Overview
overview
6Static
static
3Feather La....1.exe
windows7-x64
6Feather La....1.exe
windows10-2004-x64
6$PLUGINSDI...er.dll
windows7-x64
1$PLUGINSDI...er.dll
windows10-2004-x64
1$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...64.exe
windows7-x64
1$PLUGINSDI...64.exe
windows10-2004-x64
1$PLUGINSDI...ll.dll
windows7-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3Feather Launcher.exe
windows7-x64
5Feather Launcher.exe
windows10-2004-x64
5LICENSES.c...m.html
windows7-x64
1LICENSES.c...m.html
windows10-2004-x64
1d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows7-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows7-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows7-x64
1libGLESv2.dll
windows10-2004-x64
1resources/...up.exe
windows7-x64
1resources/...up.exe
windows10-2004-x64
1resources/elevate.exe
windows7-x64
1resources/elevate.exe
windows10-2004-x64
1vk_swiftshader.dll
windows7-x64
1vk_swiftshader.dll
windows10-2004-x64
1vulkan-1.dll
windows7-x64
1vulkan-1.dll
windows10-2004-x64
1$PLUGINSDI...ec.dll
windows7-x64
3Analysis
-
max time kernel
148s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13-06-2024 05:50
Static task
static1
Behavioral task
behavioral1
Sample
Feather Launcher Setup 1.6.1.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
Feather Launcher Setup 1.6.1.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240611-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/VC_redist.x64.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/VC_redist.x64.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/WinShell.dll
Resource
win7-20231129-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
Feather Launcher.exe
Resource
win7-20240419-en
Behavioral task
behavioral14
Sample
Feather Launcher.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
LICENSES.chromium.html
Resource
win7-20240611-en
Behavioral task
behavioral16
Sample
LICENSES.chromium.html
Resource
win10v2004-20240611-en
Behavioral task
behavioral17
Sample
d3dcompiler_47.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral18
Sample
ffmpeg.dll
Resource
win7-20240221-en
Behavioral task
behavioral19
Sample
ffmpeg.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral20
Sample
libEGL.dll
Resource
win7-20240220-en
Behavioral task
behavioral21
Sample
libEGL.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral22
Sample
libGLESv2.dll
Resource
win7-20240611-en
Behavioral task
behavioral23
Sample
libGLESv2.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral24
Sample
resources/app.asar.unpacked/native/cleanup.exe
Resource
win7-20240419-en
Behavioral task
behavioral25
Sample
resources/app.asar.unpacked/native/cleanup.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral26
Sample
resources/elevate.exe
Resource
win7-20240508-en
Behavioral task
behavioral27
Sample
resources/elevate.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral28
Sample
vk_swiftshader.dll
Resource
win7-20240611-en
Behavioral task
behavioral29
Sample
vk_swiftshader.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral30
Sample
vulkan-1.dll
Resource
win7-20240221-en
Behavioral task
behavioral31
Sample
vulkan-1.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral32
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20231129-en
General
-
Target
Feather Launcher.exe
-
Size
145.0MB
-
MD5
9ef1ecce599882119c5a0715f66dcc55
-
SHA1
f6e57a26c0f353ae14302a0a08eed0b4d8946619
-
SHA256
4d5066af522559245d0479e7d4ccc69a7f07de88aad84638d06815a6f4ad31e0
-
SHA512
f18f2e8b8cdab11305a33fce817715ebaf9d81b1eb4015e19aa1de7b53cc230b78b7b25af6151bdc6ad67c3ce763f294f8b61ecbb254a6ac0a2baea2fc8f0a3c
