985820c5d0c687f71532e53079dcf322f133513ef2dc703fd2
Malware Config
Extracted
-
quasar
-
1.6.6
-
OMG
-
64.224.17.233:4782
-
1e865e9c-9766-4673-96e3-c2aa3d604119
-
encryption_key
2BE6327A2B03AED6322898941F4E6C7CA29DE8E5
-
install_name
.exe
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
-
startup_key
dllhost
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Detects DonutLoader 2 IoCs
- Quasar payload 1 IoCs
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies registry class 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Windows Defender Authority Service.exe"C:\Users\Admin\AppData\Local\Temp\Windows Defender Authority Service.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "WindowsDefenderAuthorityMaintenance" /tr "C:\Users\Admin\AppData\Roaming\Windows Defender Authority\Windows Defender Authority Service.exe" /sc ONLOGON /rl LIMITED /f /delay 0000:30 >nul 2>&12⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\Windows Defender Authority\Windows Defender Authority Service.exe"C:\Users\Admin\AppData\Roaming\Windows Defender Authority\Windows Defender Authority Service.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "dllhost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows Defender Authority\Windows Defender Authority Service.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Roaming\Windows Defender Authority\Windows Defender Authority Service.exe"C:\Users\Admin\AppData\Roaming\Windows Defender Authority\Windows Defender Authority Service.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
Windows Defender Authority Service.exe
memory/2232-45-0x00007FF679CD0000-0x00007FF679EDA000-memory.dmp
memory/4064-31-0x00000196FA330000-0x00000196FA340000-memory.dmp
memory/4064-3-0x00000196FA330000-0x00000196FA340000-memory.dmp
memory/4064-5-0x00000196FA330000-0x00000196FA340000-memory.dmp
memory/4064-6-0x00000196F9890000-0x00000196F98AE000-memory.dmp
memory/4064-7-0x00000196F9A70000-0x00000196F9AAA000-memory.dmp
memory/4064-8-0x00000196FA340000-0x00000196FA390000-memory.dmp
memory/4064-9-0x00000196FC180000-0x00000196FC232000-memory.dmp
memory/4064-10-0x00000196FA2C0000-0x00000196FA30A000-memory.dmp
memory/4064-12-0x00000196F9AB0000-0x00000196F9AD6000-memory.dmp
memory/4064-11-0x00000196FA390000-0x00000196FA3DE000-memory.dmp
memory/4064-13-0x00000196FA3E0000-0x00000196FA414000-memory.dmp
memory/4064-14-0x00000196FA420000-0x00000196FA46C000-memory.dmp
memory/4064-15-0x00000196FA470000-0x00000196FA4BA000-memory.dmp
memory/4064-16-0x00000196FA4F0000-0x00000196FA51A000-memory.dmp
memory/4064-1-0x00000196F93A0000-0x00000196F9585000-memory.dmp
memory/4064-42-0x00000196FC400000-0x00000196FC408000-memory.dmp
memory/4064-4-0x00000196FA520000-0x00000196FA702000-memory.dmp
memory/4064-41-0x00000196FC3F0000-0x00000196FC3FA000-memory.dmp
memory/4064-37-0x00000196FC410000-0x00000196FC44C000-memory.dmp
memory/4064-36-0x00000196FC3B0000-0x00000196FC3C2000-memory.dmp
memory/4064-34-0x00007FF679CD0000-0x00007FF679EDA000-memory.dmp
memory/4064-32-0x00000196FA330000-0x00000196FA340000-memory.dmp
memory/4064-33-0x00000196FA330000-0x00000196FA340000-memory.dmp
memory/4632-25-0x0000022895120000-0x0000022895121000-memory.dmp
memory/4632-24-0x0000022895120000-0x0000022895121000-memory.dmp
memory/4632-19-0x0000022895120000-0x0000022895121000-memory.dmp
memory/4632-26-0x0000022895120000-0x0000022895121000-memory.dmp
memory/4632-27-0x0000022895120000-0x0000022895121000-memory.dmp
memory/4632-28-0x0000022895120000-0x0000022895121000-memory.dmp
memory/4632-29-0x0000022895120000-0x0000022895121000-memory.dmp
memory/4632-30-0x0000022895120000-0x0000022895121000-memory.dmp
memory/4632-18-0x0000022895120000-0x0000022895121000-memory.dmp
memory/4632-20-0x0000022895120000-0x0000022895121000-memory.dmp
memory/4728-35-0x00007FF6B7AE0000-0x00007FF6B7CEA000-memory.dmp
memory/4728-17-0x00007FF6B7AE0000-0x00007FF6B7CEA000-memory.dmp