Analysis

  • max time kernel
    148s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    13-06-2024 05:50

General

  • Target

    Feather Launcher.exe

  • Size

    145.0MB

  • MD5

    9ef1ecce599882119c5a0715f66dcc55

  • SHA1

    f6e57a26c0f353ae14302a0a08eed0b4d8946619

  • SHA256

    4d5066af522559245d0479e7d4ccc69a7f07de88aad84638d06815a6f4ad31e0

  • SHA512

    f18f2e8b8cdab11305a33fce817715ebaf9d81b1eb4015e19aa1de7b53cc230b78b7b25af6151bdc6ad67c3ce763f294f8b61ecbb254a6ac0a2baea2fc8f0a3c

  • SSDEEP

    3145728:9FJz+MnHejtWPrMYQWXPQdP57obOO4X7v+N303rVlZ:9FF+MnHejtWPrMYQWXPQdP57obOO4C6p

Score
5/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Modifies registry class 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe
    "C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1736
    • C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe
      "C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Feather Launcher" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1028 --field-trial-handle=1072,i,13896981997678793146,11257211026828650657,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      2⤵
        PID:2596
      • C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe
        "C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Feather Launcher" --mojo-platform-channel-handle=1288 --field-trial-handle=1072,i,13896981997678793146,11257211026828650657,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
        2⤵
          PID:2488
        • C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe
          "C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Feather Launcher" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --disable-blink-features=GetDisplayMedia --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=1480 --field-trial-handle=1072,i,13896981997678793146,11257211026828650657,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
          2⤵
          • Checks computer location settings
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2640
          • C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe
            "C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe" C:\Users\Admin\AppData\Local\Temp\resources\app.asar\preload\preload-mod-watcher-fork.js
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:1628
          • C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe
            "C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe" C:\Users\Admin\AppData\Local\Temp\resources\app.asar\preload\preload-skin-watcher-fork.js
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:2108
        • C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe
          "C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Feather Launcher" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1236 --field-trial-handle=1072,i,13896981997678793146,11257211026828650657,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
          2⤵
            PID:1196

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\Feather Launcher\Local Storage\leveldb\CURRENT~RFf761b7c.TMP

          Filesize

          16B

          MD5

          46295cac801e5d4857d09837238a6394

          SHA1

          44e0fa1b517dbf802b18faf0785eeea6ac51594b

          SHA256

          0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

          SHA512

          8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

        • \Users\Admin\AppData\Local\Temp\827a484d-6aff-4f10-b145-b9dbee54c4d4.tmp.node

          Filesize

          7.0MB

          MD5

          7c665f5be07c5c43fa97973838b6a8ce

          SHA1

          03a3d5c39fbe0c43fa1560ed63276d905b2b74e9

          SHA256

          4b8df94e631f974b979086e9bc78395e3c95a813af55481dd2d89fc07ee64815

          SHA512

          c36d241427f4f0ff8059d839288b0bb150c873a4f7f9d78816617efa74e4b59a7b27d219db224460ce9f1ecb874e2c89f9b75fb3ffb3e0c8720fd917610f9d1d

        • memory/2596-1-0x0000000000060000-0x0000000000061000-memory.dmp

          Filesize

          4KB

        • memory/2596-31-0x0000000076E40000-0x0000000076E41000-memory.dmp

          Filesize

          4KB