-
SSDEEP
3145728:9FJz+MnHejtWPrMYQWXPQdP57obOO4X7v+N303rVlZ:9FF+MnHejtWPrMYQWXPQdP57obOO4C6p
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Feather Launcher.exeFeather Launcher.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation Feather Launcher.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation Feather Launcher.exe -
Loads dropped DLL 1 IoCs
Processes:
Feather Launcher.exepid process 3532 Feather Launcher.exe -
Modifies registry class 7 IoCs
Processes:
Feather Launcher.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\feathermc Feather Launcher.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\feathermc\URL Protocol Feather Launcher.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\feathermc\ = "URL:feathermc" Feather Launcher.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\feathermc\shell\open\command Feather Launcher.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\feathermc\shell Feather Launcher.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\feathermc\shell\open Feather Launcher.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\feathermc\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Feather Launcher.exe\" \"%1\"" Feather Launcher.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
Feather Launcher.exeFeather Launcher.exeFeather Launcher.exepid process 1540 Feather Launcher.exe 1540 Feather Launcher.exe 4352 Feather Launcher.exe 4352 Feather Launcher.exe 3128 Feather Launcher.exe 3128 Feather Launcher.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Feather Launcher.exedescription pid process Token: SeShutdownPrivilege 1968 Feather Launcher.exe Token: SeCreatePagefilePrivilege 1968 Feather Launcher.exe Token: SeShutdownPrivilege 1968 Feather Launcher.exe Token: SeCreatePagefilePrivilege 1968 Feather Launcher.exe Token: SeShutdownPrivilege 1968 Feather Launcher.exe Token: SeCreatePagefilePrivilege 1968 Feather Launcher.exe Token: SeShutdownPrivilege 1968 Feather Launcher.exe Token: SeCreatePagefilePrivilege 1968 Feather Launcher.exe Token: SeShutdownPrivilege 1968 Feather Launcher.exe Token: SeCreatePagefilePrivilege 1968 Feather Launcher.exe Token: SeShutdownPrivilege 1968 Feather Launcher.exe Token: SeCreatePagefilePrivilege 1968 Feather Launcher.exe Token: SeShutdownPrivilege 1968 Feather Launcher.exe Token: SeCreatePagefilePrivilege 1968 Feather Launcher.exe Token: SeShutdownPrivilege 1968 Feather Launcher.exe Token: SeCreatePagefilePrivilege 1968 Feather Launcher.exe Token: SeShutdownPrivilege 1968 Feather Launcher.exe Token: SeCreatePagefilePrivilege 1968 Feather Launcher.exe Token: SeShutdownPrivilege 1968 Feather Launcher.exe Token: SeCreatePagefilePrivilege 1968 Feather Launcher.exe Token: SeShutdownPrivilege 1968 Feather Launcher.exe Token: SeCreatePagefilePrivilege 1968 Feather Launcher.exe Token: SeShutdownPrivilege 1968 Feather Launcher.exe Token: SeCreatePagefilePrivilege 1968 Feather Launcher.exe Token: SeShutdownPrivilege 1968 Feather Launcher.exe Token: SeCreatePagefilePrivilege 1968 Feather Launcher.exe Token: SeShutdownPrivilege 1968 Feather Launcher.exe Token: SeCreatePagefilePrivilege 1968 Feather Launcher.exe Token: SeShutdownPrivilege 1968 Feather Launcher.exe Token: SeCreatePagefilePrivilege 1968 Feather Launcher.exe Token: SeShutdownPrivilege 1968 Feather Launcher.exe Token: SeCreatePagefilePrivilege 1968 Feather Launcher.exe Token: SeShutdownPrivilege 1968 Feather Launcher.exe Token: SeCreatePagefilePrivilege 1968 Feather Launcher.exe Token: SeShutdownPrivilege 1968 Feather Launcher.exe Token: SeCreatePagefilePrivilege 1968 Feather Launcher.exe Token: SeShutdownPrivilege 1968 Feather Launcher.exe Token: SeCreatePagefilePrivilege 1968 Feather Launcher.exe Token: SeShutdownPrivilege 1968 Feather Launcher.exe Token: SeCreatePagefilePrivilege 1968 Feather Launcher.exe Token: SeShutdownPrivilege 1968 Feather Launcher.exe Token: SeCreatePagefilePrivilege 1968 Feather Launcher.exe Token: SeShutdownPrivilege 1968 Feather Launcher.exe Token: SeCreatePagefilePrivilege 1968 Feather Launcher.exe Token: SeShutdownPrivilege 1968 Feather Launcher.exe Token: SeCreatePagefilePrivilege 1968 Feather Launcher.exe Token: SeShutdownPrivilege 1968 Feather Launcher.exe Token: SeCreatePagefilePrivilege 1968 Feather Launcher.exe Token: SeShutdownPrivilege 1968 Feather Launcher.exe Token: SeCreatePagefilePrivilege 1968 Feather Launcher.exe Token: SeShutdownPrivilege 1968 Feather Launcher.exe Token: SeCreatePagefilePrivilege 1968 Feather Launcher.exe Token: SeShutdownPrivilege 1968 Feather Launcher.exe Token: SeCreatePagefilePrivilege 1968 Feather Launcher.exe Token: SeShutdownPrivilege 1968 Feather Launcher.exe Token: SeCreatePagefilePrivilege 1968 Feather Launcher.exe Token: SeShutdownPrivilege 1968 Feather Launcher.exe Token: SeCreatePagefilePrivilege 1968 Feather Launcher.exe Token: SeShutdownPrivilege 1968 Feather Launcher.exe Token: SeCreatePagefilePrivilege 1968 Feather Launcher.exe Token: SeShutdownPrivilege 1968 Feather Launcher.exe Token: SeCreatePagefilePrivilege 1968 Feather Launcher.exe Token: SeShutdownPrivilege 1968 Feather Launcher.exe Token: SeCreatePagefilePrivilege 1968 Feather Launcher.exe -
Suspicious use of WriteProcessMemory 48 IoCs
Processes:
Feather Launcher.exeFeather Launcher.exedescription pid process target process PID 1968 wrote to memory of 2040 1968 Feather Launcher.exe Feather Launcher.exe PID 1968 wrote to memory of 2040 1968 Feather Launcher.exe Feather Launcher.exe PID 1968 wrote to memory of 2040 1968 Feather Launcher.exe Feather Launcher.exe PID 1968 wrote to memory of 2040 1968 Feather Launcher.exe Feather Launcher.exe PID 1968 wrote to memory of 2040 1968 Feather Launcher.exe Feather Launcher.exe PID 1968 wrote to memory of 2040 1968 Feather Launcher.exe Feather Launcher.exe PID 1968 wrote to memory of 2040 1968 Feather Launcher.exe Feather Launcher.exe PID 1968 wrote to memory of 2040 1968 Feather Launcher.exe Feather Launcher.exe PID 1968 wrote to memory of 2040 1968 Feather Launcher.exe Feather Launcher.exe PID 1968 wrote to memory of 2040 1968 Feather Launcher.exe Feather Launcher.exe PID 1968 wrote to memory of 2040 1968 Feather Launcher.exe Feather Launcher.exe PID 1968 wrote to memory of 2040 1968 Feather Launcher.exe Feather Launcher.exe PID 1968 wrote to memory of 2040 1968 Feather Launcher.exe Feather Launcher.exe PID 1968 wrote to memory of 2040 1968 Feather Launcher.exe Feather Launcher.exe PID 1968 wrote to memory of 2040 1968 Feather Launcher.exe Feather Launcher.exe PID 1968 wrote to memory of 2040 1968 Feather Launcher.exe Feather Launcher.exe PID 1968 wrote to memory of 2040 1968 Feather Launcher.exe Feather Launcher.exe PID 1968 wrote to memory of 2040 1968 Feather Launcher.exe Feather Launcher.exe PID 1968 wrote to memory of 2040 1968 Feather Launcher.exe Feather Launcher.exe PID 1968 wrote to memory of 2040 1968 Feather Launcher.exe Feather Launcher.exe PID 1968 wrote to memory of 2040 1968 Feather Launcher.exe Feather Launcher.exe PID 1968 wrote to memory of 2040 1968 Feather Launcher.exe Feather Launcher.exe PID 1968 wrote to memory of 2040 1968 Feather Launcher.exe Feather Launcher.exe PID 1968 wrote to memory of 2040 1968 Feather Launcher.exe Feather Launcher.exe PID 1968 wrote to memory of 2040 1968 Feather Launcher.exe Feather Launcher.exe PID 1968 wrote to memory of 2040 1968 Feather Launcher.exe Feather Launcher.exe PID 1968 wrote to memory of 2040 1968 Feather Launcher.exe Feather Launcher.exe PID 1968 wrote to memory of 2040 1968 Feather Launcher.exe Feather Launcher.exe PID 1968 wrote to memory of 2040 1968 Feather Launcher.exe Feather Launcher.exe PID 1968 wrote to memory of 2040 1968 Feather Launcher.exe Feather Launcher.exe PID 1968 wrote to memory of 2040 1968 Feather Launcher.exe Feather Launcher.exe PID 1968 wrote to memory of 2040 1968 Feather Launcher.exe Feather Launcher.exe PID 1968 wrote to memory of 2040 1968 Feather Launcher.exe Feather Launcher.exe PID 1968 wrote to memory of 2040 1968 Feather Launcher.exe Feather Launcher.exe PID 1968 wrote to memory of 2040 1968 Feather Launcher.exe Feather Launcher.exe PID 1968 wrote to memory of 2040 1968 Feather Launcher.exe Feather Launcher.exe PID 1968 wrote to memory of 2040 1968 Feather Launcher.exe Feather Launcher.exe PID 1968 wrote to memory of 2040 1968 Feather Launcher.exe Feather Launcher.exe PID 1968 wrote to memory of 4004 1968 Feather Launcher.exe Feather Launcher.exe PID 1968 wrote to memory of 4004 1968 Feather Launcher.exe Feather Launcher.exe PID 1968 wrote to memory of 3532 1968 Feather Launcher.exe Feather Launcher.exe PID 1968 wrote to memory of 3532 1968 Feather Launcher.exe Feather Launcher.exe PID 3532 wrote to memory of 1540 3532 Feather Launcher.exe Feather Launcher.exe PID 3532 wrote to memory of 1540 3532 Feather Launcher.exe Feather Launcher.exe PID 3532 wrote to memory of 4352 3532 Feather Launcher.exe Feather Launcher.exe PID 3532 wrote to memory of 4352 3532 Feather Launcher.exe Feather Launcher.exe PID 1968 wrote to memory of 3128 1968 Feather Launcher.exe Feather Launcher.exe PID 1968 wrote to memory of 3128 1968 Feather Launcher.exe Feather Launcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Feather Launcher" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1648 --field-trial-handle=1720,i,11746450904075402571,11185391324448078348,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Feather Launcher" --mojo-platform-channel-handle=2000 --field-trial-handle=1720,i,11746450904075402571,11185391324448078348,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:82⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Feather Launcher" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --disable-blink-features=GetDisplayMedia --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2392 --field-trial-handle=1720,i,11746450904075402571,11185391324448078348,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:12⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe" C:\Users\Admin\AppData\Local\Temp\resources\app.asar\preload\preload-mod-watcher-fork.js3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe" C:\Users\Admin\AppData\Local\Temp\resources\app.asar\preload\preload-skin-watcher-fork.js3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\Feather Launcher" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2272 --field-trial-handle=1720,i,11746450904075402571,11185391324448078348,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3128
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.0MB
MD57c665f5be07c5c43fa97973838b6a8ce
SHA103a3d5c39fbe0c43fa1560ed63276d905b2b74e9
SHA2564b8df94e631f974b979086e9bc78395e3c95a813af55481dd2d89fc07ee64815
SHA512c36d241427f4f0ff8059d839288b0bb150c873a4f7f9d78816617efa74e4b59a7b27d219db224460ce9f1ecb874e2c89f9b75fb3ffb3e0c8720fd917610f9d1d
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84